Which AI use cases in payments and cards are high risk under the EU AI Act?

Annex III point 5(b): AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high risk, and a real time BNPL underwriting model is squarely this use, since it is the system making the credit decision rather than a supporting tool. Providers need risk management, data governance, logging and human oversight; deployers must run a fundamental rights impact assessment (Article 27), and consumers have a right to an explanation of an individual decision (Article 86).

Annex III point 5(b): AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are high risk, except systems used to detect financial fraud. Providers need risk management, data governance, logging and human oversight. Deployers must carry out a fundamental rights impact assessment before use (Article 27), and affected persons have a right to an explanation of individual decisions from the deployer (Article 86).

Assessing businesses and detecting fraud is not an Annex III use as such, and Annex III point 5(b) excludes systems used to detect financial fraud. If the system evaluates the creditworthiness of a natural person, for example a sole trader applying to accept payments, it can fall under Annex III point 5(b), which covers evaluating the creditworthiness of natural persons or establishing their credit score, and be high risk. Keep credit assessment of individuals separate or treat it as a high risk system.

The conversational assistant falls under the Article 50 transparency duty. Biometric verification whose sole purpose is to confirm that a person is who they claim to be is excluded from the Annex III biometric category. The system becomes high risk when the same onboarding process assesses creditworthiness or a credit score of a natural person, for example for a credit card or overdraft (Annex III point 5(b)).

The drafting assistant does not assess creditworthiness, so on its own it is not the Annex III point 5(b) credit scoring system. It helps the lender meet the Article 86 right of affected people to a clear and meaningful explanation of decisions based on such a high risk system. If it is built into the scoring system it shares that system's high risk obligations; as a separate drafting tool its tier depends on its design and on how its output is reviewed. The follow up chat assistant must tell customers they are dealing with an AI system (Article 50).

Annex III point 5(b) excludes AI used to detect financial fraud from the high risk credit scoring category, but a system that in effect decides on creditworthiness is high risk, and remote biometric identification is high risk under point 1(a), which excludes one to one biometric verification. When a public authority uses the model on claims for public benefits, point 5(a) can apply, because it covers AI used to grant, reduce, revoke or reclaim benefits and has no fraud exception. Keep fraud detection separate from the credit or eligibility decision and use biometrics only for one to one verification.

Customer due diligence on legal entities is not listed in Annex III, and an internal analyst tool usually carries no Article 50 transparency duty, so the system is usually minimal risk. The design decides the rest: biometric verification that only confirms a director is who they claim to be is excluded from Annex III point 1(a), but remote biometric identification (one to many matching) is high risk, and so is any use of the output to assess the creditworthiness of the natural persons involved (point 5(b)). GDPR applies to the personal data of owners and directors throughout. Keep biometric and credit steps in separately assessed components.

Annex III point 4 lists AI used for the recruitment or selection of natural persons (4(a)) and AI used to make decisions affecting promotion, or to allocate tasks based on individual behavior, personal traits or characteristics (4(b)). A marketplace that ranks employees for internal roles or allocates projects on the basis of inferred traits is therefore high risk. Recommending learning content or mentors to an employee who chooses freely is usually not. Deployers of the high risk part must inform workers' representatives and the affected employees before use (Article 26).

Complaint handling is not listed in Annex III, so internal classification and drafting for a handler who decides is minimal risk. Where the agent talks to customers to take the complaint, Article 50(1) requires telling them they are dealing with AI. Only a system that also assessed creditworthiness or priced life and health insurance (Annex III point 5(b) or 5(c)) would be high risk for that part.

Ranking offers is generally minimal risk and the conversational part carries the Article 50 transparency duty. Using AI to evaluate creditworthiness for a credit offer is high risk (Annex III point 5(b)), and Article 5 prohibits techniques that exploit vulnerabilities due to a person's social or economic situation to distort their behavior in a harmful way.

