The European Banking Authority Maps the AI Act Against EU Banking and Payments Law for AI That Assesses the Creditworthiness of Natural Persons

On November 21, 2025, the European Banking Authority wrote to two directors-general of the European Commission with the outcome of what it calls its AI Act mapping exercise. The letter and its annex of tables are about AI systems used for "creditworthiness assessment or credit scoring of natural persons," which the AI Act classes as high-risk under Annex III(5)(b). The letter speaks of the act's "forthcoming entry into application." It shares the outcome because the act "mandates the European Commission to issue Guidelines on the interplay between the AI Act and EU sectoral legislation." Parts of the letter and its annex follow, not the whole.

What the EBA Mapped

The EBA says it set up a dedicated workstream in January 2025 to map the AI Act against relevant provisions of EU banking and payments law that apply to AI systems used for that purpose. The exercise "aimed at identifying and assessing areas of interaction between the AI Act and the EU sectoral legislation." The letter says the EBA is "actively engaged in supporting the EC's work on ensuring a coordinated and consistent implementation of the AI Act across the EU banking and payments sector, including through its role as observer in the EU AI Board's Subgroup on Financial Services."

The letter says the AI Act recognizes overlaps between some of its requirements on high-risk AI systems and EU financial sector law, and that for some of them it "envisages targeted derogations and other types of synergies (i.e. integration or combination of requirements)." For other requirements, the EBA notes, the act "does not envisage targeted derogations or other regulatory synergies." Its examples are "human oversight, data governance, cybersecurity." For those, it says, it has found that EU financial services law "already includes a wide range of requirements."

DORA, the EU's regulation on digital operational resilience for the financial sector, "for instance, extensively covers the cybersecurity and business continuity requirements set out in the AI Act," the letter says. And the CRR and CRD, the EU's regulation on prudential requirements for credit institutions and its directive on access to the activity of credit institutions and the prudential supervision of credit institutions, "already provide a comprehensive and technology-neutral governance and risk management framework that can be leveraged upon when supervising the use of AI tools."

For human oversight, data governance and cybersecurity, the letter does not find relief in the AI Act. Its finding is that bank law already asks for a great deal. A bank then answers to both.

The Annex

The annex sorts the AI Act's requirements on high-risk systems under three headings. The first is "AI Act requirements contemplating a full or partial derogation," and the requirements it lists there include the quality management system, post-market monitoring by deployers, incident reporting and the consumer's right to an explanation. The second is "AI Act requirements envisaging their integration or combination with sectoral requirements," among them the risk management system, technical documentation and record-keeping. The third is "AI Act requirements that do not envisage regulatory synergies, but where existing sectoral requirements apply." Among the requirements under it are human oversight, transparency to deployers, accuracy, robustness and cybersecurity, data governance and AI literacy.

Beside each requirement the annex lists relevant banking and payments provisions. Against human oversight, the lines from the CRR include Article 174 on "human judgement and human oversight to review model-based assignments." The EBA says it is of the opinion that the list of provisions in the annex "provides a comprehensive overview of how EU financial services law already addresses relevant AI Act requirements," and that it "will be a useful instrument to inform the Guidelines on the interplay between AI Act and EU sectoral legislation."

The annex reads as a map of where the AI Act's questions already have an answer in a bank's existing rules. A map is not the guidelines. The letter leaves those to the Commission.

The EBA says it "stands ready to contribute further as needed."