AI in credit scoring and insurance pricing: where high-risk duties apply from 2 Dec 2027.

Finance was using machine learning long before generative AI had a name. Fraud models, credit scores and pricing engines have run inside banks and insurers for years. What changed in 2026 is scale on one side and law on the other. Use has become near universal. And the two decisions that matter most to a retail customer, whether they get a loan and what their life or health cover costs, now carry a fixed date in the European Union: 2 December 2027.

Use is near universal

The figures from supervisors leave little doubt. The European Banking Authority reports that 92% of EU banks deploy AI. In the UK, 75% of UK financial firms already use AI and a further 10% plan to within three years; foundation models already made up 17% of their use cases (Bank of England and FCA, November 2024). In Japan, the share of financial institutions using generative AI rose from 31% to 79% in two years, and the Bank of Japan's August 2026 report puts those using or trialling it above 90%.

92% of EU banks deploy AI (European Banking Authority, Sep 2025)

Insurers follow fast. Nearly two thirds of European insurers already use generative AI, according to an EIOPA survey of 347 undertakings published in February 2026. In Germany, half of all finance and insurance establishments used generative AI in 2025, twice the average across the economy (IAB, 2026). Banking is also Europe's largest AI spender, according to IDC's European spending guide.

Where does the money go? UK firms use AI most for optimising internal processes (41%), cybersecurity (37%) and fraud detection (33%); within three years they expect process use to reach 72% and fraud detection 64% (BoE/FCA).

Supervisors also see where use is heading. Firms expect the largest growth in customer support and compliance, two areas where generative assistants write answers, summarise documents and check them against policy. That moves AI closer to the customer, and closer to the rules.

Fraud is the first battlefield

The economics are plain. Fraud scams and bank fraud cost an estimated $486 billion worldwide in 2023 (Nasdaq Global Financial Crime Report). Customers feel it: in Germany, a quarter of internet users have already asked an AI tool about money, a third of those aged 16 to 29, and 62% say AI raises their fear of fraud (Bitkom, 2026).

The market reflects this. Of the 28 offerings the Good AI Prism maps in Financial Services & Insurance, eight fight fraud, financial crime and money laundering: BioCatch, Featurespace (Visa), Feedzai, Hawk AI, Lucinity, Napier AI, SymphonyAI and Unit21. Five support credit decisions (Ocrolus, Provenir, Taktile, Upstart, Zest AI), five handle insurance claims and claims fraud (FRISS, omni:us, Shift Technology, Sprout.ai, Tractable), four price and underwrite risk (Akur8, Cytora, Earnix, hyperexponential), three serve research and market intelligence (AlphaSense, Kensho, Moody's) and three power banking assistants and personalisation (Kasisto, Personetics, Unique). The FSI sector brief lists each group with the rule that applies.

The rules follow the use

The AI Act classifies uses, not products. That is why the same vendor can sit in two regimes. Under the amended timetable of the Digital Omnibus Regulation (EU) 2026/1744:

• Since 17 January 2025, DORA applies its ICT risk, incident and third-party rules to AI systems and cloud models.
• From 20 November 2026, the second Consumer Credit Directive gives consumers facing automated creditworthiness assessment a right to human intervention, an explanation and to contest the decision.
• From 2 December 2027, creditworthiness assessment and credit scoring of natural persons (Annex III 5b) and risk assessment and pricing in life and health insurance (5c) carry high-risk duties. Fraud detection is expressly excluded from 5b.

2 Dec 2027 EU high-risk duties apply to credit scoring of natural persons and life and health insurance pricing (Reg. (EU) 2026/1744)

Germany adds case law. In the SCHUFA ruling C-634/21 of December 2023, the Court of Justice held that a credit score playing a determining role in a lending decision is an automated decision under GDPR Article 22. BaFin has published principles for algorithms in decision-making and, in December 2025, guidance on ICT risks of AI under DORA.

Outside the EU, supervisors lead with guidance. The revised US interagency model risk guidance has applied since 17 April 2026; the NAIC model bulletin on AI in insurance has been adopted in 29 US jurisdictions; Canada's OSFI Guideline E-23 covers AI models from 1 May 2027; Singapore, India, Korea and the UAE have set their own principles.

Work changes before headcount

The labour story is quieter than the headlines suggest. The European Central Bank finds no significant difference in hiring or firing between firms that use AI and those that do not. German insurers employ 215,600 people and savings banks almost 200,000, and many face a wave of retirements. The constraint is skills and oversight: someone has to validate every model, explain every decision and own the outcome.

Seven questions before a pilot

Before AI touches a customer decision, settle seven questions in writing. Does the use carry high-risk duties because it scores natural persons for credit or prices life and health cover? Can we explain each decision to the customer and offer human review, as consumer credit law, GDPR Article 22 and US adverse-action rules require? Who validates the model independently, under our model risk framework, whether that is PRA SS1/23 in the UK, OSFI E-23 in Canada or the US interagency guidance? How do we test for unfair discrimination, as the NAIC bulletin and state insurance rules expect? Is the provider in our DORA register of ICT third parties, with exit and incident plans? Do customers know when they deal with a chatbot or AI-generated content, as Article 50 requires? And which measures decide scaling: fraud caught, false positives, handling time, complaints and losses? A provider that cannot answer in writing is not ready for a regulated decision. The operational readiness article turns these questions into a work plan.

What the registry adds

For the 28 offerings, the Good AI Prism Registry holds decision profiles: pricing basis, data hosting, training on customer data, integrations and the questions to ask where a provider is silent. They include Taktile's credit decisioning and Feedzai's fraud platform. Use them to build a shortlist on documented facts, then test what is missing in writing.

In practice

Use case: the SCHUFA ruling. In case C-634/21 of December 2023, the Court of Justice held that a credit score that plays a determining role in a lending decision is an automated decision under GDPR Article 22. A bank that buys a scoring tool therefore also buys a duty to explain and to offer human review, whatever the vendor contract says.

Scenario: one vendor, two regimes. An insurer buys a platform that detects claims fraud in one module and prices health cover in another. Fraud detection is not a listed high-risk use; the pricing module falls under Annex III 5c from 2 December 2027. Procurement file, model validation and customer notice are therefore set up per module, not per vendor.

What to do Monday

1. Separate the regimes. List every model and tag it: fraud, credit for natural persons, life and health pricing, other. Only two of these tags carry high-risk duties under Annex III.
2. Map providers to DORA. Every AI provider belongs in the register of ICT third parties, with exit and incident plans; an AI Estate Audit produces the list.
3. Rehearse the explanation. For every automated credit decision, test that you can explain it to the customer and offer human review before 20 November 2026.
4. Validate independently. Bring AI models under the existing model risk framework, with validation that the model owner does not control.
5. Measure what decides scale: fraud caught, false positives, handling time, complaints and losses, set before the pilot starts.

This article describes market and regulation. It is not legal or financial advice.