For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s

The week

On November 19, 2025, the European Commission, the EU’s executive arm, presented its Digital Omnibus package, and a deadline European lenders had been bracing for seemed to move. For two years, credit teams had been preparing for August 2, 2026, the day the EU’s Artificial Intelligence Act was due to start applying its strictest rules to the software banks use to decide who gets a loan.

An “omnibus” in EU language is a bundle of amendments to several laws at once, and this one was a set of proposed amendments to the EU’s digital rulebook, pitched as a simplification. One proposal targeted the AI Act.

The AI Act sorts AI systems by risk. The obligations for high-risk systems listed in its Annex III had been due to apply from August 2, 2026. Annex III includes AI used to evaluate creditworthiness or set credit scores, and AI used to price life and health insurance. The models that decide whether you can borrow, and on what terms, sit squarely in the high-risk category, alongside other uses where a wrong answer can upend someone’s life.

The Commission proposed applying those obligations only once harmonized standards and support tools were available. Harmonized standards are the detailed technical rulebooks that tell companies how to show they comply; without them, firms are guessing. The proposal set a long-stop date of December 2, 2027, meaning the rules would apply by then at the latest even if the standards were still not ready. High-risk AI embedded in regulated products, such as AI inside medical devices or machinery, would move to August 2, 2028.

A separate proposal in the package addressed the GDPR, Europe’s main data protection law, and other data rules. Nothing in the package was law yet: the European Parliament and the Council, which represents member state governments, both had to agree. In EU legislation the Commission proposes, and the other two decide.

So in the week of the announcement, the headline looked simple: more time for credit-scoring AI. For anyone actually running a lending business, the story was more complicated, and more demanding, than the headline suggested.

For banks, consumer lenders and buy-now-pay-later providers with European customers, the headline read as a reprieve of up to sixteen months for credit-scoring AI. That reading confused the most visible rule with the binding one.

Three other sets of obligations already governed automated credit decisions, and none of them moved. They were the GDPR’s rules on automated decisions as the Court of Justice had interpreted them, and the revised Consumer Credit Directive with its November 2026 application date. The third was banking supervisors’ expectations for loan origination and models. Taken in that order, they set the real timetable.

A prediction built from many hands

A credit score is a prediction. It takes what a lender knows about an applicant, such as income, existing debts, repayment history and length of employment, and turns it into a number that estimates how likely that person is to repay. Older scorecards were simple formulas a statistician could write on a whiteboard: so many points for owning a home, so many for years at the same address. Modern models, often built with machine learning, find patterns across hundreds of data points, many of which no human picked by hand.

Machine learning means software that learns rules from examples instead of being given the rules. Show it thousands of past loans and which ones were repaid, and it works out which characteristics predicted trouble. That makes it powerful and also opaque. The model may be accurate on average while being hard to explain for a particular person.

Most lenders do not build every piece themselves. A typical decision combines a score from a credit bureau, the companies that collect borrowing histories; perhaps a score from a fintech partner; and the lender’s own rules engine, which takes those scores and the application details and produces an answer, often in seconds. The applicant sees a single “yes” or “no.” Behind it sits a chain of systems from several companies.

Regulators care for three reasons. Credit decisions shape people’s lives: whether they can buy a car, rent a flat, start a business. Models can reproduce unfairness unnoticed, for example by learning that a postal code predicts default when postal code is really standing in for something a lender may not use. And a person who is refused deserves to understand why, so they can correct a mistake or improve their position. Every rule discussed below is, at heart, about those three concerns.

A credit decision resembles a dish assembled from several kitchens: the bureau prepares one ingredient, a partner another, and the lender combines them and serves it. If a diner asks what was in it, “ask the bureau” is not an acceptable answer. European law increasingly treats the lender, and sometimes the bureau as well, as responsible for being able to say what went into the decision and why it came out the way it did.

The GDPR, as the Court of Justice read it

Article 22 of the GDPR gives individuals the right not to be subject to a decision based solely on automated processing that significantly affects them, subject to exceptions and safeguards. A loan refusal plainly affects someone significantly. For years, credit bureaus and lenders argued about where that line fell: if a bureau only supplies a number and the lender makes the decision, whose decision is it? Two judgments settled much of the argument before the Omnibus appeared.

In the SCHUFA case in December 2023, the Court of Justice held that a credit bureau’s score can itself be an automated decision. That applies when a lender draws strongly on the score to grant or refuse credit. That pulled bureau scores and vendor scores into Article 22, alongside the lender’s final approval engine.

