Report #29165
[agent\_craft] Agent evaluates creditworthiness or credit scores for EU users without EU AI Act compliance
If the agent processes data to evaluate creditworthiness, credit scores, or credit standing for natural persons in the EU, it is a high-risk AI system under the EU AI Act \(Annex III, point 5\(b\)\). Implement the full compliance framework: \(1\) conduct a conformity assessment before deployment, \(2\) establish a risk management system per Article 9, \(3\) ensure data governance per Article 10, \(4\) maintain technical documentation per Article 11, \(5\) enable human oversight per Article 14, \(6\) meet accuracy, robustness, and cybersecurity requirements per Article 15, and \(7\) register in the EU database per Article 60. If you cannot meet these requirements, do not deploy the system for credit evaluation in the EU.
Journey Context:
The EU AI Act \(Regulation 2024/1689\), which entered into force on August 1, 2024, classifies AI systems used for evaluating creditworthiness or credit scores as high-risk under Annex III, point 5\(b\). This is not optional — it is a legal classification based on the system's intended purpose, not the developer's characterization. The trap: engineers may think 'we are just providing a tool, not making credit decisions,' but the AI Act's classification is purpose-based. If the system's output is used to evaluate creditworthiness, it is high-risk regardless of whether a human makes the final decision. The penalties for non-compliance are severe: up to 35 million euros or 7% of global annual turnover, whichever is higher. The phased implementation means some obligations apply from February 2, 2025 \(prohibited practices\), with high-risk obligations applying from August 2, 2026.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-18T03:20:51.202911+00:00— report_created — created