Does the EU AI Act fraud detection exemption cover AI that declines credit applications?

What point 5(b) says and what it does not say

Annex III point 5 covers access to and enjoyment of essential private services and essential public services and benefits. Within it, point 5(b) lists AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud. The wording is unchanged in the consolidated text of 27 July 2026.

Two features of the wording matter for classification. First, the creditworthiness limb is framed by intended use, and the fraud exception by the purpose for which a system is used. Neither is framed by technology or product category. Second, the provision concerns natural persons, so it speaks to consumer-facing credit decisions.

The recitals give the reason for the high-risk status. Such systems determine people's access to financial resources or essential services, and they may lead to discrimination between persons or groups, perpetuate historical patterns of discrimination, or create new discriminatory impacts. That rationale is the practical lens for an AI function that declines an application, because a decline is the point at which access is lost.

Where the recital and the Annex wording differ

The recital on fraud is narrower than the Annex text. It says AI systems provided for by Union law for the purpose of detecting fraud in the offering of financial services, and for prudential purposes to calculate capital requirements of credit institutions and insurance undertakings, should not be considered high-risk. Point 5(b) refers simply to AI systems used for the purpose of detecting financial fraud, without the Union law basis and without the reference to the offering of financial services.

The operative Annex text and the recital can be read together or the Annex can be read on its own terms, and the regulation does not say how that difference applies to a system that both flags fraud and declines applications. It also gives no rule on whether a single model serving both purposes is split into functions or treated as one system. These are open interpretive points. A defensible position records which reading was adopted, why, and who approved it.

A separate recital on a prohibition mentions assessing the likelihood of financial fraud by undertakings on the basis of suspicious transactions. It concerns that prohibition and undertakings, not the Annex III exclusion for natural persons, so it should not be used to justify a point 5(b) classification.

A functional test for fraud detection versus creditworthiness evaluation

The regulation does not supply technical criteria for separating the two. The four factors below are an editorial framework built from the purpose-based wording and the recital rationale. They are not Commission guidance. Apply them to each AI function and record the answer.

• Output: A fraud likelihood or anomaly signal points toward fraud detection. A score or label about the applicant as a credit risk points toward creditworthiness evaluation.
• Role in the grant or deny decision: An output that is only routed to a fraud team differs from one that triggers, or is a deciding input to, an automatic decline. Impact on access to credit is the recital rationale.
• Human involvement: Record whether a person reviews the output before a decline, whether they can depart from it, and whether review is substantive or a formality.
• Data inputs: Inputs about identity, device or transaction anomalies differ from inputs about income, repayment history or financial standing. Mixed inputs need an explicit rationale.

If a function is high-risk: obligations and runtime evidence

A function classified as high-risk is subject to the requirements in Articles 9 to 15, which cover risk management, record-keeping, human oversight, and accuracy and robustness, among other areas. Classification should therefore be settled before the system is built into a decision path, not after.

For each area, the useful question is what a regulator could be shown about behaviour at runtime. For record-keeping, that is a durable record of each interaction and tool call the function made, with the inputs it received and the output it produced. For human oversight, it is evidence that a decline was escalated to a named reviewer, what the reviewer saw, and what they decided. For risk management, it is evidence that the controls defined for the function were actually applied to live traffic. For accuracy and robustness, it is output history that can be compared with expected behaviour over time.

Timing should also be recorded. The Digital Omnibus on AI entered into force on 27 July 2026. As of November 2026, it sets application dates of 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products. Keep a dated record of which version of the text and which application date each classification relied on, with a review date, because Annex III can be amended and the Commission describes frequent evaluations of parts of the Act.

Where runtime policy enforcement fits

Whichever classification applies, a regulated enterprise needs to show what its AI was allowed to do and what it did. Trussed enforces policy in the execution path across models, agents, tools and MCP servers, at the level of individual interactions and tool calls. Policy can allow, redact, block, rate limit or escalate for human approval, and enforcement produces audit-ready evidence mapped to the EU AI Act.

For a function classified as high-risk, that means a decline-related action can be routed for human approval at runtime, and the evidence of that decision is generated as it happens rather than reconstructed later. For a function classified as excepted, the same enforcement can hold the function to its documented purpose, for example by blocking use of its output outside the workflow recorded in the classification rationale. Trussed does not decide the classification. That judgement remains with the organisation and its legal advisers.