EU AI Act Banking Compliance 2026: Credit Scoring Is Explicitly High-Risk, Article 86 Explanation Right Applies to Every Declined Application, and the Penalty Is €35M or 7% of Turnover

The One Question Every Indian Bank With EU Exposure Needs Answered First

Does your bank use an AI system to make or materially inform a credit decision about an EU resident, directly or through an EU-regulated subsidiary? If yes, Annex III of the EU AI Act names credit scoring and creditworthiness assessment as high-risk by default — with one carve-out worth knowing before you over-scope your remediation: AI systems used purely to detect financial fraud in that assessment are excluded from the high-risk classification. Get that distinction wrong in either direction and you either under-build your compliance program or burn budget hardening a system the Act never asked you to touch.

Most compliance teams I've talked to treat the EU AI Act as a 2027 problem because "that's what GDPR felt like." It isn't. The clock that matters for credit AI is August 2026, not some later date everyone assumes they'll have time to prepare for.

The Timeline Has Four Dates, and Three of Them Are Already Behind You

Prohibited practices — social scoring, manipulative techniques, certain biometric uses — became enforceable on 2 February 2025. If you haven't audited your AI estate against that list, you are already out of compliance on a provision that's been live for over a year. General-purpose AI model providers picked up transparency and documentation obligations on 2 August 2025. The date that actually governs most Indian banks' EU-facing credit AI is 2 August 2026, when the full high-risk obligations of Annex III come into force. A fourth date, 2 August 2027, only matters if your AI system is a safety component embedded in a product already regulated under separate EU harmonization law — a narrower category than most banking AI.

One wrinkle worth building into your plan: under Article 111's transition provisions, a high-risk system already on the market before August 2026 gets relief from the full obligations unless you make a significant modification to it. That's not a loophole to exploit — "significant modification" is broad enough to capture most retraining cycles — but it does mean your legacy credit model and your newly-launched one are not on the same clock, and treating them identically in your remediation plan wastes effort on the wrong system first.

What "High-Risk" Actually Obligates You to Build

Six things, not a vague "be compliant" mandate: a quality management system covering the AI lifecycle end to end; technical documentation including training data provenance and performance metrics broken out by demographic group; logging that lets you reconstruct what the system did and when; a transparency mechanism giving the affected person an understandable explanation of the decision inputs; accuracy and bias testing across demographic groups, with a documented methodology, not a one-time check; and human oversight procedures that allow a real person to monitor and intervene, not a rubber-stamp review step.

The part that catches Indian banks out is the demographic-group performance breakdown. Most existing model validation here reports overall accuracy and PSI drift. The Act wants accuracy sliced by group, which is a different analysis you need to build before August 2026, not retrofit after an EU regulator asks for it.

Running RBI FREE-AI and the EU AI Act as One Program, Not Two

Indian banks lending into the EU are not choosing between RBI's framework and the EU AI Act — both apply, simultaneously, to the same model. The sensible move is to build one control set that satisfies the stricter requirement on each dimension: bias testing methodology, audit trail depth, and human oversight procedures can largely be unified. Where they genuinely diverge is data handling — GDPR's data processing rules and India's DPDP Act are not interchangeable, and trying to run one data governance policy across both will eventually produce a finding under one regime or the other.

Action Checklist: What to Do Before August 2026, in Order

1. Confirm which of your EU-facing AI systems actually falls under Annex III credit scoring — exclude pure fraud-detection systems from this list, but document why you excluded them.
2. Audit for Article 5 prohibited practices now; that provision has been enforceable since February 2025 and an audit gap there is the easiest finding for a regulator to make.
3. Identify which high-risk systems predate August 2026 and qualify for Article 111 transition relief, and flag any planned retraining that would count as a "significant modification" and pull the system out of that relief early.
4. Build demographic-group-level accuracy and bias reporting now — this is new analysis, not a repackaging of existing model validation output.
5. Reconcile your RBI FREE-AI and EU AI Act control sets into one evidence pipeline per model, rather than maintaining two parallel compliance narratives for the same deployed system.