EU AI Act: Credit Scoring (Annex III, 5) — Obligations + ECJ SCHUFA

Main article: High-risk AI under Annex III — classification of all eight Annex III areas and the exception in Art. 6(3).

1. ECJ C-634/21 SCHUFA (12/2023)

On 7 December 2023 the ECJ held (C-634/21, SCHUFA) that the establishment of a score value is an automated individual decision within the meaning of Art. 22 GDPR where the lending bank bases its decision essentially on that value. As a consequence, human review is mandatory.

For implementation this means: credit scoring is covered by two sets of rules at the same time, and each demands its own evidence. The data protection track runs via the GDPR — with its own data subject rights, its own supervision and a fine range of up to EUR 20 million or up to 4 % of total worldwide annual turnover for infringements of the rights of the data subject (Art. 12 to 22 GDPR), whichever is higher (Art. 83(5) GDPR). The second track follows the AI Act with its risk-based approach (recital 26 AI Act): for high-risk systems it requires, among other things, human oversight under Art. 14 AI Act and has applied in its general scope since 2 August 2026 (Art. 113 AI Act).

Both tracks concern the same credit decision but ask different questions: the GDPR asks about legal basis, transparency and data subject rights, the AI Act about conformity, data governance and oversight design. Practical recommendation: keep both evidence trails per score model in one joint file rather than in separate data protection and model validation silos.

2. Annex III, 5 EU AI Act

Annex III no. 5 AI Act contains the high-risk classification for "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score".

Annex III no. 5 is the area "access to and enjoyment of essential private services and essential public services and benefits"; alongside creditworthiness it also covers health and life insurance scoring as well as emergency call systems. For credit institutions point (b) is relevant (creditworthiness assessment), for insurers point (c) (life and health insurance scoring). The legal consequence follows from Art. 6(2) AI Act: the systems listed in Annex III are deemed to be high-risk.

The exception in Art. 6(3) AI Act applies only where the system does not pose a significant risk to health, safety or fundamental rights — and it is expressly excluded where the system performs profiling of natural persons. Where the system produces recommendations or assessments that can materially influence human decisions, it remains high-risk despite Art. 6(3). Practical recommendation: anyone wishing to examine the exception should first record whether the score model performs profiling of natural persons, should read Art. 6(3) narrowly and, in case of doubt, classify the system as high-risk.

The entry point for every assessment is the definition in Art. 3(1) AI Act: a machine-based system that is designed to operate with varying levels of autonomy and that infers, from the input it receives, how to generate outputs such as predictions, recommendations or decisions. Annex III must be distinguished from the prohibited practices in Art. 5(1) AI Act, which include social scoring (point (c)) — there the higher fine range of Art. 99(3) applies.

3. Obligations and start of application

The following overview lists the high-risk obligations of the AI Act for credit scoring systems with their source; the next paragraph sets out from when they apply.

The general date of application of the AI Act was 2 August 2026 (Art. 113 AI Act); however, the high-risk obligations in Chapter III Sections 1 to 3 apply to Annex III systems such as credit scoring only from 2 December 2027. Chapters I and II with the prohibitions in Art. 5 applied earlier, since 2 February 2025, as did Chapter V for general-purpose AI models since 2 August 2025 (with the exception of Art. 101); Art. 6(1) with the Annex I products follows only from 2 August 2028. The basis for both high-risk dates is Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026 (Art. 113(3)(c)(i) and (ii) AI Act as amended). The FRIA obligation under Art. 27 belongs to Chapter III Section 3 and follows the same date for Annex III systems, namely 2 December 2027.

The allocation of roles for risk management, technical documentation, conformity assessment and the EU database is set out in section 7.

4. Bias testing is mandatory

Art. 10 AI Act requires a data governance concept, including examination of the training data for bias against protected groups; which statistical methods are to be used for this is not evidenced in this article (sources reviewed as of 2 May 2026).

