Credit scoring and insurance pricing AI need a rights assessment before first use

Banks and insurers must assess fundamental rights risks before they use certain AI. This applies to AI for credit scoring. It also applies to AI that assesses risk and sets prices in life and health insurance. The duty falls on the firm using the system, not on the vendor.

The rule is in Article 27 of the AI Act. It names these two uses from Annex III, points 5(b) and 5(c). So it reaches private firms, not only public bodies.

The assessment is called a fundamental rights impact assessment, or FRIA. It must say how and why the firm will use the system. It must say how long and how often the system will be used. It must name the groups of people affected and the specific risks to them. It must explain how human oversight works. It must also set out what the firm will do if harm occurs, including governance and complaint routes.

The firm must send the results to the market surveillance authority. The AI Office is due to publish a template questionnaire for this. The firm may build on the vendor's documentation and on earlier assessments of similar cases. It must update the FRIA when something relevant changes.

Many firms already have a GDPR data protection impact assessment. The FRIA adds to it. It does not replace it. Running both as one process saves work.

Best practice: start drafting now, alongside credit-model governance and DPIA reviews. The deferred deadline for Annex III high-risk duties is 2 December 2027.