Skip to main content

Module 8 — The EU AI Act and risk levels

Regulation (EU) 2024/1689 — universally called the EU AI Act — is the first horizontal statute on artificial intelligence with real teeth. It entered into force on 1 August 2024, applies in phases over three years, and reaches beyond the European Union: any provider or deployer whose system's output is used inside the Union is subject to it. For the credit scorer under audit, the AI Act is the regulatory frame; this module explains where the scorer sits, what obligations follow, and when they bite.

Four risk tiers, and where they live​

The Act organizes systems into four tiers by risk.

Unacceptable risk (Article 5) — Practices that are outright prohibited. The list includes social scoring by public authorities, real-time remote biometric identification in public spaces (with narrow law-enforcement carve-outs), untargeted scraping of facial images to build databases, emotion inference in workplaces or schools, subliminal manipulation causing harm, and exploitation of vulnerabilities of specific groups. These provisions have applied since 2 February 2025.

High risk (Article 6 and Annex III) — Systems that pose significant risk to health, safety or fundamental rights. Annex III enumerates eight domains: biometrics, critical infrastructure, education, employment, access to essential public and private services (which explicitly includes creditworthiness assessment and credit scoring), law enforcement, migration and border control, and the administration of justice. There is also a "product safety" route via Annex I. High-risk systems are permitted, but only if they meet the compliance regime in the next section.

Limited risk (Article 50) — Systems subject to transparency obligations. Chatbots must disclose that they are AI. Synthetic media (deepfakes) must be marked as such. Emotion recognition and biometric categorization systems must notify the individuals concerned.

Minimal risk — Everything else. No AI-specific obligations. This covers spam filters, recommender systems for movies, and most enterprise ML.

The credit scorer we have been auditing falls squarely into high risk under Annex III point 5(b): "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score". This module now enumerates what that means concretely.

The seven high-risk obligations​

Risk management system (Article 9). A continuous process that identifies, analyzes, mitigates and monitors risks throughout the model's lifecycle. Not a document written once, but a live procedure with named owners and a review cadence. The audit dossier of module 10 is the artefact.

Data governance (Article 10). Training, validation and test datasets must be relevant, representative, free of errors "as far as possible", and appropriate for the intended geographic, behavioral and functional setting. Datasets must be examined for bias that could lead to discrimination — exactly the module 2 analysis, formalized and archived.

Technical documentation (Article 11 and Annex IV). A dossier established before the system is placed on the market, kept up to date, and made available to authorities on request. Annex IV lists what it must contain: system description, design choices, data provenance, training methodology, performance metrics including per-subgroup metrics, and known limitations. The model card and datasheet of module 6 form its backbone.

Record keeping (Article 12). The system must log automatically. For the credit scorer, that means every prediction, its inputs (or a compact fingerprint if privacy demands it), the model version, and the human decision that followed, retained for at least six months. Those logs are what makes an audit possible after the fact.

Transparency and information to deployers (Article 13). The provider gives the deployer instructions clear enough that the deployer can use the system correctly. Intended use, limitations, expected accuracy, and per-group performance are all in scope.

Human oversight (Article 14). Measures that enable "natural persons" to oversee the system: to understand its capabilities and limitations, remain aware of automation bias, correctly interpret the output, decide not to use the output, and — critically — override or reverse the decision. This is exactly the module 7 architecture.

Accuracy, robustness and cybersecurity (Article 15). Systems must reach an appropriate level of accuracy, be resilient to errors and adversarial attempts, and have cybersecurity measures. Level and resilience are stated in the technical documentation.

Providers also must set up a quality management system (Article 17), affix the CE marking (Article 48), register the system in an EU database (Article 71), and cooperate with market surveillance authorities.

The timeline​

  • 2 August 2024 — Entry into force.
  • 2 February 2025 — Prohibited practices apply. Article 4 AI literacy obligation applies.
  • 2 August 2025 — General-purpose AI model obligations start applying. Governance provisions apply. Penalty framework applies (up to 35 million euros or 7 % of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 % for most other breaches).
  • 2 August 2026 — Most obligations for high-risk systems apply, including the credit scorer regime.
  • 2 August 2027 — Obligations for high-risk systems that are safety components of products covered by other EU harmonization law (Annex I) apply.

A model already in production before the applicable date benefits from transitional provisions in specific cases, but the safe assumption for anything designed or updated after 2024 is that the full regime applies at the deadline.

Extraterritorial reach​

The Act applies (Article 2) not only to providers established in the Union, but also to providers outside the Union whose systems' output is used in the Union, and to deployers established in the Union. A US-based fintech scoring EU applicants is subject to the same obligations as an EU bank, and must appoint an authorized representative in the Union (Article 22). A subsidiary structure is not a shield.

What the audit dossier must produce​

For the credit scorer, the audit dossier compiled in module 10 gathers: the risk management file, the datasheet and model card, the fairness analysis (module 3), the explanation samples (module 4), the privacy analysis (module 5), the human-oversight description (module 7), and the incident-response plan. Together they are what a market surveillance authority would inspect. Missing any of them is not a documentation gap — it is a compliance breach.

Summary​

  • The EU AI Act organizes systems into four risk tiers; credit scoring is high-risk under Annex III point 5(b).
  • High-risk providers must implement a risk management system, data governance, technical documentation, logging, deployer transparency, human oversight and accuracy/robustness/cybersecurity.
  • The regime for most high-risk systems applies from 2 August 2026; prohibited practices already apply since February 2025.
  • The Act has extraterritorial reach: outputs used in the Union bring the system into scope, whatever the provider's location.

Next module: personal data protection — the GDPR frame that runs in parallel with the AI Act and governs the raw material of the scorer.