Why the AI Act left bank credit models with the supervisor they already had
The AI Act text adopted in March 2024 routed high-risk credit scoring through banking supervision and let existing governance satisfy some duties. For banks, the work was separating what model risk management already met from what it never covered.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 13, 2024, the European Parliament voted to adopt the Artificial Intelligence Act, following the political agreement with member states in December 2023. The regulation classed a defined list of uses as high-risk. For financial services the list included AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, with an explicit exclusion for systems used to detect financial fraud. Risk assessment and pricing for individuals in life and health insurance were also listed. The text contained a set of provisions aimed specifically at institutions already regulated under EU financial services law. They covered who would supervise these systems, and which AI Act duties a bank could meet through its existing internal governance. The Council adopted the regulation in May 2024 and it was published in the Official Journal that July.
Earlier articles in this series covered how the AI Act sorted risk by use rather than technique, and how its obligations attach to whether an organization builds, deploys or builds on a system. The March 2024 text added something both of those readings missed for banks. It did not create a new supervisor for a bank’s credit models. It folded them into the supervision a bank already had. That design answers most of the practical questions a bank with EU-regulated entities had to settle. It breaks into three parts: who would examine the systems, which obligations existing governance already met, and which obligations no banking rule covered.
Who examines: the financial supervisor
Under the final text, the market surveillance authority for high-risk AI used by regulated financial institutions is, as a rule, the national authority that supervises those institutions. That applies where the system is directly connected to providing the financial service. The recitals add that authorities taking part in the Single Supervisory Mechanism should pass relevant findings to the European Central Bank.
The consequence is easy to understate. A bank’s credit-scoring models would be questioned by the same supervisor that already reviews its internal models, its credit risk processes and its outsourcing. That supervisor knows the bank’s model inventory and validation history. It also has established ways of following up findings. AI Act questions would arrive inside an existing supervisory relationship, mixed with prudential and conduct concerns, and not as a standalone audit by an unfamiliar agency.
For a bank, that changes how evidence should be organized. A separate AI compliance binder, maintained by a new team, would sit awkwardly beside the model documentation the supervisor already receives. The better design adds AI Act fields to the existing model inventory. They cover the Annex III classification, the bank’s role as provider or deployer, the legal entities and markets served, and the date of the last review against the Act. Examiners can then follow one record from approval to monitoring.
What existing governance already meets
The text then gave regulated financial institutions specific credit for what they already do. A provider that is a financial institution subject to internal governance requirements is treated as meeting most of the quality management system obligation by complying with those rules. A deployer that is a financial institution can meet the duty to monitor a high-risk system through its internal governance arrangements. Documentation and automatically generated logs can be kept as part of the records financial services law already requires.
These are real savings, but they are narrower than they look. The quality management credit does not extend to the risk management system for the AI itself, to post-market monitoring, or to serious incident reporting. Those still apply in full. A bank that read the derogations as a general exemption would leave gaps exactly where supervisors would look first.
The practical step is a mapping exercise, done once and kept current. On one side sit the AI Act duties for each high-risk system. On the other sit the policies and controls already in place: the model risk policy, validation standards, the credit risk framework, outsourcing and ICT third-party rules, and record retention. Each duty gets one of three labels: met by an existing control, met with an addition, or not met. Second-line model risk and compliance should own the map jointly, because neither alone sees the whole picture.
What no banking rule covers
The third part is where new work concentrated. Several AI Act obligations have no close equivalent in prudential or conduct rules, and the derogations did not touch them.
The first is data governance for training, validation and test data. Model risk frameworks ask whether data is accurate and fit for the model’s purpose. The Act asks, in addition, whether the data is relevant and sufficiently representative, and requires examination for possible biases that could harm people or lead to prohibited discrimination. That calls for documented bias testing across groups, which many credit teams had done for fair lending purposes but not in this form.
The second is human oversight by design. Providers must build systems so that people can understand outputs, avoid over-relying on them and intervene. Deployers must assign oversight to staff with competence and authority. For an automated decline, that means defining who can override, on what evidence, and how often overrides are reviewed.
The third is the fundamental rights impact assessment. Deployers using AI to evaluate creditworthiness, or to price life and health insurance, must assess the effects on the people concerned before first use. No banking rule required this. It needs input from compliance, fair lending, customer complaints and the business line, not only from model developers.
The fourth concerns individuals. A person subject to a decision based on a high-risk system’s output, with significant effects, gained a right to a clear explanation of the system’s role. Adverse action and GDPR processes already provided some of this, so the work is extending existing templates.
For a bank that buys scoring from a bureau or fintech, most of the provider duties sit with the vendor. The bank still needs the vendor’s documentation and instructions to meet its own duties, and contracts signed before 2024 rarely required them. Organizations should confirm the scope of each obligation, and the classification of borderline systems, with counsel.
With hindsight
The AI Act entered into force on August 1, 2024. Prohibitions applied from February 2025 and obligations for general-purpose AI models from August 2025. The high-risk obligations, including credit scoring, were originally due in August 2026. In 2026, after a Commission proposal of November 2025, EU lawmakers agreed to defer obligations for stand-alone high-risk systems to December 2027. Banks should confirm the final published text with counsel.
The supervisory design held. In November 2025 the European Banking Authority reported on its mapping of the AI Act against banking and payments law, focused on credit scoring. It found no significant contradictions and planned no new guidelines for now. It also noted that the targeted derogations did not extend to areas such as human oversight and data governance. That is the split described here: integration where banking rules already reached, and new work where they did not.