AI in lending and credit scoring

A loan passes through intake, checking, scoring, decision and monitoring, and AI appears at each step. AWS describes mortgage lenders who extract and verify data from income statements, tax returns and credit reports, assess risk from credit histories and employment records, and answer borrower questions with chatbots. In underwriting a model proposes a risk class, and anomaly detection looks for forged applications.

German banks are careful with the scoring step. BaFin reports that smaller German banks use AI mainly for texts, chatbots and fraud detection, and rarely to check creditworthiness. BaFin and the Bundesbank set out their expectations for machine learning in risk models in a joint consultation paper in 2021, covering both the regulatory capital models and the internal risk models.

Annex III, point 5(b) of the EU AI Act lists AI systems that evaluate the creditworthiness of natural persons or establish their credit score as high-risk. A bank that builds such a model carries the provider duties, from risk management and data governance to technical documentation. A bank that buys one carries the deployer duties, including human oversight. Lending to companies is outside this entry, because it covers natural persons only.

The EU Court of Justice added a second line in case C-634/21 on SCHUFA: a score that strongly influences whether a lender grants credit can count as an automated decision under Article 22 of the GDPR. Lending in Germany covers the ruling and the license rules for lenders.

Article 18 of the new Consumer Credit Directive (EU) 2023/2225 gives a consumer whose creditworthiness was assessed by automated processing the right to human intervention from the lender, the right to a meaningful explanation of the assessment including its main variables and logic, and the right to contest the decision. The same article bars special categories of personal data, such as health data, and data from social networks from the assessment. Member States apply the directive from November 20, 2026.

For a lender that means every automated decline needs a path to a person and an explanation a customer can follow. A model that cannot name the main variables behind a score is hard to defend under these rules.

Under the new Consumer Credit Directive the consumer can demand that a person reviews the decision, and under the SCHUFA ruling a score that drives the outcome falls under the GDPR rules on automated decisions. A fully automatic decline without a way to reach a person does not fit either rule.

The AI Act's high-risk entry covers credit scoring of natural persons, so a model for corporate loans is not high-risk under that point. It still falls under the bank's model risk rules; credit risk in German banking covers how such loans are assessed and monitored.