In the Dun & Bradstreet Austria case in February 2025, the Court held that a person refused after an automated credit assessment is entitled to an explanation. It must cover the procedure and principles actually applied. Handing over an algorithm or a formula does not meet that standard; a page of mathematics is not an explanation to an ordinary applicant. Where trade secrets are involved, the information may have to go to a supervisory authority or court to weigh the competing interests.

The operational consequence is concrete. A lender needs to be able to say, for an individual applicant, which data were used and how they moved the result. That means feature-level reason codes stored with each decision: a short record that says, for example, “high existing debt relative to income” and “short credit history” were the main factors. It means a process for producing an intelligible explanation on request, and contracts with score vendors that oblige them to support it. That work does not wait for AI Act standards.

The Consumer Credit Directive’s November 2026 date

The revised Consumer Credit Directive, Directive (EU) 2023/2225, had to be transposed by member states by November 20, 2025 and applies from November 20, 2026. A directive, unlike a regulation, does not apply directly; each country writes it into its own national law, a process called transposition. It widens the scope of consumer credit rules, including to many buy-now-pay-later products, and it rewrites the creditworthiness assessment.

Assessments must rest on relevant and accurate information about income and expenses. Special categories of personal data, such as health data, may not be used. Where the assessment involves automated processing, the consumer can request human intervention and a clear explanation of the assessment and of how the processing works. The consumer can also express a point of view and ask for a review. Those are AI Act themes, arriving on a fixed date through national law.

For a lender, the work splits into product and process. The decisioning platform has to route a review request to a person with authority to change the outcome, and log what happened. A reviewer who can only rubber-stamp the machine is not meaningful human intervention. Data pipelines, the automated flows that carry information from application forms and bureaus into the model, have to exclude prohibited inputs, including proxies that a model might learn. Customer-facing teams need scripts and service levels for explanation requests. Because each member state transposes the directive itself, legal teams also need a country-by-country view of the final wording.

A lender that did all of this by November 2026 would already meet much of what the AI Act asks of a deployer, the AI Act’s term for an organization that uses an AI system rather than builds it.

Supervisors’ expectations for origination and models

The third layer is supervisory. The European Banking Authority’s guidelines on loan origination and monitoring, applied since mid-2021, already set expectations for banks that use automated models in creditworthiness assessment. Institutions are expected to understand the models, manage the quality of their data, monitor their performance, and keep human judgment in the process. National supervisors and the ECB examine against those expectations now, through model risk reviews and on-site inspections.

That changes how a bank should read the Omnibus. A credit model that would struggle under AI Act documentation rules is probably already weak under its own model governance. Validation reports, which record independent testing of whether a model works as intended; data quality controls; override monitoring, which tracks when staff overrule the model and why; and challenger testing, which runs an alternative model alongside the live one to see if it performs better, are existing obligations. Supervisors do not need the AI Act in force to ask why a model refuses certain applicants more often, or why overrides cluster in one branch.

How the work actually gets done inside a lender

The practical sequence follows from the three layers. First, build what the GDPR and the Consumer Credit Directive require of every decision: stored reasons, explanation on request, human review that can change outcomes, and exclusion of prohibited data. Second, make sure model governance can show supervisors how each model was validated and how it is monitored. Third, and only then, address items specific to the AI Act, such as conformity assessment, registration and the provider’s technical file, which depend on standards that were not yet final.

Suppose a mid-sized consumer lender operates in four EU countries, with a credit card, personal loans and a new pay-later product sold at online checkouts. Its decision engine pulls a bureau score in each country plus an in-house model. The work would break down like this.

• Technology: the engine is changed to store the top reasons behind every decision, and to keep them for as long as the customer might ask. A review button in the case management system sends disputed cases to trained underwriters.
• Data: the data science team inventories every input, removes anything in a special category, and tests whether remaining inputs act as stand-ins for prohibited ones.
• Contracts: procurement reopens the bureau contracts to require that each bureau supply reason information and cooperate when a customer asks for an explanation.
• People: customer service gets clearly worded templates and a target response time; underwriters get authority, and training, to overturn the model.
• Legal: counsel tracks each country’s transposed text and flags differences.

The work is unglamorous, and all of it is needed regardless of when the AI Act’s high-risk rules finally apply.

Two second-order effects deserve attention. Lenders that buy scores from bureaus or fintech partners carry the explanation duty for decisions those scores drive, so procurement terms matter as much as model design. And a lender that pauses because of the Omnibus may find its November 2026 build squeezed into a few months, competing with year-end change freezes, the period when many banks forbid system changes to protect peak trading. The cheapest compliance path ran through the existing rules, not around them.

Budgets, borrowers and three sets of regulators

Handing all of this to the compliance department as a legal matter misses where the costs and risks actually fall.