Keeping customer due diligence files current is not listed in Annex III, so a back office system that assembles reviews for an analyst to decide is usually minimal risk. The design decides the rest: a conversational agent that asks customers for missing information must tell them they are interacting with an AI system (Article 50(1)); biometric verification that only confirms a person is who they claim to be is excluded from Annex III point 1(a), while remote biometric identification is high risk; and Article 5(1)(d) prohibits assessing the risk that a person will commit a criminal offense based solely on profiling, so behavioral triggers should open a review for a human rather than score the customer. GDPR applies to the collection and retention of KYC data, including Article 22 if an automated refresh leads to a decision with legal or similarly significant effect, such as closing an account.

An AML customer risk rating is not listed in Annex III. Article 5(1)(d) prohibits AI risk assessments that predict whether a natural person will commit or will likely commit a criminal offense based solely on profiling of that person or on assessing their personality traits and characteristics; it exempts only AI that supports the human assessment of a person's involvement in a criminal activity, which is already based on objective and verifiable facts directly linked to a criminal activity. An AML customer risk rating built from due diligence attributes, transaction behavior and screening results is itself an automated evaluation of a person's situation and behavior, which is profiling under GDPR Article 4(4), and due diligence facts such as occupation, geography and products are not facts directly linked to a criminal activity, so the rating does not sit squarely inside the exemption. What keeps it a defensible AML due diligence tool rather than an offense prediction is that it does not itself accuse a person of an offense: it sets a level of scrutiny, a human analyst reviews material moves, and regulatory minimum rules sit above the model as hard constraints. A rating driven mainly by nationality or other personal attributes weakens that position further, which is why the proxy discrimination guardrail matters. If the same score is used to evaluate the creditworthiness of natural persons or to establish their credit score, that use falls under Annex III point 5(b) and is high risk, so keep the AML rating and credit decisions separate.

A customer facing agent must make clear that people are dealing with AI, unless that is obvious from the context (Article 50). Initiating payments within a customer's mandate is not listed in Annex III. It becomes high risk if the same agent evaluates creditworthiness, for example by deciding on a buy now pay later or credit line at checkout (Annex III point 5(b)).

A customer facing assistant must tell people they are interacting with an AI system (Article 50(1)). It triages and opens cases but does not evaluate creditworthiness (Annex III point 5(b), which in any case excludes systems used to detect financial fraud) or decide access to an essential service, so it is not high risk under Annex III.

Article 50(1): people must be informed that they are interacting with an AI system, unless that is obvious from the context. Servicing existing accounts and cards is not an Annex III use. It would become high risk under Annex III point 5(b) if the agent itself evaluated the creditworthiness of a natural person, for example to decide a credit limit increase.

An AI system that interacts directly with people must be designed so that they know they are dealing with AI, unless that is obvious from the context (Article 50(1)). It is not high risk under Annex III as long as it does not evaluate eligibility for essential public assistance benefits and services (point 5(a)), creditworthiness (point 5(b)), risk and pricing for life and health insurance (point 5(c)) or emergency calls (point 5(d)). This holds only if emotion or vulnerability signals are inferred from what the customer says (text or transcript content), not from voice or other biometric features; an agent that infers emotion from a caller's voice is an emotion recognition system (Article 3(39)), which is high risk under Annex III point 1(c) and triggers the deployer disclosure duty in Article 50(3).

A customer facing service agent must disclose that the customer is interacting with AI (Article 50). It is not high risk: it does not decide on access to essential services, credit or employment.

A customer facing agent must disclose that it is AI (Article 50(1)). It stays out of Annex III as long as eligibility for credit offers is decided upstream by the bank's own, separately governed credit processes; if the agent itself assessed creditworthiness it would be high risk under point 5(b).

An internal drafting and review aid that makes no decisions about people. Article 50 transparency duties apply to generated content: providers must mark synthetic content, and deployers must disclose deep fake images, audio or video. Personalized targeting of individuals is governed mainly by data protection and consumer law rather than the AI Act.

Annex III point 5(b) expressly excludes AI systems used to detect financial fraud from the high risk creditworthiness category, so the scoring is not high risk. The conversational part must disclose that it is AI under Article 50(1). If a voice component infers the customer's emotions from their voice, it becomes an emotion recognition system under Annex III point 1(c), which is high risk and needs the Article 50(3) notice, so keep coaching detection to what is said rather than to biometric signals.

