Category Archives: Tech

France’s data protection authority has put AI credit scoring rules at the centre of its supervision of consumer lending, publishing a formal recommendation in May 2026 that tells banks, credit institutions and intermediaries how creditworthiness assessments must work when algorithms drive the decision. The move lands in an unusual regulatory moment: the EU AI Act classifies credit scoring as high-risk, but the obligations attached to that classification were postponed weeks before they were due to take effect, leaving data protection law carrying the weight for the next eighteen months.

The CNIL published its recommendation on assessing solvency in credit applications on 7 May 2026, after a public consultation the previous year and discussions with the banking members of its compliance club. It replaces AU-005, the single authorisation issued in 2008 that governed the area before the GDPR.

How France polices AI credit scoring rules today

The recommendation applies to private organisations that grant credit and to banking and payment services intermediaries. It covers consumer credit and mortgage credit governed by the French Consumer Code, and focuses on processing carried out to evaluate whether an applicant can repay.

Four themes run through the text. Data must be limited to what is relevant and strictly necessary. Past repayment incidents may be considered, but the recommendation specifies which data are relevant and strengthens what applicants must be told about how that history affects a new application. Retention periods are set for application data and records of past defaults. And the conditions under which a decision may rest on fully automated processing are spelled out, with safeguards of transparency, human intervention and explainability.

The final version also settled a legal basis question. Because the Consumer Code obliges lenders to assess solvency, institutions may ground the processing in legal obligation under Article 6 of the GDPR rather than relying on consent or legitimate interest.

The CNIL published an accompanying verification checklist for data protection officers and compliance teams, and said it will check compliance through its future inspection work. Credit scoring does not appear among its announced priority inspection themes for 2026, which are recruitment, the single electoral register and sports federations.

The court rulings that reshaped automated lending decisions

The recommendation is built on two judgments of the Court of Justice of the European Union.

In Case C-634/21, decided in December 2023, the Court found that generating a probability value about a person’s ability to service a loan can itself constitute an automated individual decision within the meaning of Article 22 of the GDPR, where the recipient of that score draws on it in a determining way. The scoring entity, not only the lender acting on the score, is therefore in scope.

Case C-203/22, decided in February 2025, addressed what a data subject is entitled to know about the logic involved. The CNIL’s reading is precise and worth stating plainly: applicants have a right to an explanation after the decision, and the institution must make sure they understand their individual situation. That does not mean handing over a copy of the algorithm. It means a concise and comprehensible account of the mechanism that produced the outcome.

Why the AI Act’s documentation duties slipped to 2027

Annex III, point 5(b) of the EU AI Act classifies AI systems used to evaluate the creditworthiness of natural persons, or to establish their credit score, as high-risk. That classification carries a substantial package: risk management, data governance, technical documentation under Article 11, transparency towards deployers, human oversight, accuracy and robustness requirements, and registration in the EU database.

Those obligations were originally due from 2 August 2026. They no longer are. Regulation (EU) 2026/1744, the AI Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, moving standalone Annex III high-risk obligations to 2 December 2027 and Annex I embedded systems to 2 August 2028. The Article 50 transparency duties were not deferred and applied on schedule.

The practical effect for lenders is a sequencing problem rather than a reprieve. Technical documentation for a scoring model is not produced at the end; it depends on records of training data, validation results, performance monitoring and design choices captured while the model is built and run. Firms treating December 2027 as the start date will be reconstructing evidence retrospectively.

Meanwhile the GDPR obligations bind now, and they are not thin. Article 22, the transparency duties, data minimisation and the right to an explanation apply to automated scoring today, with or without the AI Act layered on top.

Who supervises what, and where the gaps are

France has not finished designating its AI Act authorities. A scheme published by the French directorates for enterprise and for competition, consumer affairs and fraud control proposes a decentralised model in which the DGCCRF serves as coordinating market surveillance authority and single point of contact under Article 70, with sectoral regulators including the CNIL and Arcom covering specific use cases. The proposal awaits adoption.

France is not unusual. Member states had to designate market surveillance and notifying authorities by 2 August 2025. As of mid-2026, on the Future of Life Institute’s tracker, nine had designated both, twelve had partial arrangements and six had designated neither.

Under the AI Omnibus, national authorities retain competence over AI systems used by financial institutions, so credit scoring supervision stays national.

What to watch over the coming months

Three dates shape the next phase. November 2026 brings the French legal authorisation for fully automated consumer credit decisions into application. December 2026 ends the AI Act’s marking grace period for generative systems already on the market. December 2027 is when the Annex III high-risk package, including Article 11 documentation, finally applies to credit scoring.

In between, the signal to watch is inspection activity. The CNIL has said it will verify compliance through its ordinary control work rather than a dedicated campaign, which means enforcement is more likely to surface through complaint-driven investigations and sanctions than through an announced sweep. Applicants refused credit by an automated process now have a clearly articulated right to an explanation, and complaints are the mechanism most likely to test it.

Lenders operating across borders face a further complication: the supervisory map differs by member state, so the same model may be examined by a data protection authority in one country and a market surveillance body in another. The same documentary discipline applies to anyone assembling financial evidence for regulated processes, a point covered in our guide to proof of funds requirements in the UK, Canada and Australia.

Questions readers are asking about automated lending

What did the CNIL publish on credit scoring in 2026?

On 7 May 2026 it published a recommendation on assessing creditworthiness in credit applications. It applies to private lenders and to banking and payment services intermediaries, covers consumer and mortgage credit under the French Consumer Code, and replaces the pre-GDPR authorisation known as AU-005.

Is credit scoring classified as high-risk under the EU AI Act?

Yes. Annex III, point 5(b) covers AI systems used to evaluate the creditworthiness of natural persons or establish their credit score. The obligations attached to that classification, including the Article 11 technical documentation duty, now apply from 2 December 2027.

What did the Court of Justice decide about automated credit decisions?

In Case C-634/21 the Court held that producing a probability score can itself amount to an automated decision under Article 22 of the GDPR where the score plays a determining role. Case C-203/22 addressed the right to an explanation of the logic involved.

Do applicants have a right to see the algorithm?

No. The CNIL is explicit that the right to an explanation does not mean handing over a copy of the algorithm. Institutions must give a concise, comprehensible explanation that lets the applicant understand their individual situation.

Which authority supervises AI systems in France?

France has not completed its designation. A published scheme proposes a decentralised model with the DGCCRF as coordinating market surveillance authority and single point of contact, and the CNIL and Arcom among sectoral authorities.

What changes for French lenders in November 2026?

The recommendation anticipates a legal authorisation, applying from November 2026, for fully automated decisions on consumer credit, together with the safeguards attached to it.

Related reading on European regulators acting against financial platforms is available in our coverage of the Noones shutdown and EU sanctions on user funds.