Image: Unsplash.
Correction (October 19, 2026): read this first. The story below does not hold up. (1) The EU AI Act's high-risk obligations did not take effect on August 2, 2026: the AI Omnibus, in force since July 27, 2026, moved the rules for Annex III systems, credit scoring included, to December 2, 2027 (European Commission; consolidated AI Act, Article 113). (2) The claim that CNIL sent documentation requests to 14 financial institutions, and refused three extensions, rests on a single aggregator blog. On October 19, 2026 we searched CNIL's site and found no publication about it, so treat it as unconfirmed. What CNIL did publish, on May 7, 2026, is a recommendation on using personal data to assess creditworthiness, automated decisions included, under the GDPR rather than the AI Act. We've kept the original text below for the record and removed this post from search indexing.
Correction (October 20, 2026): We rewrote the rest of this post. The earlier body still told the unconfirmed story as fact, including three denied extension requests, and it also said Article 72 requires deployers to report serious incidents within 15 days (incident reporting is Article 73, a provider duty, with deployers involved in limited cases) and that non-EU providers answer mainly to the European AI Office (the AI Office supervises general-purpose AI models; high-risk systems are, in general, supervised by national market surveillance authorities). What follows is limited to what CNIL and the AI Act's text say.
If you score credit applicants in France, two sets of rules matter, on two different clocks. The GDPR rules in CNIL's credit recommendation apply now. The EU AI Act's rules for credit scoring as a high-risk use apply from December 2, 2027.
What CNIL actually published
On May 7, 2026, after a public consultation, CNIL published its recommendation on using personal data to assess creditworthiness. It covers consumer and mortgage credit regulated by the French Consumer Code and replaces the pre-GDPR single authorization AU-005. CNIL's framing: it "renforce transparence et contrôle, notamment des décisions automatisées" (it strengthens transparency and control, in particular of automated decisions).
Screenshot: CNIL, "Octroi de crédit : la CNIL publie sa recommandation...", May 7, 2026.
The points a lender acts on, from the recommendation itself:
| Topic | What CNIL says |
|---|---|
| Data | Only data relevant and strictly necessary to assess the applicant's ability to repay |
| Rejected applicant who isn't a customer | Keep the file in the active database for at most six months from filing; after that, archive only for evidence |
| Fully automated decisions | Allowed where EU or French law authorizes them with safeguards, or where necessary to conclude the contract (GDPR Article 22(2)) |
| Safeguards | The right to human intervention, to give a point of view and to contest the decision; tell applicants when they apply that they can ask for a re-examination if refused |
| AI systems | Scoring tools may also be high-risk AI systems; "L'autorité de surveillance de marché compétente est seule compétente" to interpret and apply the AI Act to them |
The recommendation also flags a date French lenders should have in the diary: from November 20, 2026, Ordinance No. 2025-880 of September 3, 2025 adds an express legal basis in Article L. 312-16 of the Consumer Code for fully automated creditworthiness assessments for consumer credit, with the safeguards that come with it.
Screenshot: CNIL, Recommandation concernant l'évaluation de la solvabilité dans le cadre de l'octroi de crédit, page 10, May 2026.
That box at the bottom matters for the story we got wrong. CNIL itself says it isn't the body that interprets the AI Act for these tools.
What the AI Act adds, and when
Credit scoring is high-risk under Annex III, point 5(b): systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score," except fraud detection. The duties that come with that classification apply from December 2, 2027 under Article 113 as amended by the AI Omnibus.
| Duty | Who | Where in the Act |
|---|---|---|
| Meet the high-risk requirements (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy) | Provider of the scoring system | Articles 9-16 |
| Use per instructions, assign trained human oversight, monitor, keep logs at least six months, inform applicants | Lender that deploys it | Article 26 |
| Fundamental rights impact assessment before first use | Deployers of credit scoring systems | Article 27 |
| Explain the AI system's role in a decision on request | Deployer | Article 86 |
Article 27 is the one lenders tend to miss. It names deployers of point 5(b) and 5(c) systems, so a lender using a third-party scoring model has to do the assessment itself, not just collect the vendor's paperwork.
Who supervises? For AI used by financial institutions regulated under EU financial services law, in direct connection with those services, Article 74(6) makes "the relevant national authority responsible for the financial supervision of those institutions" the market surveillance authority, though a member state can designate another authority in appropriate cases. Breaches of provider or deployer duties can bring fines of up to 15 million euros or 3% of worldwide turnover, whichever is higher (Article 99(4)).
Image: Pexels, used under the Pexels License.
What to do in each window
Now (GDPR, CNIL recommendation):
- Check your data list against "strictly necessary" for solvency.
- Set the six-month active-database limit for rejected non-client files.
- If any decision is fully automated, confirm the legal basis (Article 22(2)), and from November 20, 2026 the Consumer Code basis for consumer credit.
- Tell applicants at the start that they can ask for a re-examination if refused, and staff the human review.
Before December 2, 2027 (AI Act):
- Ask your scoring vendor for its technical documentation and instructions for use.
- Name the people who oversee the system and record their training.
- Set log retention for the logs under your control to at least six months.
- Run the fundamental rights impact assessment before you rely on the system for Annex III scoring.
Our Annex III guide covers classification, and the high-risk documentation templates split each article between provider and deployer.
Related Reading
- EU AI Act Annex III: High-Risk AI System Classification Explained
- EU AI Act High-Risk Documentation Templates: Articles 9-15
- EU AI Act Annex IV Technical Documentation: Complete Guide
- EU AI Act August 2026: What's Delayed and What Still Applies
- Fintech AI Governance: CFPB, FCRA, and Fair Lending Compliance 2026
- CNIL and Agentic AI: GDPR Persistent Memory Compliance 2026
Sources: CNIL, May 7, 2026 announcement, CNIL recommendation (PDF), Regulation (EU) 2024/1689, consolidated text, European Commission, AI Omnibus.