A customer facing collections agent must disclose that it is AI (Article 50). It is not listed in Annex III as long as it applies preapproved arrangement rules and does not itself evaluate creditworthiness; an affordability model that decides who gets which arrangement for individuals should be assessed separately against Annex III point 5(b).

Confirming flagged transactions with cardholders is not listed in Annex III, and point 5(b) expressly excludes AI used to detect financial fraud from the creditworthiness category, so the system is not high risk. An agent that messages or calls customers must tell them they are dealing with AI under Article 50(1), and synthetic voice output must be marked as AI generated under Article 50(2).

Article 50(1): the business owner must be informed they are interacting with an AI system, unless that is obvious from the context. Preparing routine transfers, invoices and payroll for an existing business account is not an Annex III use. It would become high risk under Annex III point 5(b) if the agent itself assessed a natural person's creditworthiness, for example to decide whether to extend the account an overdraft or credit line.

A chatbot that interacts with people at client companies must disclose that it is AI (Article 50). It does not evaluate creditworthiness or decide on access to an essential service (Annex III point 5), so it is not high risk.

A chatbot that interacts with developers must disclose that it is AI (Article 50). Code generation for integration is not listed in Annex III.

A customer facing assistant must make clear that people are dealing with AI, unless that is obvious from the context (Article 50). Preparing a payment the customer approves is not listed in Annex III. It becomes high risk if the same assistant evaluates creditworthiness, for example by deciding on an overdraft or credit line at the moment of payment (Annex III point 5(b)).

Not an Article 5 practice and not listed in Annex III: the system prepares filings for authorities and makes no decision on the credit, insurance, employment or access to services of a natural person. It is an internal tool whose users know they are working with AI, and drafted text that ends up in public disclosures passes human review under a named person's editorial responsibility, which takes it outside the Article 50(4) deployer disclosure duty. The system still drafts variance commentary and plain language explanations of validation failures from underlying data, rather than lightly editing existing text, so the assistive function for standard editing exception does not fit. The bank that builds or operates the system is then the provider and carries the Article 50(2) duty to mark that generated text in a machine readable way as artificially generated, which has applied since 2 August 2026. The AI literacy duty of Article 4 also applies.

An internal tool that monitors and classifies regulatory publications for staff makes no decisions about natural persons, so it is not listed in Annex III and is not a prohibited practice under Article 5. Staff know they are using an AI tool and its summaries are not published to the public, so the Article 50 duties to inform users and to disclose published generated text add little for the deploying organization. Article 50(2) still requires the provider of a system that generates text to mark its output, in a machine readable format, as AI generated: usually the vendor, but an organization that builds its own summarizer can itself be that provider, which is what puts this use case at the limited tier rather than minimal. Beyond this and AI literacy (Article 4), no specific obligations apply. General model risk and third party rules still apply.

Annex III point 5(b) lists creditworthiness assessment and credit scoring of natural persons as high risk but explicitly excludes AI systems used for the purpose of detecting financial fraud, and payment fraud scoring is not otherwise listed in Annex III or prohibited by Article 5. Behavioral biometrics used only to confirm that customers are who they claim to be fall under the biometric verification exclusion in Annex III point 1(a). The model does not interact with people, so Article 50 does not apply. GDPR Article 22 can still apply to solely automated declines with significant effects on customers.

AML transaction monitoring is not listed in Annex III; point 5(b) covers creditworthiness and credit scoring and excludes systems used to detect financial fraud. The Article 5(1)(d) ban on predicting criminal offenses from profiling alone does not apply to systems that support a human assessment already based on objective and verifiable facts linked to criminal activity, which is how alert triage should be designed. A decision to restrict an account taken solely by automated means would fall under GDPR Article 22 and national AML law, so consequential decisions need human review.

Drafting internal reports for a human investigator is not listed in Annex III (the law enforcement uses in point 6 cover systems used by or for law enforcement authorities, not a bank's own reporting), and the text is not published to inform the public, so the deployer disclosure duty for generated text in Article 50(4) does not apply. Confidentiality rules for suspicious activity reports and GDPR apply in full.

