AI for credit scoring and insurance: What does the AI Act require?
Short answer
AI that assesses a person's creditworthiness or sets a credit score, and AI that assesses risk and prices life and health insurance for individuals, are high-risk under Annex III, point 5, of the AI Act. AI used only to detect fraud is excluded. From 2 December 2027 you must, among other things, have human oversight, keep logs and carry out a fundamental rights impact assessment (FRIA). Customers can ask for an explanation of the AI's role (Article 86), and Article 22 GDPR already applies.
What a human decision looks like
The example is from recruitment, but the workflow is the same for a credit application: the facts, the AI's recommendation, a person's decision and a log.
Case facts
Louise Brennan
- Current title
- Senior controller
- Experience
- 12 years
- CV
- Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
The AI’s recommendation
Invite to interview
Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.
The AI is unsure about:
Audit log
- Decisions are saved here with the time and a timestamp.
Fictional data. Decide the cases and see the log.
Solutions for your customers
See how GoalCube is used for borrowers, policyholders and tenants.
What to do
- Find the high-risk uses.Credit scoring of individuals, life and health insurance pricing.
- Carry out a FRIA and a DPIA.Before use – ideally together.
- Let an employee decide.With reasons, so the customer can get an explanation.
- Hide what isn't relevant.Name, origin and gender must not influence a credit decision.
What the law says
- Annex III, point 5(b) and (c), AI Act
- Credit scoring and life/health insurance; fraud detection excluded.
- Articles 27 and 86 AI Act
- FRIA and the right to an explanation.
- Directive (EU) 2023/2225 – consumer credit
- Requirements for creditworthiness assessments and the right to human intervention.
Questions and answers
Is property and casualty insurance high-risk?
Annex III mentions life and health insurance. Claims about property are not listed there, but a rejection is a decision about a person under GDPR.
Is fraud detection high-risk?
No. AI used only to detect financial fraud is excluded from Annex III, point 5(b).
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.