AI Credit Scoring in 2026: 7 Rules Under EU AI Act

Last updated: April 2026

What is AI credit scoring?

AI credit scoring is the application of machine-learning models — gradient boosting (XGBoost, LightGBM), deep neural networks, and since 2023 large language models — to the problem of estimating whether a loan applicant will repay. The output is a probability of default (PD), typically converted to an interpretable score, used by lenders to approve, reject, or price credit. The substantive shift from the old FICO-style logistic regression is twofold: AI models absorb many more features (up to thousands, including transaction narratives and device metadata), and they non-linearly interact features in ways a human underwriter cannot.

Two things make this topic distinctive in 2026. First, credit scoring is one of the eight practices that the EU AI Act explicitly lists as high-risk (Annex III, point 5b) — meaning obligations that do not apply to most other AI applications take effect on 2 August 2026. Second, the Schufa ECJ ruling (C-634/21, 7 December 2023) has already established that a score itself — not just the final decision that relies on it — counts as an automated individual decision under GDPR Article 22. Legal exposure is therefore not future-tense; it is live in any EU operation today.

How does AI credit scoring work?

An AI credit scoring pipeline has four stages. Each stage now has specific obligations under either the GDPR, the EU AI Act or the European Banking Authority’s 2023 guidelines on loan origination.

Traditional vs AI credit scoring

The distinction is not “AI replaces FICO” — FICO itself has added ML-based variants (FICO 10T, released 2020). The real shift is in how a model treats data and how a regulator treats the model. The table below summarises the operational deltas observed across US and EU lenders in 2024–2025.

The headline +27% thin-file approval number comes from the US Consumer Financial Protection Bureau’s 2023 review of Upstart (the largest US AI-only lender). Similar effect sizes are reported by LendingClub for near-prime borrowers. For EU readers this is partly aspirational — GDPR enforcement and the AI Act compliance cost make greenfield AI underwriting harder in the EU than in the US.

Why is AI credit scoring classified as high-risk under the EU AI Act?

Annex III, point 5(b) of Regulation 2024/1689 lists “AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud”. The classification reflects three distinct harms the regulator is trying to price in:

• Exclusion from credit is a welfare-relevant event. A false rejection on a mortgage or SME loan has material downstream effects — missed housing transitions, failed business expansions — that are not reversible when the model turns out to be wrong.
• Opacity of the decision undermines the contestation rights that GDPR already promises. A thousand-tree GBM cannot explain itself via coefficients; regulators have therefore imported explainability as a substantive obligation, not a nice-to-have.
• Disparate impact along protected characteristics (gender, ethnicity, age) is a well-documented failure mode of ML credit models when features correlate with protected classes. FinRegLab’s 2020 empirical study of five US lenders found unexplained disparate impact in all five even after removing protected features directly.

Concretely, from 2 August 2026 providers and deployers of AI credit scoring must implement: Article 9 (risk management system), Article 10 (data governance), Article 11 (technical documentation), Article 13 (transparency to deployers), Article 14 (human oversight), Article 15 (accuracy, robustness, cybersecurity), and register the system in the EU database under Article 49. The EU AI Office has stated in its March 2026 implementation guidance that the obligations apply to existing production models, not just greenfield deployments — a significant pressure on banks with legacy ML portfolios.

The Schufa ECJ ruling — what changed in December 2023

Germany’s Schufa is the largest consumer credit bureau in Europe; it issues scores used by almost every German lender. In case OQ v Land Hessen (C-634/21), decided 7 December 2023, the European Court of Justice ruled that producing such a score is itself an automated individual decision under GDPR Article 22 when the score “plays a determining role” in a credit decision — even if the downstream lender formally makes the final call.

The practical consequences for every EU AI credit scoring provider are four:

1. The score producer (not only the lender) needs a legal basis under Article 22(2) — consent, contract, or member-state law.
2. The applicant has a right to human intervention, to express their view, and to contest the score.
3. The applicant has a right to “meaningful information about the logic involved” — which the ECJ clarifies cannot be reduced to publishing the model’s input list.
4. The combination with Article 15 right of access means applicants can demand a copy of the score and the explanatory features that drove it.

This moves European AI credit scoring towards the American adverse-action notice regime (ECOA / FCRA), but with stronger process rights. For fintechs operating across the EU and the US, the compliance architecture is converging — which is arguably the main reason US-origin AI underwriters (Upstart, Pagaya) have moved cautiously on EU market entry.

Five real fintech use cases in 2025–2026

1. Upstart (US) — thin-file borrower approval

Upstart uses roughly 1,600 model features and has originated over USD 30 billion in loans through 2024. Its 2023 CFPB-reviewed results show +27% approvals vs a national bank’s logistic regression benchmark at equivalent default rate, and +43% for applicants under age 25. The pricing edge comes from segmenting the “grey zone” of FICO 620–700 that traditional scorecards collapse into a single risk tier.

2. Klarna (SE) — buy-now-pay-later real-time scoring

Klarna reviews each BNPL transaction in under 200 ms across 150+ million consumers. The scoring combines transaction graph features (recipient merchant, basket composition, velocity) with a proprietary gradient-boosting model. Swedish data protection authority IMY opened an investigation in 2024 into Klarna’s compliance with GDPR Article 22 post-Schufa; at time of writing the case is pending.

