Skip to content
AI Policy Generator

ESWhat applies

Credit or creditworthiness scoring

Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

Examples

By country

We only list countries where an obligation in force or adopted mentions this use case.

How rules treat it, by jurisdiction

JurisdictionLevelDateNote
European UnionHigh riskDecember 2, 2027Annex III(5)(b), excluding fraud detection; the EBA limits it to loan origination; FRIA for deployers.
European UnionSector rulesNovember 20, 2026Consumer Credit Directive (CCD2): right to human intervention, explanation and contesting the score.
SpainData protection—GDPR Art. 22 and CJEU case law (SCHUFA): a decisive score is an automated decision; impact assessment required.
PeruHigh riskSeptember 10, 2026Credit assessment is high-risk and the finance-sector deadline has passed; the SBS requires model risk management (Res. 053-2023).
EcuadorSector rules—JPRF and Superintendency of Banks fintech rules (2025): accountable algorithm owner, traceability, explainability and incidents.
EcuadorData protectionMarch 10, 2026SPDP general rule on AI and Data Protection Law Art. 20: notice, impact assessment and review of automated decisions.
ColombiaData protection—Laws 1266/2008 (credit reporting) and 1581/2012.
ChileData protectionDecember 1, 2026Law 21,719, Art. 8 bis: human review of automated decisions.
ArgentinaData protection—Law 25,326 and AAIP Res. 4/2019: explain the logic of automated decisions.
BrazilData protection—LGPD Art. 20: review and explanation of automated decisions, including credit profiles.
MexicoData protection—No AI rule from the supervisor; the data protection law and credit bureau rules apply.
United States (federal)Sector rules—ECOA/Reg B: adverse action notice with specific reasons even for complex models; FCRA when consumer reports are used.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189: financial or lending services are a consequential decision.
CaliforniaConsequential decisionJanuary 1, 2027CCPA ADMT: financial or lending services are a significant decision.

Common base documents

Depending on your situation

If the entity operates in the EU
If the model comes from a vendor
If there is a disparate impact risk
If it is trained on own data

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)