Skip to content
AI Policy Generator

ESWhat applies

Credit or creditworthiness scoring in Spain: related rules

Models that estimate a person's likelihood of default or creditworthiness to approve, deny or price credit. It is high-risk in the EU and Peru and requires explaining denial reasons and allowing human review in almost every jurisdiction.

Risk classification

JurisdictionLevelDateNote
European UnionHigh riskDecember 2, 2027Annex III(5)(b), excluding fraud detection; the EBA limits it to loan origination; FRIA for deployers.
European UnionSector rulesNovember 20, 2026Consumer Credit Directive (CCD2): right to human intervention, explanation and contesting the score.
SpainData protection—GDPR Art. 22 and CJEU case law (SCHUFA): a decisive score is an automated decision; impact assessment required.

Obligations related to this use case

Appoint a data protection officer and involve them in AI projects

LOPDGDDRGPD, arts. 37-39; LOPDGDD, arts. 34-37In force

Already applicable

When it relates
Mandatory for public bodies and for sectors such as banking, insurance, healthcare, education, telecom, energy, private security, profiling-based advertising and credit reference files.
What the rule provides
  • Appoint the officer and notify the AEPD within ten days.
  • Involve them in every AI project with personal data, especially in the DPIA.
  • Ensure their independence and resources.
Typical evidence
  • Appointment record and proof of notification to the AEPD.
  • The officer's opinion in AI system DPIAs.
Verification
Verified in the official source on October 31, 2026Consolidated text in the BOE (Spain's official gazette). In force since 2018; no new dates to confirm.

Using high-risk systems: human oversight, logs and monitoring

AI ActReglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies later

Applies from December 2, 2027

Deadlines by profile

  • : Annex III high-risk systems
  • : Clinical AI that is a high-risk medical device (Annex I)
When it relates
If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).
What the rule provides
  • Use the system according to the provider's instructions.
  • Assign human oversight to people with enough competence, training, authority and support.
  • Ensure input data under your control is relevant and representative.
  • Monitor operation, suspend use when risks appear, and report serious incidents to the provider and the authority.
  • Keep automatically generated logs under your control for at least six months.
  • Public bodies: register the use in the EU database. Systems already in use by public authorities: deadline Aug 2, 2030.
Typical evidence
  • Appointment and training records of human overseers.
  • Log retention policy and sample logs.
  • Monitoring plan and incident log.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i) (Dec 2, 2027 for Annex III). Regulation (EU) 2026/1744 moved the date but not the content of Article 26.

Inform and explain to people affected by high-risk decisions

AI ActReglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies later

Applies from December 2, 2027

When it relates
If you make or support decisions about people with an Annex III high-risk system.
What the rule provides
  • Tell people that a high-risk system is being used on them.
  • On request, give a clear and meaningful explanation of the system's role in the decision and its main elements when the decision has legal or similarly significant effects.
Typical evidence
  • Notices to affected people.
  • Explanation template and log of requests handled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Fundamental rights impact assessment (FRIA)

AI ActReglamento (UE) 2024/1689, art. 27Adopted, applies later

Applies from December 2, 2027

When it relates
Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.
What the rule provides
  • Before first use, assess processes, duration and frequency, affected people or groups, specific risks of harm, human oversight measures and risk responses, including complaints.
  • Notify the results to the market surveillance authority using the AI Office form.
  • It can build on an existing data protection impact assessment and must be updated when factors change.
Typical evidence
  • Signed and dated FRIA.
  • Proof of notification to the authority.
Verification
Verified in the official source on November 2, 2026Date checked (Article 113(c)(i)). Scope per Article 27: it does not cover every employer using AI for hiring; some vendor websites wrongly extend it.

Providers of Annex III high-risk systems

AI ActReglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies later

Applies from December 2, 2027

When it relates
If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).
What the rule provides
  • Risk management system across the lifecycle and governance of training, validation and test data.
  • Technical documentation, automatic event logging, instructions for use, design for human oversight, and accuracy, robustness and cybersecurity.
  • Quality management system, conformity assessment, EU declaration of conformity, CE marking and registration in the EU database.
  • Post-market monitoring and serious-incident reporting.
  • If you conclude that your Annex III system is not high-risk (Article 6(3)), document the assessment and register it before placing it on the market.
  • Small mid-caps (fewer than 750 employees) get simplified documentation templates.
Typical evidence
  • Technical file and quality management system.
  • EU declaration of conformity and registration number.
  • Post-market monitoring plan.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i). The small mid-cap category comes from secondary sources on Regulation (EU) 2026/1744.

Safeguards against solely automated decisions

GDPRRGPD, arts. 13.2.f), 14.2.g), 15.1.h) y 22; STJUE C-634/21, SCHUFA, 7-dic-2023; STJUE C-203/22, Dun & Bradstreet Austria, 27-feb-2025In force

Already applicable

When it relates
If AI makes, or in practice determines, decisions with legal or similarly significant effects on people without meaningful human involvement: hiring, credit, insurance, education, benefits, pricing or access to services. Diagnostic support reviewed by a clinician is usually not a solely automated decision.
What the rule provides
  • Avoid decisions based solely on automated processing unless needed for a contract, authorized by law or based on explicit consent.
  • Where allowed, provide real human intervention and the ability to give one's view and contest the decision.
  • A third-party score that determines the decision also counts as an automated decision.
  • Disclose that the automated decision exists and, on request, give meaningful information about the logic involved and its consequences. The law does not require a specific letter format.
Typical evidence
  • Human review procedure with timelines and owners.
  • Log of decisions and reviews.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Data protection impact assessment (DPIA)

GDPRRGPD, art. 35In force

Already applicable

When it relates
If you use AI to evaluate or decide about people, monitor, use biometrics, train models on personal data, or process sensitive or children's data.
What the rule provides
  • Carry out the DPIA before starting: description, necessity and proportionality, risks and measures.
  • Consult the authority if residual risk remains high.
  • Review it when the system or model changes.
Typical evidence
  • Signed DPIA, with the data protection officer's opinion if there is one.
Verification
Verified in the official source on October 31, 2026Official text on EUR-Lex. In force since 2018; no new dates to confirm.

Human intervention, explanation and challenge of automated scoring

CCD2Directiva (UE) 2023/2225, art. 18.5 y 18.8Adopted, applies later

Applies from November 20, 2026

When it relates
If you grant consumer credit and assess creditworthiness with models or AI. As a directive, it binds companies through national law: in Spain transposition is still pending and Parliament was dissolved on Oct 6, 2026, so the actual date in Spain may be later.
What the rule provides
  • Allow consumers to request and obtain human intervention by the lender.
  • Give a clear, understandable explanation of the assessment, its logic and risks, and the main data used.
  • Allow consumers to express their view and request a review of the decision.
  • Do not use special categories of data or social media data to assess creditworthiness.
Typical evidence
  • Human review procedure and explanation letter templates.
  • List of data sources allowed in the model.
Verification
Verified in the official source on November 4, 2026Checked in the Official Journal text (CELEX 32023L2225): Article 18(8) (human intervention, explanation, point of view and review), Article 18(5) (no special categories or social media data) and Article 48 (transposition by Nov 20, 2025 and application from Nov 20, 2026). The original text was reviewed, not the consolidated version. As a directive, it binds private companies through national law. Per secondary sources, the Spanish draft bill (Jan 7, 2026) was not adopted; not checked in the BOE.

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)Spain