3. LendingClub (US) — re-underwriting with alternative data

LendingClub’s 2024 results cite the use of cash-flow data via Plaid (US open-banking equivalent) for second-look underwriting. The described lift is roughly +10% approvals on previously declined applicants with minimal default-rate deterioration, broadly aligning with FinRegLab’s 2020 multi-lender study.

4. Revolut Bank (LT / EU) — internal credit decisioning

Revolut runs a full-stack ML credit engine for its Lithuanian banking licence covering overdrafts, cards and personal loans across the EU. The Bank of Lithuania’s 2024 supervisory review noted the need for “enhanced explainability and human-in-the-loop controls” — a direct anticipation of Article 14 of the AI Act. Revolut’s public disclosures emphasise SHAP-based reason codes and a human review queue for every declined applicant above a defined threshold.

5. Aasa Polska — PL consumer lending

Aasa and similar Polish non-bank lenders rely on ML for rapid online underwriting, working under KNF supervision and the Polish consumer credit act (ustawa z 12 maja 2011 r., Dz.U. 2011 nr 126 poz. 715). UOKiK’s 2024 enforcement activity flagged risk of pricing discrimination in short-term consumer loans — likely the first regulator to test proxy-discrimination claims against a ML scorecard in Poland. Ties directly into the anchoring effect arguments Polish regulators already apply to retail lending disclosures.

Bias, proxy discrimination, and information gain

ML credit models do not create bias; they absorb bias present in the training data and sometimes amplify it through proxy features. Three empirical findings shape the 2025–2026 conversation:

• Bartlett, Morse, Stanton & Wallace (2022, Journal of Financial Economics) analysed 7 million US mortgage applications and found algorithmic lenders discriminated 40% less than face-to-face lenders on loan acceptance but still produced pricing gaps for Black and Latinx borrowers equivalent to about 7.9 basis points on rates.
• Bussmann, Giudici, Marinelli & Papenbrock (2021, Computational Economics) demonstrated that SHAP-based explanations on XGBoost credit models recovered interpretable risk drivers — but also that different surrogate explainers can give meaningfully different feature attributions, which the EU AI Act Article 13 obligations will have to grapple with.
• Hurlin, Pérignon & Saurin (2022) pointed out the most subtle risk: “fairness-through-unawareness” (simply dropping gender, ethnicity) fails because ZIP code, device type, and even transaction merchant identity carry strong statistical correlation with protected classes.

Seven compliance rules from the EU AI Act for AI credit scoring

Synthesising the AI Act, EBA 2023 loan origination guidelines, GDPR and the Schufa ruling, seven concrete rules define what “compliant AI credit scoring” looks like from August 2026.

1. Classify the system correctly. Any model that evaluates creditworthiness of natural persons is high-risk, regardless of internal branding. Systems used only for fraud detection are excluded — but “hybrid” fraud-and-credit models are not.
2. Data governance (Art. 10). Training, validation and test datasets must be relevant, representative, free of errors, and complete. Document provenance and statistical properties of every feature.
3. Transparency to the deployer (Art. 13). Provide instructions for use, intended purpose, accuracy metrics, known limitations, and feature importance. A typical US-origin vendor datasheet is no longer sufficient.
4. Human oversight (Art. 14). Human reviewers must be able to understand outputs, intervene, and override. The Schufa ruling makes this an individual-applicant right, not only a systemic requirement.
5. Post-market monitoring (Art. 72). Drift and fairness metrics must be continuously monitored in production; substantial model updates trigger re-assessment obligations.
6. Explanation duty per applicant. From GDPR Art. 22 via Schufa: meaningful information on the logic, plus contestation route. Practical solution: pre-computed SHAP reason codes stored with every scoring event.
7. Record-keeping for ten years (Art. 18). Technical documentation, logs, and post-market records must be retained for ten years after the system is placed on the market. Plan the storage architecture accordingly.

A personal take — would I use AI to score my first mortgage?

Writing this as a high-school student who will likely apply for a first mortgage within 5–7 years, and who already trades CFDs on Plus500 as a sanity-check for how markets price risk — my honest answer is yes, but only where the AI is combined with a human underwriter with authority to override. The anchoring risk in fully-automated pricing is that the score becomes the decision; a good underwriter has the freedom to step outside the model when the applicant’s life trajectory (career change, probationary employment, first-time home buyer) is the information the model was not trained on. In Polish retail lending the default is increasingly “model rules”, and behavioural finance tells us that consumers rarely contest scores even when they could. The August 2026 obligations are exactly a bet by the EU that this default will drift in the direction of less accountability if left unregulated.

Conclusion — what to do before 2 August 2026

For any fintech, bank, or technology vendor touching EU credit-scoring decisions, the 2 August 2026 deadline is not a nominal compliance date — it is the point at which a credible legal challenge can be filed against a production AI system. The operational playbook for the next four months: (i) map whether your model meets Annex III point 5(b); (ii) close the documentation gaps (data lineage, feature provenance, evaluation metrics); (iii) wire in SHAP- or counterfactual-based explanations per decision event; (iv) stand up a human-oversight queue with real override authority; (v) implement drift and fairness monitoring with documented thresholds; (vi) prepare a GDPR Article 22 information pack for applicants; (vii) register the system in the EU database.

For the broader picture on how algorithms and equilibrium interact, see market equilibrium and the Calvano et al. findings on algorithmic pricing. For the behavioural angles — why applicants rarely contest adverse scores, and why lenders exploit loss aversion in pricing — the behavioural economics cluster on DTF is the follow-up read. For Polish-speaking readers, a paired PL version will follow in the coming weeks.