Credit scoring is high-risk and is one of the few categories that owes a mandatory FRIA.
Creditworthiness assessment is Annex III point 5(b) — and unlike most high-risk uses, it requires a fundamental rights impact assessment before first use. You also already hold an inventory: the DORA Register of Information.
- Annex
- Annex III · 5(b) — creditworthiness of natural persons
- Provisions
- Art. 27(1)(b) · Annex III 5(b) · Art. 26 · DORA
- Pack
- €249/month add-on · 5 duties · 2 notice templates
Why this sector is different
Two things make financial services different: the FRIA is mandatory rather than conditional, and the supervisory relationship is already mature — a DORA register of information, a model inventory and a DPO with real authority. The work is mapping what you already have onto Article 26 and Article 27 rather than starting from zero.
Complete the Article 27 FRIA before the credit model's first use
Mandatory for Annex III 5(b). The Omnibus lets you cross-reference an existing GDPR DPIA rather than duplicate it, so start from the DPIA you already hold.
Art. 27 · due within 21 days of activation
Reconcile the DORA Register of Information against the AI register
You already maintain an ICT third-party register. Import it, mark which entries are AI systems, and you have most of the inventory for free.
Art. 26(1) · DORA Art. 28 · due within 30 days of activation
Define the adverse-action explanation path for declined applicants
A declined applicant has a right to a meaningful explanation, and the model's score alone is not one.
Art. 86 · Art. 22 GDPR · due within 45 days of activation
Bind each high-risk model to an owner and a validation record
Your model risk framework probably already names owners; connect it to the register so the evidence is one artefact.
Art. 14 · Art. 26(2) · due within 60 days of activation
Collect GPAI and sub-processor documentation for every scoring vendor
Article 26(1) makes you liable for using the system per its instructions, which you may never have received.
Annex IV · Arts. 53–55 · due within 60 days of activation
The notices you owe
Unlocked with the pack, rendered with your own facts, blanks kept where you must decide.
Applicants, before or with the decision
Credit decision notice — AI-assisted assessment
{company} uses an automated system to help assess creditworthiness. The system considers {dimensions}. Your application was assessed on {date} and a person reviewed the outcome before it was communicated to you. If your application …
Published summary, where applicable
FRIA summary for publication
This summary records that {company} completed a fundamental rights impact assessment under Article 27 before deploying {system} for {purpose}. It identifies the affected groups, the risks considered, the human oversight measures and the internal …
What your buyers will ask
The questions that stall a deal or trigger an audit. Each one is a control in the matrix.
- ?Show the FRIA for your credit model.
- ?How does the DORA register map to your AI register?
- ?What explanation does a declined applicant receive?
- ?Who validates the model, and how often?
Straight answers
Do we need a FRIA for credit scoring?
Yes. Article 27(1)(b) covers deployers of Annex III point 5(b) systems assessing the creditworthiness of natural persons. It is one of the few categories where a private company owes a FRIA regardless of whether it provides a public service.
We already did a DPIA. Is that enough?
Not on its own, but you are not starting over. Following the Digital Omnibus, Article 27(4) allows the FRIA to cross-reference the relevant sections of a GDPR Article 35 DPIA, or incorporate them. The remaining FRIA-specific content is the affected groups, the fundamental-rights risks, oversight measures and the complaint mechanism.
Does fraud detection need a FRIA?
Generally no. Annex III 5(b) expressly excludes AI systems used to detect financial fraud, and fraud detection usually falls outside the high-risk list. Record the reasoning under Article 6(4) so the exclusion is documented rather than assumed.
What is the DORA connection?
DORA requires financial entities to keep a register of information on ICT third-party arrangements. It overlaps heavily with the AI Act inventory. Importing it gives you a running start on Article 26(1) and a defensible answer when an authority asks how you identified your AI systems.
Know where you stand before the questions arrive.
Four minutes, no card. You get your exposure score and the exact articles that apply to a financial services organisation.