Written by: Luke Sobieraj, Founder & COO, Digital Colliers
If you run credit decisioning at a European lender, the ground already moved under you. The Court of Justice ruling in SCHUFA (C-634/21) landed in December 2023, and it treated automated credit scoring as an Article 22 decision under GDPR. That means the exposure is live now, not in 2027 when the AI Act's high-risk obligations kick in.
Most credit teams I talk to still can't produce three artefacts on demand: a current model card, a data lineage doc that ties features back to source systems, and a human-review log that shows a real person touched the borderline cases. If a regulator or a plaintiff's lawyer asks tomorrow, the answer is a Slack thread and a Jupyter notebook someone's laptop.
What SCHUFA actually changed
The ruling did two things. It confirmed that a score which effectively decides whether you get credit is itself the automated decision, even if a human formally signs off downstream. And it pulled the whole scoring pipeline into GDPR Article 22's regime, which means meaningful information about the logic, plus a real right to contest.
So when the AI Act high-risk obligations apply on 2 December 2027, you're not starting from a clean slate. You're stacking a second regime on top of GDPR exposure that's already been enforceable since late 2023. And the GDPR fine ceiling is 4% of global turnover, or 20 million euros, whichever is higher. The AI Act adds another 3% or 15 million on top for high-risk violations.
What a defensible model card looks like
Model cards used to be a nice-to-have artefact for the ML team's wiki. Under the current regime, they're the primary evidence you'll hand a regulator. A defensible one covers, at minimum:
- The exact model version in production, with a hash and a deploy date
- Training data provenance, including cut-off dates and any excluded populations
- Input features, their source system, and their refresh cadence
- Performance metrics broken out by protected characteristic where you can
- Known failure modes and the thresholds where you route to human review
- The retraining cadence and who signs off
The piece most teams miss is the last one. A model card that names a person and a date is a control. A model card that describes the model in the abstract is a marketing document.
Lineage is the part that fails audits
Model cards fail gracefully. Data lineage fails hard. If a customer challenges a decline under Article 22, you need to walk backwards from the score to the raw fields, through every join and every feature transform, and show which upstream table on which date produced the value that drove the decision.
The operators I see getting this right treat lineage as a first-class artefact of the pipeline, not a diagram someone drew in Lucidchart. Practically, that means:
- Feature store entries carry their SQL and their source table refs
- Every score written to the decision log carries a feature-set version
- Source system extracts are immutable and dated, so you can replay them
- Human overrides are logged with reviewer identity, timestamp, and reason code
If you can replay any decision from the last six years and produce the same score, you've got lineage. If you can't, you've got a diagram.
The integration nobody budgeted for
Here's the piece that's quietly eating 2026 roadmaps. Your data science stack lives in one world: notebooks, feature stores, MLflow, whatever. Your compliance registry lives in another: GRC tooling, policy documents, DORA reporting since it came into force on 17 January 2025. Nobody owns the wire between them.
So the model card exists, kind of, in the data science team's repo. The risk register exists in the second-line GRC tool. When they drift out of sync, and they will, the compliance artefact is the one that's wrong, because that's the one nobody's running CI against.
The teams that are going to be fine in 2027 are treating the model registry and the compliance registry as one integrated system. Every model deploy pushes an event to the compliance side. Every policy change on the compliance side pushes a validation task back to the ML team. It's boring plumbing. It's also the difference between passing an inspection and paying 4% of global turnover.
If your credit models went into production before the SCHUFA ruling and nobody's been back to re-paper them, that's the work. It won't get smaller by waiting for the AI Act deadline.