Start with money. Rebuilding a decision engine to store reasons, adding a review workflow, retraining underwriters and renegotiating bureau contracts all take budget and, more scarce still, the time of the same small group of engineers and data scientists who also deliver new products. A lender that plans the work across a year spreads that load. A lender that waits compresses it, pays more for contractors, and delays its product roadmap.

Then customers. Credit is an emotional product. A person refused a loan for a family car or a pay-later purchase at checkout wants to know why, and an answer that sounds evasive feels like an insult. The new explanation and review rights turn that frustration into a formal request with a legal clock attached. Lenders that handle those requests well keep the relationship; some of those applicants will come back when their circumstances change. Lenders that handle them badly generate complaints, and complaints are a leading indicator for supervisors.

Then the regulators themselves, of which there are several. Data protection authorities enforce the GDPR. National consumer credit authorities enforce the transposed directive. Banking supervisors examine models and loan origination. Each can ask about the same decision from a different angle. A lender whose answer is consistent across all three, because it rests on the same stored reasons and the same governance, is in a far stronger position than one improvising a fresh answer for each.

Finally, reputation. Stories about unfair algorithms travel fast. A lender that can show, with evidence, how it tests its models for hidden bias and how a human can overturn them has a credible answer when a journalist or a politician asks. One that cannot is left defending a black box.

The prepared lender and the predictable errors

A well-prepared lender can answer any refused applicant within days, in words they understand, with reasons that actually reflect how the decision was made. It can show a supervisor a list of every model in use, who owns it, when it was last validated and how it is monitored. It knows which of its data inputs might act as a stand-in for a protected characteristic, and it has tested for them. Its vendor contracts give it what it needs to meet its own duties.

The errors are predictable:

• Reading “AI Act delayed” as “credit AI rules delayed,” and pausing work that other laws require.
• Treating the bureau score as the bureau’s problem, when the courts have said it can be part of the lender’s automated decision.
• Offering human review that cannot change the outcome, which fails the purpose of the right.
• Explaining a refusal by describing the model in general terms rather than the factors that drove this applicant’s result.
• Building one solution for “the EU” without checking how each country wrote the directive into its law.

There is a reputational dimension too. A customer who is refused and cannot get a sensible answer tends to tell others, and complaints are often what draw supervisors’ attention in the first place. Good explanations are a compliance duty and a customer service asset at the same time.

Signs a lender is ready for November 2026

1. If a customer we refused yesterday asked why, could we tell them clearly, based on what actually drove their result?
2. Which of our credit decisions rely heavily on a bureau or partner score, and do our contracts require those providers to help us explain them?
3. When a customer asks for human review, who looks at the case, and can that person change the outcome?
4. Are we on track for November 20, 2026 in every country, given each one’s own transposed text?
5. Has any part of our compliance program been paused because of the Omnibus, and should it have been?

A leadership team does not need to understand how a machine learning model is trained to judge the answers. Listen for specifics: named owners, dates, numbers of requests handled, examples of decisions that human review actually changed. Answers that stay general, or that point to another team or to a vendor, are the signal that more work is needed. And if the honest answer to the last question is yes, the time to restart that work is now, while November 2026 is still a deadline rather than a date already passed.

With hindsight

The AI portion of the Omnibus moved quickly by EU standards. The amending regulation entered into force on July 27, 2026, about eight months after the proposal. It fixed December 2, 2027 for standalone high-risk systems, including credit scoring, and August 2, 2028 for AI embedded in regulated products. The GDPR changes followed their own, separate track.

Nothing in that outcome changed the other two timetables. The Consumer Credit Directive’s November 2026 date stayed in place, and lenders still needed each member state’s final national text. The court rulings on automated credit decisions continued to apply. Lenders that used the year to build explanation, review and data controls for every decision now face the 2027 AI Act date with much of the deployer work done. Those that waited are building for two deadlines at once.

The episode also says something about reading regulatory news. Headlines track the newest and most talked-about law. Operations are governed by all the laws in force at once, including older ones that courts have sharpened along the way. When a headline announces relief, the useful check is what did not move. In this case, the parts that did not move were the parts that touched every single credit decision.

There is also a point about efficiency. The controls that the GDPR, the directive and banking supervisors already demanded overlap heavily with what the AI Act will ask of lenders that use credit-scoring systems. Building them once, early, means the later deadline becomes mostly a matter of documentation and registration rather than a rebuild. Building them late, under two deadlines, costs more and leaves less room to get them right.

Finally, the episode is a reminder that a lender’s exposure extends to the scores it buys. Contracts with bureaus and partners are where much of this work was won or lost.