Independent comparison of vendors building AI for retail, commercial and corporate banks in 2026, with a focus on EU AI Act Annex III point 5(b) (creditworthiness assessment), Federal Reserve SR 11-7 model-risk-management guidance, EBA guidelines on internal governance, and DORA operational-resilience requirements [1][2].
Vendors were selected on five criteria: depth of EU AI Act practice (Annex III point 5(b) creditworthiness), banking-vertical specialisation evidenced by named bank deployments or named regulators worked with, a written methodology, multilingual delivery across at least three European languages, and a citation chain in shipped outputs (factor-level traceability for credit and AML decisions).
The list is ordered by shape of fit, not ranked. The middle of the list is not worse than the top.
Honesty disclosure: Impetora is one of the nine vendors below. We have written our own entry in the same factual register as the others.
Verification: every vendor was confirmed operating as of April 2026 by checking their public website and a recent press mention.
Five practical tests. First, can the vendor produce a written conformity-assessment plan for the workload, mapped to Annex III point 5(b) where creditworthiness is in scope? Second, has the vendor read SR 11-7 (Federal Reserve guidance on model risk management) and the EBA guidelines on internal governance under CRD V, and can they articulate how delivery satisfies independent model validation, model-risk register and performance monitoring? Third, do shipped outputs include factor-level evidence chains traceable to the source (credit file, transaction history, policy clause)? Fourth, does the vendor demonstrate DORA-aligned operational resilience (incident response, third-party risk, exit plan)? Fifth, does the proposal name the senior engineer who will be hands-on?
Vendors that cannot cite SR 11-7, EBA guidelines, DORA or the AI Act in the proposal should not progress.
The EU AI Act, Regulation (EU) 2024/1689, treats AI used to evaluate creditworthiness or credit score of natural persons as high-risk under Annex III point 5(b) [1]. Article 43(2) carves a partial exception where the AI is part of a financial-services internal control framework already supervised under EU financial-services law, but the substantive obligations still apply.
SR 11-7 (Federal Reserve, OCC SR 11-7 / OCC Bulletin 2011-12) is the canonical US model-risk-management guidance and is the de-facto global benchmark for bank model validation [7]. The practical implication for vendor selection is that any AI shipped into a US bank decisioning chain must be deliverable with effective challenge documentation, independent validation, and ongoing monitoring artefacts.
EBA guidelines on internal governance under CRD V apply to EU banks. DORA (Regulation (EU) 2022/2554), in force from 17 January 2025, adds operational-resilience and ICT third-party-risk obligations that materially affect AI vendor procurement: contracts must specify exit, audit, and concentration-risk provisions [2].
Buy when: the workload is real-time fraud, sanctions screening or AML transaction monitoring and a productised platform such as Quantexa or Featurespace already covers 80% of the use case with the regulator references the bank needs.
Build when: the workload is creditworthiness on a niche product (SME, microfinance, embedded credit), where the model-risk regime requires factor-level evidence chains the SaaS vendor cannot provide, or where DORA exit and concentration-risk provisions argue against single-vendor dependency.
Hybrid when: AML is bought from a platform but credit-policy Q&A and exception adjudication are custom because product taxonomy and policy text are bespoke.
Send the same five written questions to every vendor on the shortlist:
Ready to scope your project? Submit a short brief and we reply within one business day.
Tell us what you would like to build. We reply within one business day.