Internal triage of fraud alerts is not listed in Annex III, and point 5(b) explicitly excludes fraud detection from the high risk creditworthiness category. Article 50(1) covers any system that interacts directly with people, analysts included, but it does not apply where the use of AI is obvious to a reasonably well informed user, as it is in an internal analyst tool; the marking duties for generated content in Article 50(2) sit with the provider. Reassess if its output feeds credit decisions. Decisions that affect customers remain subject to GDPR and consumer protection rules.

Dispute processing between issuers, acquirers and merchants is not listed in Annex III and is not an evaluation of creditworthiness or credit scoring under Annex III point 5(b), and because cardholders do not interact with the system directly, the Article 50(1) transparency duty for AI that talks to people does not apply. Article 50(2) marking of generated text is a duty of the provider of the AI system that generates it, which includes an institution that builds its own dispute drafting agent and puts it into service under its own name. A drafted rebuttal built from attached case evidence performs an assistive function for standard editing of that evidence and does not substantially alter the underlying input, so it falls under the Article 50(2) exception and does not need machine readable marking. With that point checked, the tier stays minimal. A customer facing intake agent is assessed separately.

Matching entries between internal financial records is not a use listed in Annex III and is not a practice prohibited by Article 5. Operators knowingly use an internal AI tool, so no Article 50(1) disclosure is needed. If a generative model drafts the explanations or journals, the provider of that system may have to mark its output as AI generated under Article 50(2). The AI literacy duty of Article 4 applies to the bank as deployer.

Detecting mule accounts is fraud and AML detection by a private firm, which Annex III does not list; point 5(b) explicitly excludes systems used to detect financial fraud from the credit scoring category. Restricting an account based solely on an automated score can be a decision with similarly significant effects under GDPR Article 22, so keep a human decision and a route to challenge.

Sanctions screening by banks and payment firms is not listed in Annex III: point 5 covers credit scoring and life and health insurance pricing, and point 6 covers AI used by or on behalf of law enforcement authorities. It is not a prohibited practice under Article 5, and as an internal tool it carries no Article 50 transparency duty. It still processes personal data at scale, so GDPR applies, and decisions that block a payment or freeze assets remain human decisions.

Analyzing complaints in aggregate to find causes is not listed in Annex III, is not a practice prohibited by Article 5 and does not decide on individuals. It does not interact with the public, so the disclosure duty in Article 50(1) does not apply; the machine readable marking of generated text in Article 50(2) is a duty of the provider of the generative model or system that writes the summaries. If the same system decided individual complaint outcomes or redress, or its themes were used to evaluate the performance of individual complaint handlers (Annex III point 4), that design would need its own assessment.

Verifying charges against contracts is not listed in Annex III and is not a practice prohibited by Article 5. The system is internal, so the Article 50(1) duty to tell people they are dealing with AI does not arise; the Article 50(2) duty to mark generated text, such as the discrepancy explanations, falls on the provider of the generative model or system. It supports, but does not take, decisions about individual customers; remediation decisions stay with people.

An internal tool that supports engineers on IT incidents; it is not a use listed in Annex III and makes no decisions about people. Annex III point 2 covers AI used as a safety component in the management and operation of critical digital infrastructure, and recital 55 limits safety components to systems that directly protect the physical integrity of that infrastructure or the health and safety of persons and property. A triage copilot that proposes causes and fixes to engineers does not normally do that, but operators of critical digital infrastructure (cloud, data centers, telecom networks) should confirm this for their own design.

Handling payment exceptions is not a use listed in Annex III and is not a prohibited practice under Article 5. If the agent interacts directly with customers, for example in a chat about the case, Article 50(1) requires that they are told they are interacting with an AI system.

Adverse media and PEP screening for due diligence is not listed in Annex III. It processes personal data, including data about alleged offenses, so GDPR Article 10 and national AML law govern what may be collected and how long it is kept.

Drafting regulatory correspondence for human approval is not an Annex III use. The main risks are confidentiality and accuracy, which are handled by supervisory information rules, data protection law and internal controls.

Assessing organizations as vendors is not an Annex III use. If assessments score individual natural persons, such as sole traders, check the design against Annex III and data protection rules. The EU AI Act also shapes what to ask AI vendors, since providers of high risk systems carry specific obligations.