Written by: Agata Wojtas, Chief Commercial Officer, Digital Colliers
If you run automated credit scoring in the EU, the compliance clock isn't ticking toward 2027. It already went off. The Court of Justice ruling in SCHUFA (C-634/21, December 2023) settled that automated credit decisions fall under Article 22 GDPR, which means the paperwork you'll need for AI Act high-risk classification in 2027 is largely paperwork you should have on the shelf right now.
Most credit teams I talk to are planning a 2026 project to get ready for the AI Act. That's the wrong shape. The GDPR exposure exists today. The AI Act just adds a second layer on top of it.
What SCHUFA actually said
The ECJ ruled that generating a probability score used by a third party to decide on credit qualifies as an automated individual decision under Article 22. That matters because Article 22 gives the data subject specific rights, and it puts specific obligations on the controller.
In practice, if your model outputs a score that meaningfully drives a lending decision, you owe the applicant:
- A meaningful explanation of the logic involved, not just "the model said no"
- The ability to contest the decision and request human review
- A lawful basis under Article 22(2), which for most lenders means explicit contractual necessity or explicit consent
- A documented data protection impact assessment covering the scoring logic, the training data, and the fairness controls
GDPR fines reach up to 20 million euros or 4% of global turnover, so this isn't a paperwork exercise you can defer. Supervisory authorities across the EU have started citing SCHUFA in enforcement actions against fintechs and traditional lenders alike.
Why 2027 is a red herring
The EU AI Act's high-risk obligations apply from 2 December 2027. Credit scoring is explicitly named as high-risk in Annex III. Fines reach up to 15 million euros or 3% of global turnover, and they stack on top of GDPR exposure, not replace it.
But here's the thing. The AI Act's high-risk requirements read like a superset of what SCHUFA already forces you to document:
- A risk management system across the model lifecycle
- Data governance covering training, validation and test sets
- Technical documentation of model architecture and performance
- Logging sufficient to reconstruct decisions
- Human oversight measures
- Accuracy, robustness and cybersecurity evidence
If you build the SCHUFA file properly, you're most of the way to the AI Act file. If you wait until 2026 to start, you'll be rebuilding the GDPR work anyway, and you'll have spent two more years shipping decisions you can't fully defend.
The documentation you should have right now
This is the concrete shortlist. If any of these is missing, that's the gap to close first.
- A model card describing the exact model version in production (with a hash and a deploy date), inputs and their source systems, training data provenance including cut-off dates, performance broken out by protected characteristic where possible, known failure modes, and the retraining cadence with a named sign-off. A model card that names a person and a date is a control; one that describes the model in the abstract is a marketing document.
- A DPIA that specifically addresses Article 22, including the legal basis you're relying on and the human review path.
- Fairness testing across protected attributes, with results and mitigations documented, not just "we tested it."
- Adverse action explanation logic that produces a specific, meaningful reason per decision, not a generic reason code.
- A decision log with enough detail to reconstruct any individual score for at least the statutory retention window.
- A human review workflow with named roles, SLAs, and evidence that reviewers can actually override the model.
None of this is new. It's just that most lenders built their scoring stack before any of it was required, and the retrofit keeps getting deprioritised.
Lineage is the part that fails audits
Model cards fail gracefully. Data lineage fails hard. If a customer challenges a decline under Article 22, you need to walk backwards from the score to the raw fields, through every join and every feature transform, and show which upstream table on which date produced the value that drove the decision. Practically: feature store entries carry their SQL and source table refs, every score in the decision log carries a feature-set version, source extracts are immutable and dated so you can replay them, and human overrides are logged with reviewer identity, timestamp and reason. If you can replay any decision from the last six years and produce the same score, you have lineage. If you can't, you have a diagram.
The quieter gap is the wire between the data science stack and the compliance registry. The model card lives in the ML team's repo; the risk register lives in the GRC tool; when they drift out of sync, the compliance artefact is the one that's wrong, because nobody runs CI against it. The teams that will be fine in 2027 treat the model registry and the compliance registry as one integrated system: every model deploy pushes an event to the compliance side, every policy change pushes a validation task back.
For the broader context on how scoring models are built and governed, see our guide to AI credit scoring and the AI for financial services page.
Scoping the work honestly
A realistic scoping pass has three phases. First, an inventory. List every automated decision that touches credit, including pre-approval, limit changes, and collections triage. A lot of teams miss the last two.
Second, a gap assessment against the SCHUFA checklist above. Be honest about what exists as a living document versus a slide from 2022.
Third, a build plan that treats the AI Act as an extension of the GDPR work, not a separate track. The teams I see handling this well are the ones who put one owner across both regimes, usually sitting between the model risk function and the DPO. When those two functions run parallel projects, the documentation drifts and the auditor finds the seams.
DORA has been in force since 17 January 2025, which means your operational resilience evidence is already being examined. Regulators are getting comfortable asking hard questions about AI systems inside financial services. The lenders who look organised in 2027 are the ones who started in 2024.