How to Prepare Credit Scoring and Underwriting Systems for the EU AI Act After the Digital Omnibus Delay

The EU AI Act’s high-risk obligations for credit scoring were pushed to December 2027, but banks and fintechs should use the extra time to plan, implement, and validate changes to their scoring architecture. This article explains what the revised timelines mean for lenders and how to prepare credit-scoring systems, with practical insights from a fraud detection and KYC platform we helped develop for a European financial services provider.

Updated 27 October 2026

Credit scoring sits in Annex III of the EU AI Act as a high-risk use case, alongside recruitment, biometric identification, and law enforcement tools. Annex III point 5(b) covers AI systems used to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud. Under the original timeline, the Act’s high-risk requirements for AI credit-scoring systems were scheduled to apply from 2 August 2026. These include risk management systems, data governance, technical documentation, human oversight, and obligations for providers and deployers.

That deadline no longer applies. On 24 July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal, and it entered into force on 27 July 2026, six days before the original cutoff. The Omnibus defers the requirements in Chapter III, Sections 1–3, except Article 6(5), for stand-alone Annex III systems, including in-scope credit scoring, to 2 December 2027. For product-related AI systems classified as high-risk under Article 6(1) and Annex I, the corresponding date is 2 August 2028.

What the delay covers and what it does not

The delay is real, but it covers less than most headlines suggest. Article 50 transparency obligations have generally applied since 2 August 2026, subject to a limited transitional period for Article 50(2). Providers of generative AI systems placed on the market before that date have until 2 December 2026 to comply with its machine-readable marking and detectability requirements for synthetic content. Separately, the Omnibus added two new prohibitions to Article 5, covering AI systems that generate non-consensual intimate imagery and child sexual abuse material, effective 2 December 2026. These requirements follow separate timelines from the Annex III obligations.

For banks, the practical reading is this: the revised timeline provides more time to prepare in-scope credit-scoring systems, while separate transparency and consumer-protection requirements already apply or take effect sooner.

National measures implementing Directive (EU) 2023/2225 (CCD2, the recast Consumer Credit Directive) are required to apply from 20 November 2026. Where creditworthiness assessment involves automated processing of personal data, CCD2 gives consumers the right to request and obtain human intervention. This includes a clear explanation of the assessment and the logic, risks, and effects of the automated processing, the opportunity to express their own view, and the right to request a review of the assessment and credit decision. Assessments must be based on relevant and accurate information about the consumer’s income, expenses, and other financial and economic circumstances, with appropriate verification. 

CCD2 is not part of the AI Act and was not touched by the Omnibus delay. For any bank or fintech offering consumer credit covered by CCD2, including certain installment and buy-now-pay-later products, these obligations take effect more than a year before the AI Act’s deferred high-risk requirements.

Why banks should not treat the Omnibus delay as a reason to slow down

The AI Act and CCD2 create different implementation timelines for related lending processes. The AI Act gives credit-scoring teams more runway, while CCD2 tightens the rules on automated lending decisions on a nearer horizon. A scoring platform built only to satisfy CCD2’s human-intervention and explainability requirements by November 2026 may still need additional work to meet the AI Act’s applicable high-risk requirements as they take effect from 2 December 2027. Building the two in sequence, rather than as one connected architecture, can mean reworking the same data pipelines and decision logs twice.

There is also a harmonized-standards gap. One reason the AI Act’s high-risk deadline moved is the delayed availability of standards, common specifications, and supporting guidance. That gap is expected to narrow during the deferral window, so scoring platforms designed now should prepare for more detailed documentation and testing expectations as standards and guidance become available. Starting now gives teams more time to adapt.

How Computools helped build KYCentrum, a hybrid fraud detection and KYC platform with audit trails

A European financial services provider with branches in Estonia, Latvia, and Lithuania needed to connect fragmented fraud prevention and customer verification workflows. Static detection rules and manual checks generated too many false-positive alerts, slowed onboarding, and forced analysts to switch between separate tools.

Our banking software development team helped develop KYCentrum, integrating real-time transaction monitoring, automated KYC verification, sanctions screening, AML enrichment, and analyst case management with the client’s existing banking infrastructure. Our team contributed to platform architecture, backend development, API integrations, and AI workflow automation.

The platform combined ML-supported fraud scoring with configurable rules and explanations for flagged transactions and customer profiles. Analysts could review risk signals, verification results, and case history in one environment. Decision logs and audit trails supported investigations and audit preparation, while configurable rules let risk teams adjust fraud and compliance logic without rebuilding the platform.

The platform delivered the following results:

• Confirmed fraud cases decreased by 41%.
• False-positive alerts decreased by 52%.
• Customer onboarding time decreased by 50–60%.
• Compliance case resolution became 63% faster.
• Operational compliance costs decreased by 20–30%.
• The organization reached ROI within 6 months.

KYCentrum focuses on fraud prevention and KYC. Its combination of configurable rules, ML-supported risk assessment, explainable outputs, analyst review, and audit trails provides a practical engineering reference for modernizing credit scoring, while applicable regulatory requirements must be assessed separately.

Build or modernize your credit scoring and underwriting systems for EU AI Act and CCD2 readiness. Working software increments in days, not months – with our engineers accountable for every release.

