How should organisations determine whether a credit scoring model falls under the EU AI Act high-risk rules?

How to decide if a credit model is in scope

The practical test is not whether the model is labelled “advisory” or whether a human signs off at the end. Focus on the role the model plays in the real decision flow: if it assesses a natural person’s creditworthiness or materially shapes a lending outcome, treat that as the relevant function. A model can be in scope even when it is one step upstream of the final underwriter decision.

That means organisations should trace where the score, rank, flag, or recommendation is actually used. If the output influences approval, pricing, limits, or escalation thresholds in a way that meaningfully affects the borrower’s treatment, the analysis should assume high-risk treatment until the mapping is disproven. The strongest evidence is a documented decision chain, not a product brochure or internal ownership chart.

When the use case sits close to the line, align the assessment with the EU AI Act regulatory framework and the Commission’s high-risk AI materials, then record why the model does or does not map to the Annex III creditworthiness use case. The same approach is reflected in NHIMG’s EU AI Act High-Risk AI Systems Guide, which is useful when you need to translate legal categories into an operational inventory.

For teams building internal governance, AI Use Case Risk Tiering Guide helps structure the classification question around use-case impact rather than vendor naming, which is the right mindset for credit decisions.

What evidence should support the classification

The classification should be grounded in evidence that can be audited later. Start with the model output, then identify the downstream consumer, the decision it informs, and whether that consumer can realistically override it. If the output changes eligibility, prioritisation, or the substance of the lending decision, the model’s role is not merely informational.

Useful evidence includes process maps, decision-policy documents, workflow screenshots, scorecard definitions, and approval rules that show where the model sits in the lending journey. If the model feeds a manual review queue, the important question is whether the queue is genuinely independent or whether the model is already setting the lending posture. That distinction matters more than who presses the final approve button.

Where organisations struggle, the problem is often governance drift rather than technology. The model may have started as a support tool and later become part of a semi-automated underwriting workflow without anyone updating the formal assessment. A current inventory, use-case register, and documented review cadence reduce that drift and make the classification defensible.

NHIMG’s AI Governance Guide is relevant here because it frames inventory, ownership, and review as operational controls, not paperwork.

For organisations that need a broader policy anchor, the AI Register and AI Inventory Template is a practical way to capture the evidence needed for a repeatable decision.

How to handle borderline cases and documentation

Borderline cases usually arise when the model is one input among several, or when the business insists that a human review breaks the chain. The better question is whether the human review is substantive or simply a formality after the model has already constrained the outcome. If the latter, document the model as materially affecting the decision and classify accordingly.

Do not wait for a deployment review to produce the assessment. The classification should exist before go-live, because it determines the control expectations around documentation, oversight, testing, and lifecycle management. If the model’s role changes later, the classification should be revisited rather than assumed to remain stable.

Where legal, risk, compliance, and product teams disagree, the decision should be resolved from the actual workflow and evidential record, not from business preference. A short written rationale that states what the model does, what decision it influences, and why that influence is or is not material will save time during audits, procurement, and regulator queries.

For organisations building that discipline, EU AI Act Compliance Guide is the most direct internal reference for the surrounding obligations and terminology.

Relatedly, the European Commission’s EU AI Act regulatory framework remains the canonical source for the high-risk regime and should be checked for the latest official wording and timeline.

Practitioner Guidance

What to verify: verify whether the model output changes the outcome, not just the workflow. If a reviewer routinely follows the score, the human step may not be enough to keep the use case outside high-risk treatment.

Decision rule: if the model assesses creditworthiness or materially informs lending, classify it as in scope and document the rationale; if it only supports a separate, genuinely independent decision, record why that influence is not material.

What good looks like: a current use-case inventory, a decision-flow diagram, and a written classification note that all say the same thing about where the model sits in the lending process.

Practitioner takeaway: in credit scoring, the legal question is answered by operational influence, not by organisational labels, and the safest classification is the one you can prove from the real decision path.

Related resources from NHI Mgmt Group

• Guide: Agentic AI Compliance Guide
• Risk Rules
• How should teams implement high-risk AI model evaluation under the EU AI Act?
• What breaks when a credit scoring model is treated as internal analytics under the EU AI Act?
• When do AI systems move into high-risk territory under the EU AI Act?