EU AI Act for Fintech AI Companies
For fintech teams: credit scoring and life and health insurance pricing are high-risk, fraud detection is excluded, and Scanara supports the work.
Credit scoring and insurance pricing are high-risk uses
Annex III point 5(b) covers evaluating the creditworthiness of natural persons and credit scoring. Point 5(c) covers risk assessment and pricing for life and health insurance. Fraud detection is excluded from point 5(b). The high-risk rules apply from 2 December 2027. Next step: list your AI systems and check each against points 5(b) and 5(c).
What lands on fintech teams
Providers meet Articles 8 to 15
Providers of credit-scoring and insurance-pricing systems meet the high-risk requirements (Article 16) from 2 December 2027, unless the Article 6(3) exception applies. They follow the conformity assessment based on internal control (Annex VI).
Banks and insurers are deployers
A bank or insurer that uses such a system under its authority is a deployer (Article 3(4)). Before deployment it assesses the impact on fundamental rights for point 5(b) and 5(c) systems, whatever its status (Article 27(1)).
Other fintech AI needs a separate check
Anti-money-laundering checks, algorithmic trading and robo-advice are not named in point 5. Check each against the rest of Annex III and against Annex I. Article 5 and Article 50 can apply too.
What Scanara supports for fintech teams
Inventory with recorded classification
You register each AI system. Scanara records its risk classification, your reasoning for point 5(b) or 5(c) and any Article 6(3) assessment. You make the decision.
Code and document checks
Code rules cover Articles 9, 10, 12, 14 and 15. Document scans check Articles 11 and 13 content. Code rules detect standard ML framework patterns; custom code can be missed.
Guided assessments
Guided assessments cover risk management (Article 9), deployer duties (Article 26) and the fundamental rights impact assessment (Article 27). You answer; Scanara stores the results as evidence.
Draft technical documentation
Scanara generates drafts of the Annex IV technical documentation from your inputs and assessment answers, with versioned records. Your team completes and verifies them.
Key date and fine ceiling
2 December 2027
High-risk rules apply to credit-scoring and insurance-pricing systems from this date. Systems placed on the market or put into service earlier are covered only after significant design changes (Article 111(2)).
EUR 15 million or 3%
Fine ceiling for breaches of provider and deployer duties: up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited practices reach EUR 35 million or 7% (Article 99(3)).
Questions fintech teams ask
Is my credit-scoring AI high-risk?
Yes, if it is intended to evaluate the creditworthiness of natural persons or establish their credit score (Annex III point 5(b)), unless the Article 6(3) exception applies. A system that profiles natural persons is always high-risk.
Is fraud detection high-risk?
Not through point 5(b), which excludes AI systems used to detect financial fraud. Such a system is high-risk only if another point of Annex III or Annex I covers it.
Does insurance pricing count?
Only for life and health insurance: AI intended for risk assessment and pricing in relation to natural persons is high-risk (point 5(c)). Other insurance lines are not named in point 5.
When do the rules apply?
The high-risk rules for Annex III systems apply from 2 December 2027 (Article 113(c)(i)). A system placed on the market or put into service earlier is covered only after significant design changes. The Article 5 prohibitions apply since 2 February 2025.
Can financial services law cover some of the duties?
In part. Financial institutions under internal governance rules of Union financial services law meet the quality management duty through those rules, with exceptions (Article 17(4)). They keep technical documentation and logs within the documentation kept under that law (Articles 18(3), 19(2)). The Act names no specific law; ask counsel which rules count.
Read next
See a sample scan report
The demo shows a real, anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.