Credit-scoring AI under the EU AI Act

Credit institutions using third-party AI scoring trigger Annex III §5(b) and Article 27 FRIA automatically by activity. The 7 May 2026 Digital Omnibus did not exclude banking — Annex III §5 binds 2 December 2027. The DORA × AI Act intersection has sharpened: in May 2026 the Eurogroup publicly demanded EU access to Anthropic's withheld Mythos model so EU banks would not be exposed versus US peers. Whether your GPAI provider has signed the Code of Practice is now a deployer question, not a vendor question.

• · Independent — not affiliated with any provider, regulator, or notified body
• · Article-by-article: Annex III §5 + Article 26 §1–§12 + Article 27 FRIA + Article 25 reverse-bascule + DORA Article 28
• · 18-month runway: 2 December 2027 — confirmed post-Omnibus, not arbitrable

Timeline

The banking deadline is 2 December 2027 — not 2 August 2026

Most companies in the AI ecosystem focus on 2 August 2026 (Article 50 transparency). For credit institutions and insurers under Annex III §5, the binding deadline post-Digital Omnibus (trilogue agreement 7 May 2026) is 2 December 2027 — high-risk obligations on Annex III high-risk use cases postponed by 16 months from the original 2 August 2026.

Banking is expected to be covered by the Annex III general postponement to 2 December 2027 (the EP press release of 7 May 2026 enumerates biometrics, critical infrastructure, education, employment, law enforcement, and border management; the enumeration is non-exhaustive — §5 essential services covered by the general postponement per Council/IAPP/Modulos triangulation, consolidated text pending). Unlike machinery (which received an overlap removal), banking did not receive a sectoral exemption. ~18 months of regulatory runway to produce a defensible position before binding obligations apply.

Note on certainty: 10 EU Member States (AT, DK, NL, SK, SI, ES, GR, PT, RO, LV) formed a blocking minority against further deregulation. The 2 December 2027 deadline is durable. Vente sur certitude, pas sur arbitrage.

Sources: Reg. 2024/1689 Annex III · Council/Parliament press release (7 May 2026) · Bloomberg coverage of Eurogroup Mythos demand (May 2026) · MLex EU member states diverging views.

Our scope

What our assessment covers for banking AI

The Sprinkling Act report for a banking AI system covers the six gates of the standardised methodology, with the banking specificity layered in.

• →G1 — Art. 5 — Are any of the 8 prohibited practices triggered?
• →G2 — Art. 6(1) — Is the AI system a safety component of an EU-regulated product? (rare for banking, but checked)
• →G3 — Art. 6(2) + Annex III §5 — Credit/insurance scoring classification — core gate for banking
• →G4 — Art. 50 — Does an end user interact with the AI without knowing? (chatbot disclosure)
• →G5 — Art. 51/53 — Does the system use or distribute a general-purpose AI model? (Code of Practice signature check)
• →G6 — Art. 6(3) — Can the “no significant risk” exception apply?

Banking specificity:

• ·Annex III §5(b)/(c) determination with CJEU SCHUFA precedent applied
• ·Article 27 FRIA scope memo (mandatory for §5 by activity)
• ·Article 26 §1–§12 paragraph subset map (banking-specific active subset)
• ·Article 25(1)(b) reverse-bascule check on fine-tuning contracts
• ·DORA Article 28 third-party ICT cross-reference for GPAI providers
• ·GDPR Article 22 × AI Act Article 26 §11 dual-regime mapping
• ·Timeline orientation (2 December 2027 post-Digital Omnibus + significant change trigger)

Out of scope (explicit):

• ×Internal credit risk model validation (handled by EBA/CRR-aligned providers)
• ×DORA full ICT risk management framework (separate engagement)
• ×Stress-testing or capital adequacy assessment

GPAI provider chain

Where you sit in the GPAI cyber chain

Article 55 GPAI systemic-risk obligations activate 2 August 2026. Whether your GPAI provider has signed the Code of Practice and participates in cyber-coalitions is now a deployer due-diligence question. The Eurogroup publicly demanded EU access to Anthropic's withheld Mythos model in May 2026 (Bloomberg) so EU banks would not be exposed versus US peers — DORA × AI Act × Article 55 is now politically active at the highest level.

Project Glasswing — 12 launch partners + 40 critical-infrastructure organisations

Anthropic's coalition for vulnerability patching includes named partners across the cyber stack:

• ·Cloud / hyperscale: AWS, Google, Microsoft
• ·Hardware / silicon: NVIDIA, Broadcom, Apple
• ·Networking / security: Cisco, Palo Alto Networks, CrowdStrike
• ·Open source: Linux Foundation
• ·Financial services: JPMorganChase
• ·Foundation: Anthropic

If your GPAI provider is on the Code of Practice (Anthropic + OpenAI signed July 2025) and Glasswing-aware, your downstream Article 26 due-diligence has institutional cover. If they are not — or if they release comparable models less restrictively (OpenAI announced GPT-5.4-Cyber in April 2026 with a tiered "Trusted Access for Cyber" program) — your deployer cyber-resilience documentation has a gap that DORA Article 28 may force you to close.

Sources: AI Act Article 55 + Recital 110 · Reg. (EU) 2022/2554 DORA Article 28 · Anthropic Project Glasswing announcement · Bloomberg coverage of Eurogroup Mythos demand (May 2026) · UK AISI Mythos evaluation (32-step corporate-network attack simulation completed autonomously).