Practical recommendation, not a statutory testing scheme: statistical tests and their documentation can be broken down into three working steps — (1) determine along which characteristics testing is carried out; the catalogue is provided by equal treatment law (next paragraph), (2) examine the data basis for each characteristic for gaps and bias, (3) record the test methodology, the data basis and the result separately for each model version so that changes to the model remain traceable. Which statistical methods, metrics or thresholds Art. 10 AI Act requires in detail, and at what point testing must take place, is not evidenced in this article (sources reviewed as of 2 May 2026); the wording of Art. 10 AI Act is decisive.

Which grounds count as protected characteristics is set out in equal treatment law — and here Germany and Austria differ in their structure. In Germany, § 1 AGG names the grounds of race and ethnic origin, gender, religion or belief, disability, age and sexual identity. In Austria, the corresponding provisions — in relation to employment relationships — are § 3 GlBG (gender) and § 17 GlBG (ethnic affiliation, religion or belief, age, sexual orientation); for goods and services § 31 GlBG applies — there for ethnic affiliation alone (see next paragraph).

For lending business, Germany adds the civil-law prohibition of discrimination in § 19 AGG: it applies to civil-law obligations that typically arise without regard to the person in a large number of cases (mass transactions, Massengeschäfte) and to private insurance; for race and ethnic origin it applies comprehensively in addition. The Austrian counterpart is § 31 GlBG, which prohibits discrimination on grounds of ethnic affiliation in, among other things, access to and supply of goods and services. Whether a specific credit product falls under these provisions must be clarified case by case.

Procedurally, the burden of proof shifts in Germany: under § 22 AGG the opposing party must prove that there was no infringement once the claimant proves, in a dispute, indications that give rise to a presumption of discrimination on a ground under § 1 AGG. In Austria, this is replaced by prima facie evidence under § 12(12) GlBG (gender) and § 26(12) GlBG (remaining grounds): the person concerned substantiates the facts of discrimination, after which the defendant bears the counter-evidence. Anyone measuring bias along sensitive characteristics also touches on Art. 9(1) GDPR: the processing of data revealing, for example, ethnic origin or religious beliefs is prohibited in principle and permissible only under the narrow exceptions in paragraph 2 — for instance explicit consent. That leaves one question open which must be clarified before the first bias test: on what does the processing of sensitive characteristics solely for testing purposes rely? The legal basis must be clarified in advance, case by case.

5. Human final decision

An AI score may not be the sole basis for a credit rejection: Art. 14 AI Act requires human oversight, and the decision is taken by the responsible person.

Human oversight is anchored in law in Art. 14 AI Act; it belongs to the Annex III obligations from Section 3, while the accompanying deployer obligations — relevance of input data, retention of logs, information of workers — are set out with their sources in section 7. Which oversight measures Art. 14 AI Act requires in detail is not evidenced in this article (sources reviewed as of 2 May 2026); the wording of Art. 14 AI Act is decisive.

Practical recommendation, not a statutory requirement: record for each rejection which person decided on what information basis, and evaluate how frequently the human decision deviates from the score. A deviation rate close to zero is an indication that oversight is exercised formally but is not effective in substance. The frequency of this evaluation is an organisational decision and not a deadline under the AI Act.

6. Transparency for applicants

In the event of a rejection: reasons + access to data (Art. 15 GDPR + Art. 86 AI Act). Under Art. 86(1) AI Act, persons affected by a decision taken by the deployer on the basis of the output of a high-risk AI system listed in Annex III (with the exception of Annex III no. 2) have the right to a clear and meaningful explanation of the role of the AI system in the decision-making procedure and of the main elements of the decision taken. Art. 50 AI Act is not relevant here: it governs marking and disclosure obligations (direct interaction with humans, synthetic content, emotion recognition/biometric categorisation, deep fakes, AI-generated texts on matters of public interest).

Operationally, a deadline attaches to the data protection side: on requests from data subjects under Art. 15 to 22 GDPR, the controller must provide information on the action taken without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months where necessary, taking into account the complexity and number of the requests; the person must be informed of the extension within the first month, together with the reasons (Art. 12(3) GDPR).

Practical recommendation: place the explanation building block under Art. 86(1) AI Act directly in the rejection process and not in the data subject access process. Otherwise the explanatory effort only arises with the data subject request — that is, under the one-month period in Art. 12(3) GDPR.

