Consumer lenders that use AI agents to assess borrowers are deployers of high-risk systems under the EU AI Act, because creditworthiness assessment of individuals is listed as high-risk. Article 26 requires them to assign oversight to people with the competence, training and authority to do it. For a lender, that means underwriters who can read, question and overrule the agent.
What does Article 26 require of a consumer lender?
A deployer of a high-risk AI system must, in substance: use it according to the provider's instructions; assign human oversight to natural persons with the necessary competence, training and authority, and support them; ensure input data it controls is relevant and sufficiently representative; monitor the system, tell the provider about risks and suspend use when a serious risk appears; report serious incidents; keep the logs under its control for an appropriate period; inform workers' representatives before using the system at work; and inform borrowers that a high-risk system is used in decisions about them, where the Act requires it.
For a lender, those duties land on a few concrete questions. Who decides held applications? How do you know they can? Can they say no? And what does the record show? The definitions behind this are in what a deployer is under the EU AI Act.
Which consumer lending agents are covered?
Any agent assessing whether an individual can repay, or scoring them for credit: personal loans, car finance, credit cards, overdrafts, store credit and buy-now-pay-later. That holds whether the agent recommends or decides, if its assessment shapes the outcome. Agents used only to detect financial fraud fall outside the credit listing. Agents in collections may come inside it when they assess ability to pay for a new arrangement.
Consumer lending has features that make Article 26 demanding:
- Volume. Thousands of small applications, where review time per case is short and automation bias grows fastest.
- Thin files. Young borrowers, recent arrivals and the self-employed often have little data, and agents assess them less well.
- Declared data. Income and outgoings are often stated by the applicant. An assessment built on declared figures is weaker than one built on signed or sealed data, and the underwriter must know which they are looking at.
- Speed expectations. Borrowers expect decisions in minutes, which pushes lenders to automate approvals at depth 3 and makes the held cases more important.
What does competence look like for consumer lending staff?
Underwriters who decide held applications need to read the agent's assessment, see the facts behind it with their provenance, and judge whether the outcome is right for this borrower. They should know the segments where the agent is weakest and look harder there. They should be able to give specific reasons for a decline that trace to the file.
Credit risk analysts need to read the record in aggregate: approval and decline rates by segment, override rates by underwriter, and drift after a change in sources. They decide when to suspend the agent's automatic approvals.
Collections staff who meet the same customers later need to understand how the original decision was made, because affordability problems often trace back to it. Overseas comparison is useful here; see AI agent training for collections agents in consumer lending in India.
Authority must be written into credit policy. An underwriter's override in the borrower's favour, within mandate, should not need more sign-off than a decline. If it does, the lender has built a bias into its oversight.
Training must follow the agent. An agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. At renewal its sources or limits may change, and underwriters must be briefed before they decide under the new version.
How does a lender meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Oversight assigned to named people | Named underwriters per product and named capability owner | Assignment register |
| Necessary competence | Assessment on the lender's own past applications, including seeded wrong recommendations | Assessment results before approval rights |
| Training kept current | Briefing at each agent recertification or change | Briefing records linked to agent changes |
| Necessary authority | Override in the borrower's favour within mandate needs no extra sign-off | Credit policy; override records |
| Support | Review time and queue limits sized for real review | Queue and review-time metrics |
| Monitor and suspend | Analysts can suspend automatic approvals on drift | Suspension events and triggers |
| Inform borrowers | Notices say a high-risk system was used where required | Notice templates; sent notices |
Some lenders go further and make approval rights depend on a current certificate, depth by depth. The idea of what counts as proof is set out in what evidence of competence is.
What will a supervisor ask?
Consumer credit supervisors and market surveillance authorities will want to see the people behind the decisions. Expect: who decides held applications, and how were they assessed? Show declines by underwriters whose training predates the agent's last change. What are override rates by underwriter, and what do you make of a zero? How do you treat thin-file applicants? When did you last suspend automatic approvals, and why? How are borrowers told a high-risk system was used?
What does Article 26 not cover?
It does not set affordability or responsible lending rules, which come from consumer credit law. It does not set training content or credentials. It does not apply to agents outside the high-risk categories. And it does not settle data protection questions, which the GDPR handles, including Article 22 rights for solely automated decisions. Similar duties in neighbouring sectors are covered in Article 26 duties in insurance and in telecoms.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Operator track is built for the people who run a live workspace daily, such as underwriters and credit team leads. It ends in a written exam of 40 questions, passed with at least 32 correct, and a two-week practicum of real review decisions signed off by a Pryme assessor. Our guide to AI literacy and certification for people who work with agents covers the other levels.
Questions people ask
Can a lender let the agent approve loans automatically?
Routine approvals within narrow criteria can run at depth 3 if the agent is certified for them. Declines and edge cases should be held, and automatic approvals should be monitored by trained analysts who can suspend them.
Are buy-now-pay-later checks covered?
If the agent assesses whether an individual can repay, it is a creditworthiness assessment, whatever the product is called. The deployer duties apply.
What should underwriters do with declared income?
Treat it as declared, the weaker class of fact, and look for signed or sealed evidence before relying on it for a large or marginal decision. Training should show what the agent does when only declared data is available.