Is a credit scoring agent high-risk under the EU AI Act?

Yes, if it assesses the creditworthiness of natural persons or sets their credit score. Annex III of the EU AI Act lists that use as high-risk, and an agent doing it is a high-risk AI system whatever else it does. Scoring companies is outside that listing, and fraud detection is carved out. Sole traders, however, are people.

What exactly makes it high-risk?

Annex III lists, among others, AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud. Three points follow:

• Natural persons only. An agent that assesses limited companies for business loans is not in this listing. One that assesses sole traders, partners or guarantors who are individuals is.
• Purpose, not label. An agent called "underwriting assistant" or "affordability checker" is in scope if what it does is evaluate an individual's creditworthiness.
• A narrow escape route. The Act lets some Annex III systems fall outside high-risk if they do not pose a significant risk, for example because they perform only a narrow procedural or preparatory task. That route is closed for systems that profile individuals, and credit assessment of a person almost always involves profiling. Anyone relying on it must document the reasoning.

The general test is set out in is an AI agent a high-risk AI system under the EU AI Act, and the concept in what a high-risk AI system is.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Who carries which duties?

The provider, who builds the agent and places it on the market under its name, carries the design duties: risk management (Article 9), data governance (Article 10), automatic logging (Article 12), information to deployers (Article 13), human oversight by design (Article 14), and accuracy, robustness and cybersecurity (Article 15).

The deployer, the lender using it, carries Article 26 duties: use it according to instructions, assign oversight to people with the competence, training and authority to do it, monitor its operation, keep the logs under its control and inform individuals where required. Deployers evaluating creditworthiness must also carry out a fundamental rights impact assessment under Article 27. People affected by decisions based on high-risk systems can also ask the deployer for an explanation of the system's role.

A lender that builds its own agent is both.

What changes because it is an agent, not a scorecard?

A scorecard produces a number. A credit agent gathers documents, asks the applicant questions, reads bank statements, weighs explanations and may produce the decision letter. Two effects follow. The high-risk classification covers more steps, because each step shapes the assessment. And human oversight must sit before the action, not after it, since an agent able to issue a decline has already affected the applicant.

An illustrative example

Take a consumer lender in Spain that buys an agent from a platform to assess personal loans. The platform is the provider and supplies technical documentation and instructions for use. The lender, as deployer, assigns three credit officers to oversight, trains them on the agent's weaknesses, and configures the agent so that it may approve within policy but every decline is held for an officer.

Before going live, the lender completes its fundamental rights impact assessment, which leads it to test outcomes for applicants with irregular income, such as gig workers, and to add a referral rule for them. It keeps the agent's logs for its own records. When an applicant asks why they were declined, the officer can show which documents and factors drove the outcome.

Which controls meet the high-risk duties?

• Classification record for each credit capability, with the reasoning.
• Provider documentation on file, and instructions for use followed.
• Named, trained overseers with authority to override.
• Holds on declines and on any action with significant effects.
• Logs of every step, retained under the deployer's control.
• Impact assessment under Article 27 before use.
• Outcome testing across groups, repeated after changes.

Comparisons with other uses are in is an insurance pricing agent high-risk under the EU AI Act and is a customer support chatbot high-risk. For the basics of scoring itself, see what credit scoring is. The full map is in AI agent regulation, mapped to controls.