7. Provider or deployer: who bears which obligation

Anyone who develops a score model or places it on the market under their own name is a provider (Art. 3(3) AI Act) and bears the main burden; anyone who uses a bought-in model under their own authority is a deployer (Art. 3(4) AI Act). The role must be determined per system, not per company.

The FRIA under Art. 27 AI Act covers the description of the AI use, the persons affected, the risks to fundamental rights and the safeguards (on its start of application see section 3). Caution on a change of role: under Art. 25 AI Act a deployer becomes a provider where it substantially modifies the purpose or functionality or places the system on the market under its own name — anyone who rebuilds a purchased score model for their own credit product and markets it should check this point before rollout.

8. GDPR interface: legal basis, DPIA, service providers

Alongside the AI Act, every credit scoring operation needs a sound data protection basis: processing is lawful only if at least one of the six grounds for permission in Art. 6(1) GDPR is met — consent, contract or pre-contractual measures, legal obligation, vital interests, public interest or legitimate interests. If you rely on consent, you must be able to demonstrate it, and withdrawal must be as easy as giving it (Art. 7(1) and (3) GDPR).

Art. 35(3) GDPR names, as a standard example of the obligation to carry out a data protection impact assessment, the systematic and extensive evaluation of personal aspects (profiling) on which decisions producing legal effects are based. Practical recommendation: record in writing how your own score process is classified under this standard example. FRIA and DPIA rest on separate legal bases: the FRIA on Art. 27 AI Act, the DPIA on Art. 35 GDPR.

Where the score is calculated by an external service provider, Art. 28 GDPR applies: only processors offering sufficient guarantees of appropriate technical and organisational measures may be used, and the cooperation requires a contract with the minimum content set out in paragraph 3. On the data protection officer, DE and AT diverge: in Germany, § 38(1) of the German Federal Data Protection Act (BDSG) requires a designation where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data — and irrespective of that number where processing operations are subject to a DPIA under Art. 35 GDPR. Austria provides for no numerical threshold going beyond Art. 37 GDPR; the designation obligation there follows directly from Art. 37 GDPR (§ 5 of the Austrian Data Protection Act (DSG) additionally governs confidentiality and freedom from instructions).

9. Supervision and sanctions in Germany and Austria

Credit scoring is subject to separate supervisory regimes — for credit institutions in Germany additionally to banking supervision. For the AI Act, each Member State designates at least one notifying authority and at least one market surveillance authority under Art. 70(1) and (2); one market surveillance authority acts as single point of contact, and the contact details had to be made publicly available by 2 August 2025. In Germany the market surveillance authority has been the Federal Network Agency (Bundesnetzagentur) since 29 July 2026 (§ 2(1) of the German AI Market Surveillance and Innovation Promotion Act (KI-MIG)), in so far as sectoral authorities — such as BaFin — are not competent; the single point of contact under Art. 70(2) is likewise the Federal Network Agency (Bundesnetzagentur) (§ 6(1) KI-MIG). As at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act; the RTR AI service point is an information and advice body without supervisory powers. Practical recommendation: clarify competence once per site and store the contact details where your incident response process needs them — not only when an incident occurs.

For data protection, the competent bodies in Germany are the authorities competent under Land law for non-public bodies (§ 40(1) BDSG) and the Federal Commissioner for Data Protection (BfDI) for federal bodies (§ 9(1) BDSG), and in Austria the Austrian Data Protection Authority (Datenschutzbehörde) (§ 18(1) DSG). For credit institutions in Germany, banking supervision under the German Banking Act (KWG) applies alongside the AI Act; the supervisory requirements for the score model must be assessed separately. Practical recommendation: file the evidence on the score model in such a way that it can be presented both to market surveillance under the AI Act and to banking supervision, instead of maintaining two separate reporting lines.

All rows in this table state statutory upper limits, not standard amounts. As an EU regulation, the AI Act applies directly and in identical wording in Germany and Austria; only the competent authorities and the sanctions regime within the framework of Art. 99(1) AI Act are regulated nationally.