When your bank becomes the AI Act provider

If your bank puts its brand on a vendor credit model, substantially changes that model, or turns a general AI tool into credit scoring, you become the AI Act provider. Article 25 of Regulation (EU) 2024/1689 then applies the full provider duties in Article 16 to you.

Three triggers matter. First, you put your name or trademark on a high-risk AI system already on the market or in service. Second, you make a substantial modification to a high-risk system and it stays high-risk. Third, you change the intended purpose of a non-high-risk system, including a general-purpose AI system, so that it becomes high-risk under Article 6. Creditworthiness assessment of natural persons is high-risk under Annex III point 5(b).

"Substantial modification" has a legal meaning in Article 3(23). It is a change after placing on the market or putting into service that was not planned in the initial conformity assessment. The change must affect compliance with the high-risk requirements in Chapter III, Section 2, or change the intended purpose that was assessed.

When you become the new provider, the original provider is no longer the provider of that specific system. The Digital Omnibus (Regulation (EU) 2026/1744) spells out what the original provider must still do. It must cooperate: share technical documentation, explain known limits and failure modes, and give targeted technical access for testing and validation. That duty does not apply if the original provider clearly said the system must not be turned into a high-risk system.

Map vendor contracts and in-house fine-tunes against these three triggers before 2 December 2027, when Annex III high-risk obligations apply.