Credit and Risk-Scoring Models Still Answer to the AI Act Today
A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027 has led a lot of financial institutions to file the whole regulation under “next year’s problem.” That reading is wrong, and it is wrong in a way that creates real exposure for institutions using AI for credit decisions, fraud detection and risk scoring today. The deferral covers one specific chapter of the Act. Several other obligations were never touched by it, and some of them are already in force.
Confusing a targeted delay with a general reprieve is an easy mistake to make when headlines simplify “AI Act rules delayed” without the qualifier attached. The practical risk is an institution that quietly stops preparing altogether, only to discover that the provisions still binding it, transparency duties and obligations on general-purpose AI providers whose models often sit underneath a credit-scoring tool, were never part of the postponement. This article sets out what the deferral actually covers for financial institutions, what it leaves untouched, and what that means for AI governance work that should already be underway.
Executive Summary
The Digital Omnibus amendment to the EU AI Act deferred the application of high-risk system obligations, currently to December 2027, in response to unfinished technical standards. That deferral is real and specific: it applies to Chapter III. It does not touch the Act’s prohibited-practice bans, its obligations on providers of general-purpose AI models, or its transparency requirements around AI-generated content and AI interaction disclosure, several of which are already binding on financial institutions today. For risk and compliance leaders, the practical implication is that the 2027 date is the wrong deadline to plan around if the goal is treating every AI Act obligation as still-pending.
Key Takeaways
- Only Chapter III high-risk system obligations were deferred, not the whole Act. Credit scoring is an Annex III high-risk category, moving to December 2027, while other chapters proceed on their original timeline.
- Transparency obligations under Article 50 were not delayed and are already active. Disclosing AI interaction and labelling AI-generated content are current obligations for any customer-facing AI, not future ones.
- Obligations on general-purpose AI model providers were untouched by the deferral. Many credit and fraud-scoring tools sit on top of general-purpose models, and those underlying obligations have applied since before the delay was even proposed.
- Prohibited AI practices remain banned regardless of the high-risk timeline. The deferral affects when high-risk systems need conformity assessment, not whether unacceptable-risk practices are permitted.
- Governance infrastructure built now for transparency and documentation carries forward into high-risk readiness later. Waiting for the 2027 deadline to start means rebuilding the same capability twice.
What the Digital Omnibus Actually Deferred for Credit and Risk Scoring
The deferral mechanism was introduced because the technical standards and conformity assessment tools needed to operationalise high-risk obligations were not ready in time, not because the underlying policy goals changed.
A Targeted Delay to Chapter III, Not a Reset of the Act
The postponement applies to conformity assessment, technical documentation, and the fuller compliance regime that credit-scoring and fraud-detection systems, as Annex III categories, are subject to. Everything outside that chapter proceeds on the timeline the Act originally set.
Backstop Dates Exist Precisely Because Standards Are Still Catching Up
The new date functions as a backstop: high-risk obligations apply once the necessary standards are confirmed ready, with December 2027 as the outer limit regardless. Regulators expect institutions to keep preparing during the extension.
What Is Already in Force for Financial Institutions, Deferral or Not
Several obligations sit outside Chapter III entirely and have applied on their original schedule.
General-Purpose AI Model Obligations Predate the Deferral Entirely
Providers of general-purpose AI models, which underpin many risk-scoring and fraud-detection tools, have been subject to documentation, transparency and safety obligations since before the Digital Omnibus was even proposed.
Transparency and Disclosure Duties Are Live Now
Requirements that customers be told when they are interacting with an AI system applied on the Act’s original schedule and were not moved by the Omnibus. An institution deploying a customer-facing credit or fraud AI without addressing these duties is not in a grace period.
Why Treating the Delay as a Pause Costs More Later
An institution that stops all AI governance work because “the deadline moved to 2027” is discarding groundwork that would have made the eventual high-risk deadline easier to meet.
Documentation and Logging Built Now Are Not Wasted Work
The record-keeping and access control capability that high-risk systems will eventually need overlaps substantially with what transparency and general-purpose model obligations already require.
Building AI Governance Around What Actually Applies Today
The practical starting point is separating the AI Act obligation calendar into what is live now and what is on a backstop timeline extending into 2027, prioritising governance work against the first list immediately.
How a Data Control Plane Supports AI Governance Obligations Already in Force
The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action any user or AI agent takes across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling. Because logging is complete and never sampled, institutions can produce the detailed, queryable record of AI-related data access that current transparency and documentation obligations expect, and that eventual high-risk requirements will expect in more detail still.
Institutions that want to see how continuous, cross-channel evidence supports their current AI governance obligations can schedule a custom demo.
Frequently Asked Questions
Only Chapter III high-risk system obligations were deferred to December 2027; the postponement does not apply to the rest of the Act.
Yes, Article 50 transparency requirements for disclosing AI interaction and labelling AI-generated content are already active and were not delayed.
Yes, these obligations were untouched by the Digital Omnibus and have applied since before the delay was proposed, affecting many credit and fraud-scoring tools.
Documentation and logging built now for current transparency duties overlap with future high-risk requirements, so delaying work means rebuilding the same capabilities later.