Contact Us →

How to build an AI Act and CCD2-ready credit scoring architecture

Step 1. Inventory every scoring and underwriting model in production

Start with a complete list of models and rules used in creditworthiness assessment, including third-party bureau scores, in-house scorecards, machine learning models, and any rules engine that influences an approval, limit, or pricing decision. For each one, record the data inputs, the decision it feeds, whether a human reviews the output before it reaches the customer, and which jurisdictions it serves. Also identify the organization’s role as provider, deployer, or both. This inventory forms the basis for assessing which components qualify as AI systems and which fall under the high-risk classification in Article 6 and Annex III. Existing systems also need a separate check against the transitional provisions in Article 111(2).

Step 2. Separate deterministic underwriting rules from AI-assisted scoring

Fixed underwriting rules, such as income thresholds, debt-to-income ratios, and product eligibility criteria, serve a different function from models that infer patterns from data. Keep these two layers architecturally distinct. Deterministic rules should remain easy to trace and explain on their own; AI-assisted components should sit behind a layer that logs model version, input features, and output score for every decision. This separation helps teams test, explain, and update each component without rebuilding the entire platform.

In KYCentrum, we combined configurable fraud rules with ML-supported scoring. Risk teams could adjust rule-based logic without rebuilding the system, while explanations helped analysts understand why transactions or customer profiles were flagged.

Step 3. Build the human-intervention path CCD2 requires

CCD2 gives consumers the right to request human intervention where creditworthiness assessment involves automated processing of personal data. This includes a clear explanation of the assessment, the opportunity to express their own view, and a review of the assessment and credit decision.

This means the scoring platform needs a queue for review requests, a case view that shows the underwriter the same features the model used, and a way to record the reviewer’s final decision and rationale alongside the original automated output. With the 20 November 2026 application date approaching, prioritize testing the review-request process, reviewer access, and decision recording.

Step 4. Establish data governance and lineage for credit-decision data

The AI Act’s applicable high-risk requirements call for data governance practices that address bias, representativeness, and data quality, along with technical documentation available for supervisory review. Every feature used in a credit decision should carry a traceable source, transformation history, and a documented rationale for inclusion. Retrofitting lineage onto years of accumulated scoring data can be time-consuming, so it should be a practical priority during the Omnibus deferral period.

Step 5. Define human oversight and override authority

The AI Act requires effective human oversight of high-risk systems. Define who can override a model’s decision, under what conditions, and how that override is logged. For high-volume scoring platforms, design oversight based on the system’s risks and the lender’s policies. This can include enhanced review for edge cases and decisions near policy thresholds, alongside the consumer-requested review process required by CCD2.

Step 6. Build the risk management and monitoring layer

A production-ready system needs ongoing monitoring for model drift, demographic and outcome disparities where the relevant data can lawfully be processed, declining scoring accuracy, and a defined process for retraining, revalidating, and redeploying models under version control. 

For in-scope high-risk credit-scoring systems, providers should prepare lifecycle risk management under Article 9 and post-market monitoring under Article 72. Deployers have operational monitoring duties under Article 26(5). Monitoring dashboards and alerting built here should be treated as permanent infrastructure rather than a pre-audit exercise.

Include preparation for the fundamental rights impact assessment required under Article 27 for deployers of in-scope credit-scoring systems.

Step 7. Prepare technical documentation and conformity assessment evidence

Assemble documentation describing the model’s purpose, training data, performance metrics, known limitations, and risk mitigations for internal conformity assessment and supervisory review. 

For credit-scoring systems under Annex III point 5(b), Article 43(2) provides for the internal-control procedure in Annex VI, without a notified body. As supporting standards and guidance develop, build the documentation process to be modular: it should be straightforward to add new required fields or evidence types as standards are published, rather than rewriting the whole documentation set each time.

In KYCentrum, pre-launch QA covered performance, rule logic, verification workflows, and audit trail consistency. These checks supported the reliability of the platform’s review and reporting workflows.

Step 8. Align transparency disclosures with the parts of the AI Act that were not delayed

Article 50 has generally applied since 2 August 2026. Assess affected customer-facing interactions separately: credit scoring alone does not automatically trigger its AI-interaction disclosure requirement. If a customer-facing AI interaction falls under Article 50, the platform must already provide the applicable disclosures, independent of the Annex III conformity work.

A limited transition until 2 December 2026 applies to Article 50(2) marking obligations for generative AI systems placed on the market before 2 August 2026. Map which customer touchpoints are affected now, rather than assuming the whole AI Act moved to 2027.

Core capabilities of an AI Act and CCD2-ready lending platform

Best practices for financial institutions preparing now:

• Do not wait for December 2027. Use the deferral window to improve data traceability, decision logs, and review workflows, while allowing documentation and testing procedures to evolve as standards and guidance become available.
• Treat CCD2 as the nearer deadline. Its 20 November 2026 application date arrives more than a year before the AI Act’s deferred high-risk obligations, and its human-intervention and explainability requirements touch the same systems.
• Keep deterministic and AI-assisted decision logic architecturally separate. It simplifies both explainability and later conformity assessment.
• Build monitoring and documentation as permanent infrastructure, not a pre-audit checklist, so model changes, validation results, and review decisions remain documented throughout the system’s lifecycle.
• Track Article 50 separately from Annex III. Some AI Act obligations were never delayed, and conflating the two creates blind spots.

Conclusion

The Digital Omnibus gave credit-scoring teams real breathing room on the AI Act’s high-risk obligations, but it did not remove the work. CCD2’s nearer deadline remains unchanged, and most of the AI Act’s transparency obligations already apply. Institutions that use the deferral window to build traceable, well-governed scoring architecture, rather than postpone the project, will be better positioned to adapt as standards and guidance develop and to meet CCD2’s human-intervention requirements from 20 November 2026.

Note: This article is for general information and is not legal advice. Check your own obligations with qualified counsel.