← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for credit scoring providers

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 5(b) makes AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score high-risk, except systems used to detect financial fraud. This page is for the teams who build the score: bureaus, scoring vendors, and in-house model teams selling to lenders. Lending teams using a score should also read the fintech and banking pages.

Article 6(3) lets some Annex III systems escape high-risk status if they only perform a narrow procedural or preparatory task. That route is closed for scoring: an Annex III system is always high-risk where it performs profiling of natural persons. A model that turns someone's data into a number about their likely behaviour is profiling.

Scores for companies are outside 5(b), which speaks of natural persons. Sole traders and small business owners scored on personal data are a grey zone worth flagging.

The logging duties that follow

• Art. 12 (providers): the scoring system records events automatically, so any single score can be traced back to its inputs, model version and output.
• Art. 19 (providers): keep those logs for at least six months; providers that are financial institutions keep them as part of their financial-services documentation.
• Art. 26 (deployers), the lenders: human oversight (Art. 26(2)), log retention of at least six months (Art. 26(6)), and informing applicants that a high-risk system is used in decisions about them (Art. 26(11)). Deployers of 5(b) systems must also carry out a fundamental rights impact assessment under Article 27.

Applicants affected by a decision based on your output can ask the deployer for an explanation (Art. 86). Your logs are what makes that answer possible.

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

A disputed score raises three questions: which model version, which inputs, and was the result changed afterwards.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"bureau_pull","input":{"subject":"sub_4e19","purpose":"consumer_loan"}}}
{"seq":2,"type":"tool.result","data":{"name":"bureau_pull","output":{"tradelines":7,"arrears_90d":0}}}
{"seq":3,"type":"tool.result","data":{"name":"score_v3_2","output":{"score":642,"band":"C","top_reasons":["utilisation","file_age"]}}}
{"seq":4,"type":"run.end","data":{"status":"ok","model_version":"score_v3_2"}}

Recording the reason codes with the score lets the lender explain the outcome from the same chain the regulator will check.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign score runs in batches per lender per day, and hand the attestation to the lender with the score file so their retention and yours reference the same digest.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the score was accurate or non-discriminatory. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. WORM storage, vs. signing your own logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.