Usury threshold checks, pre-contract and withdrawal testing, creditworthiness file reviews and evidence of human oversight over credit scoring are what AI agents can do for French consumer lending compliance. People keep every finding and remediation. The ACPR supervises, and EU consumer credit rules, the EU AI Act, GDPR and the CNIL shape the work.
What does consumer lending compliance involve in France?
Pricing control is a French particularity. Consumer and mortgage credit cannot exceed a usury threshold published periodically for each category of loan, and the calculation includes fees, insurance and other mandatory costs. When the threshold moves, every rate grid and every loan in the pipeline must be checked against it.
Pre-contract and contract obligations follow EU consumer credit rules: standard pre-contract information, an assessment of creditworthiness, a withdrawal period after signing, and clear explanations. Compliance tests that each loan followed the sequence and that refusals were handled properly.
Borrowers in difficulty are a third theme. Lenders consult the national register of household repayment incidents before lending, must report incidents to it, and deal with the over-indebtedness procedure when a household's case is accepted. Loan insurance sold with mortgages, which borrowers have rights to switch, adds its own complaints. All of this is supervised by the ACPR, which covers commercial practices as well as prudential matters.
Where do agents fit?
- Usury threshold checks (depth 1). Each time the threshold is published, the agent recalculates the all-in rate of loans in the pipeline and active rate grids, and lists any that breach or come close.
- Pre-contract sequence testing (depth 1). The agent samples files and checks that the standard information sheet came before signature, the withdrawal period was respected, and funds were not released early.
- Creditworthiness file review (depth 2). The agent compares the assessment with the income and expense evidence on file and drafts a finding where they do not match, for compliance to confirm.
- Human oversight evidence (depth 1). Where the lender uses an AI system to score borrowers, the agent checks that reviewers actually looked at overridden and borderline cases, using the decision logs.
The fourth use is where the EU AI Act changes the work. Creditworthiness assessment of individuals is a listed high-risk use, so the lender must show that people oversee the scoring system. An agent that tests whether oversight happened in practice produces that evidence continuously.
What has to stay with people?
Credit decisions stay with the credit function. Under GDPR Article 22, decisions based solely on automated processing with significant effects, such as refusing credit, are restricted, and borrowers have rights to human intervention and to contest. Compliance's agent tests those decisions; it does not take them.
Findings and remediation stay with compliance. If testing finds loans above the usury threshold, deciding how to correct them and contact borrowers is a matter for people and counsel.
Treatment of over-indebted households stays human, with care and discretion. Our principle that AI compliance agents are second line, never the last word matters most where the borrower is already in difficulty.
Which rules apply in France?
The ACPR supervises lenders' compliance, including commercial practices and consumer protection, and EBA guidelines on loan origination shape expectations for creditworthiness assessment. French law implements EU consumer credit rules and sets the usury threshold. The CNIL supervises data protection.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and lists creditworthiness assessment and credit scoring of natural persons as high-risk in Annex III. Providers of those systems carry obligations on risk management (Article 9), data governance (Article 10), logging (Article 12), transparency (Article 13), human oversight (Article 14) and accuracy (Article 15). Lenders as deployers have duties under Article 26, and certain deployers, including those using AI for creditworthiness, must carry out a fundamental rights impact assessment under Article 27. Application dates for high-risk obligations have been subject to proposed changes, so plan now and confirm timing with counsel.
GDPR applies throughout: lawful basis under Article 6, Article 22 for automated decisions, Article 35 impact assessments. DORA, applying from 17 January 2025, covers ICT risk and suppliers.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the first 90 days look like?
Month one: run usury threshold checks at depth 1 against the last published threshold and your current grids. This is precise, quick to verify and immediately useful.
Month two: run pre-contract sequence testing on a sample of recent loans, and design the human oversight test with the team that runs the scoring system.
Month three: begin human oversight evidence at depth 1 and creditworthiness file review at depth 2, each finding held for compliance. Link the outputs to your Article 27 assessment work.
Questions people ask
Is a compliance agent that reviews credit files itself high-risk under the EU AI Act?
A tool that only reviews files after decisions is not doing creditworthiness assessment, so it is unlikely to be high-risk itself. The scoring system it reviews may be.
What is the UK Consumer Duty's relevance for a French lender?
None legally, but its focus on outcome monitoring is a useful model. Our pieces on FCA Consumer Duty and AI agents in lending and on Consumer Duty and AI support agents show the method.
How does France compare with India for consumer lending compliance?
India's rules centre on RBI's digital lending expectations and the DPDP Act rather than an AI law. See our brief on compliance agents in Indian consumer lending.