For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s

The week

On November 19, 2025, the European Commission presented its Digital Omnibus package, a set of proposed amendments to the EU’s digital rulebook. One proposal targeted the AI Act. The obligations for high-risk systems listed in Annex III had been due to apply from August 2, 2026. Annex III includes AI used to evaluate creditworthiness or set credit scores, and AI used to price life and health insurance. The Commission proposed applying them only once harmonized standards and support tools were available, with a long-stop date of December 2, 2027. High-risk AI embedded in regulated products would move to August 2, 2028. A separate proposal in the package addressed the GDPR and other data rules. None of it was law yet: the European Parliament and the Council both had to agree.

For banks, consumer lenders and buy-now-pay-later providers with European customers, the headline read as a reprieve of up to sixteen months for credit-scoring AI. That reading confused the most visible rule with the binding one. Three other sets of obligations already governed automated credit decisions, and none of them moved. They were the GDPR’s rules on automated decisions as the Court of Justice had interpreted them, and the revised Consumer Credit Directive with its November 2026 application date. The third was banking supervisors’ expectations for loan origination and models. Taken in that order, they set the real timetable.

The GDPR, as the Court of Justice read it

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing that significantly affects them, subject to exceptions and safeguards. For years, credit bureaus and lenders argued about where that line fell. Two judgments settled much of the argument before the Omnibus appeared.

In the SCHUFA case in December 2023, the Court of Justice held that a credit bureau’s score can itself be an automated decision. That applies when a lender draws strongly on the score to grant or refuse credit. That pulled bureau scores and vendor scores into Article 22, not only the lender’s final approval engine. In the Dun & Bradstreet Austria case in February 2025, the Court held that a person refused after an automated credit assessment is entitled to an explanation. It must cover the procedure and principles actually applied. Handing over an algorithm or a formula does not meet that standard. Where trade secrets are involved, the information may have to go to a supervisory authority or court to weigh the competing interests.

The operational consequence is concrete. A lender needs to be able to say, for an individual applicant, which data were used and how they moved the result. That means feature-level reason codes stored with each decision, a process for producing an intelligible explanation on request, and contracts with score vendors that oblige them to support it. None of that waits for AI Act standards.

The Consumer Credit Directive’s November 2026 date

The revised Consumer Credit Directive, Directive (EU) 2023/2225, had to be transposed by member states by November 20, 2025 and applies from November 20, 2026. It widens the scope of consumer credit rules, including to many buy-now-pay-later products, and it rewrites the creditworthiness assessment.

Assessments must rest on relevant and accurate information about income and expenses. Special categories of personal data, such as health data, may not be used. Where the assessment involves automated processing, the consumer can request human intervention and a clear explanation of the assessment and of how the processing works. The consumer can also express a point of view and ask for a review. Those are AI Act themes, arriving on a fixed date through national law.

For a lender, the work splits into product and process. The decisioning platform has to route a review request to a person with authority to change the outcome, and log what happened. Data pipelines have to exclude prohibited inputs, including proxies that a model might learn. Customer-facing teams need scripts and service levels for explanation requests. Because each member state transposes the directive itself, legal teams also need a country-by-country view of the final wording. A lender that did all of this by November 2026 would already meet much of what the AI Act asks of a deployer.

Supervisors’ expectations for origination and models

The third layer is supervisory. The European Banking Authority’s guidelines on loan origination and monitoring, applied since mid-2021, already set expectations for banks that use automated models in creditworthiness assessment. Institutions are expected to understand the models, manage the quality of their data, monitor their performance, and keep human judgment in the process. National supervisors and the ECB examine against those expectations now, through model risk reviews and on-site inspections.

That changes how a bank should read the Omnibus. A credit model that would struggle under AI Act documentation rules is probably already weak under its own model governance. Validation reports, data quality controls, override monitoring and challenger testing are existing obligations. Supervisors do not need the AI Act in force to ask why a model refuses certain applicants more often, or why overrides cluster in one branch.

The practical sequence follows from the three layers. First, build what the GDPR and the Consumer Credit Directive require of every decision: stored reasons, explanation on request, human review that can change outcomes, and exclusion of prohibited data. Second, make sure model governance can show supervisors how each model was validated and how it is monitored. Third, and only then, address items specific to the AI Act, such as conformity assessment, registration and the provider’s technical file, which depend on standards that were not yet final.

Two second-order effects deserve attention. Lenders that buy scores from bureaus or fintech partners carry the explanation duty for decisions those scores drive, so procurement terms matter as much as model design. And a lender that pauses because of the Omnibus may find its November 2026 build squeezed into a few months, competing with year-end change freezes. The cheapest compliance path ran through the existing rules, not around them.

With hindsight

The AI portion of the Omnibus moved quickly. EU negotiators reached a provisional agreement on May 7, 2026, the European Parliament approved it in June, and the Council formally adopted it at the end of that month. It was published in the Official Journal in July. The agreed text fixed December 2, 2027 for standalone high-risk systems, including credit scoring, and August 2, 2028 for AI embedded in regulated products. The GDPR changes followed their own, separate track.

Nothing in that outcome changed the other two timetables. The Consumer Credit Directive’s November 2026 date stayed in place, although some member states were reported to be late in transposing it, which left lenders working from draft national texts. The court rulings on automated credit decisions continued to apply. Lenders that used the year to build explanation, review and data controls for every decision now face the 2027 AI Act date with much of the deployer work done. Those that waited are building for two deadlines at once.