Update, September 2026: the EU's AI Omnibus entered into force on 27 July 2026 and deferred the high-risk obligations. Rules for stand-alone high-risk systems listed in Annex III, which include credit scoring, now apply from 2 December 2027. Rules for high-risk systems covered by Annex I product legislation apply from 2 August 2028.
The deferral gives payment and credit firms more time, but not a reason to wait. Conformity assessment for high-risk systems takes longer than most compliance teams expect, and the inventory and documentation work is the same whether the deadline is 2026 or 2027.
Which AI systems are in scope
The Act lists certain financial services uses as high-risk. For payment and credit firms the main ones are AI systems used to assess the creditworthiness of individuals or set their credit scores, and AI used for risk assessment and pricing in life and health insurance.
Two common payment uses are explicitly carved out. AI used to detect financial fraud is excluded from the credit scoring category, and biometric verification whose only purpose is to confirm that a person is who they claim to be is excluded from the biometrics category. Firms should still check each system carefully: a fraud model that also feeds credit decisions, or a biometric system used for identification rather than verification, may fall back into scope.
What conformity assessment requires
High-risk systems must pass conformity assessment before they are put into service. Providers need a risk management system; technical documentation on the system's purpose, capabilities and limits; data governance showing that training data meets quality criteria and has been checked for bias; logging that allows decisions to be audited afterwards; clear information for the people who deploy the system; and human oversight arrangements that allow people to intervene.
Human oversight is the hardest part for real-time systems. A model deciding in milliseconds cannot wait for a person to review each case, so oversight means that people understand the system's limits, can monitor its performance, and can override or stop it when needed.
Preparing for December 2027
Most payment and credit firms have not yet listed their AI systems against the Act's high-risk criteria. That inventory is the first step: identify every AI or machine learning system that makes or strongly influences decisions about customers, then assess each against the criteria and the exclusions.
For systems in scope, documentation, data governance evidence and oversight arrangements should be ready well before 2 December 2027. Firms that find gaps now have time to fix them properly; firms that start in late 2027 will not.