Are credit scoring AI models automatically high-risk?

Yes. Annex III, Area 5(b) explicitly classifies AI for creditworthiness assessment as high-risk.

How does DORA interact with the EU AI Act?

DORA and the AI Act overlap on ICT risk management, resilience testing, and incident reporting. Build integrated frameworks satisfying both simultaneously.

Do we need to explain AI credit decisions to customers?

Yes. Article 86 requires meaningful individual-level explanations of factors influencing AI-driven credit decisions.

Quick answer

Financial institutions using AI must comply with both sector-specific regulations (DORA, Basel III, Solvency II) and the EU AI Act simultaneously. AI systems for credit scoring, insurance pricing, and fraud detection are high-risk. A unified model risk management framework satisfying both sets of requirements is the most efficient approach.

Updated June 2026 · MmowW AI Compliance

AI Model Risk Management in Financial Services: Regulatory Framework 2026

The Dual Regulatory Landscape

Financial services firms face a unique compliance challenge: AI systems must satisfy both the EU AI Act and sector-specific financial regulation. The Digital Operational Resilience Act (DORA) establishes ICT risk management requirements that overlap significantly with the AI Act's robustness and cybersecurity provisions.

The EU AI Act classifies several financial AI applications as high-risk under Annex III, Area 5(b): AI systems used for creditworthiness assessment and credit scoring. Any AI model used in lending decisions must meet full high-risk requirements by August 2026.

Credit Scoring and Lending AI

Article 86 grants individuals a right to explanation for AI decisions that significantly affect them. In lending, borrowers denied credit based on AI scoring must receive meaningful information about the factors that influenced the decision. This goes beyond existing GDPR Article 22 obligations.

Black-box models that cannot produce individual-level explanations will not meet this standard. Financial institutions should prioritise explainable AI approaches for credit scoring or implement robust post-hoc explanation methods.

Building a Unified Framework

The most effective approach extends existing model risk management frameworks to incorporate AI Act requirements. Most large banks already have MRM functions based on SR 11-7 (US) or EBA guidelines (EU) covering model validation, monitoring, and governance.

Key additions needed are: fundamental rights impact assessments (Article 27), enhanced transparency documentation, and formal human oversight procedures (Article 14). Many institutions find existing governance is 60-70% of the way to AI Act compliance.

Anti-Money Laundering and Fraud Detection

AI systems for transaction monitoring, fraud detection, and AML screening process vast amounts of personal data and make decisions with significant consequences. These systems should be assessed for high-risk classification.

The compliance challenge is balancing transparency requirements with the need to keep AML detection methods confidential to prevent circumvention. The AI Act acknowledges this tension but still requires proportionate oversight.

Check your AI compliance readiness — free.

Take the Readiness Check 3 minutes · 10 questions · no signup required

This article is for informational purposes only and does not constitute legal advice. Regulatory requirements change frequently — verify current rules with official sources. Built by Sawai Gyoseishoshi Office, Hiroshima, Japan.