Credit decisions are where Article 14 of the EU AI Act applies without argument. The Act lists creditworthiness assessment and credit scoring of individuals as high-risk, so any agent doing that work must be overseen by people who understand it, resist automation bias, interpret its output and can override or stop it. Lenders must train them and prove it.
What does Article 14 require for credit?
In substance, Article 14 requires high-risk systems to be built so that natural persons can oversee them effectively during use. The people assigned to oversight must be able to understand the system's capacities and limitations, monitor it for anomalies, remain aware of automation bias, interpret output correctly, decide not to use the output or to override or reverse it, and intervene or stop the system. Measures must be proportionate to risk, autonomy and context.
Article 26 places the matching duty on the lender as deployer: assign oversight to people with the necessary competence, training and authority, and support them. Article 4 asks for AI literacy across staff. The GDPR adds Article 22: where a credit decision is based solely on automated processing and has significant effect, the applicant has rights, including to obtain human intervention.
Who in a lender does it reach?
Any lender using an agent to assess creditworthiness or score applicants who are natural persons: banks, consumer lenders, card issuers, buy-now-pay-later providers and credit unions. Business lending to companies falls outside the high-risk listing, though lending to sole traders, who are individuals, may not.
Note one boundary. The high-risk listing for credit scoring does not extend to systems used to detect financial fraud. An agent screening applications for fraud is in a different position from one assessing ability to repay, even if both read the same file.
The people who need oversight competence:
- underwriters and credit reviewers who decide held applications;
- credit risk managers who monitor the agent's decisions in aggregate;
- heads of credit who set the lender's limits that bound the agent;
- complaints and appeals staff who reconsider declined applications.
What does oversight of a credit agent involve day to day?
A governed credit agent might read bureau data and account history at depth 1, assemble the file and draft an assessment at depth 2, and approve routine applications inside tight criteria at depth 3. Declines, approvals near the edges of policy, and anything above the lender's own limits are held for a named underwriter.
That design puts three demands on the underwriter.
Reading the assessment, not the score. Article 14 asks overseers to interpret output correctly. An underwriter should read which facts drove the assessment and where each came from. Income verified from payroll records is a sealed or signed fact; income stated on the application is declared. An assessment resting on declared figures is weaker, and the underwriter should know it.
Resisting the default. Automation bias in credit looks like approving every recommendation in the queue because the last fifty were right. Underwriters need training on the cases where agents go wrong in lending: thin files, recent life changes, self-employment, and data errors that a person would spot from context.
Disagreeing with a reason. When an underwriter overrides the agent, in either direction, they record why. Those reasons are evidence that oversight was real, and they feed back into the agent's sources and bounds. Qualification, not training: the lender changes the agent's brief and limits, not the model's weights.
Building competence, authority and the ability to intervene
Competence is built on the lender's own cases. Generic AI training does not teach an underwriter what this agent gets wrong on this lender's applicants. Assessment should use real decisions, including seeded ones where the right answer is to decline the agent's recommendation.
Authority must be written into credit policy. An underwriter who overrides the agent should not need a second signature to do so in the applicant's favour within their mandate, and should never be penalised for slowing a decision to check it.
Intervention includes the stop. Credit risk managers should be able to suspend the agent's depth 3 approvals immediately if a pattern looks wrong, sending everything to manual review. The agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day, so manual capacity must exist anyway.
How do you meet Article 14 in credit decisions?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Overseers understand capacities and limits | Training on the agent's criteria, depths and known weak segments | Training and assessment records |
| Awareness of automation bias | Seeded applications in review queues; override rates monitored | Seeded case results; override rates by underwriter |
| Correct interpretation | Underwriters read deciding facts and their provenance | Decision notes citing facts |
| Power to override or reverse | Overrides within mandate need no extra approval | Override records with reasons |
| Ability to stop | Risk managers can suspend depth 3 approvals | Suspension events and their triggers |
| Competent people with authority (Article 26) | Approval rights tied to current credentials and mandates | Credential and mandate register matched to approvals |
| Human intervention on request (GDPR Article 22) | Appeals reviewed by a trained person who can change the outcome | Appeal files and outcomes |
Collections teams face a related version of this; see Article 14 oversight for AI agents in collections. The concept of review that changes outcomes is set out in what meaningful human review is.
What will a supervisor ask?
Banking supervisors and consumer authorities will sample decisions. For each, they will ask what the agent recommended, what the underwriter saw, and whether the underwriter could have decided differently. They will compare override rates across underwriters: one who never overrides is either reviewing very easy cases or not reviewing. They will ask how underwriters were trained, when, and on what. They will ask what the lender did the last time the agent drifted, and how quickly. And they will ask the lender to show that the people approving held decisions had current competence on the dates they approved.
What does Article 14 not cover?
It does not set credit policy or affordability rules, which come from consumer credit law and prudential supervision. It does not apply to fraud detection systems under the credit scoring listing. It does not prescribe training hours or credentials. It does not replace model risk management expectations, which supervisors apply to credit models in most banking markets. And it does not allow a lender to shift responsibility to the agent's provider. For the general picture of oversight, see what human oversight is, and for payments, Article 14 oversight for AI agents in payments.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
A lender can make approval rights depend on a current certificate, depth by depth. Pryme Intelligence Academy's Certified Pryme Operator credential fits that practice: a written exam plus a two-week practicum of real review decisions signed off by a Pryme assessor, valid for 12 months and checkable at source through VerifyDoc.ai. Our guide to AI literacy and certification for people who work with agents covers the other levels.
Questions people ask
Does a person approving each decision satisfy Article 14?
Only if the person can understand, question and change the decision in practice. Approval without the information, time or authority to disagree does not meet the purpose of the article.
Should automated approvals be allowed at all?
Routine approvals within narrow criteria can run at depth 3 if the agent is certified for them and overseers monitor the results. Declines and edge cases should be held, because those are where errors cost applicants most.
Who should oversee the overseers?
Credit risk managers, using the record. They should review override rates, seeded case results and complaints by underwriter, and act when a pattern suggests oversight has become a formality.