EU AI Act compliance for debt collection AI in 2026

Annex III, point 5(b) of Regulation (EU) 2024/1689 covers AI systems "intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud" [1]. Collections AI that scores debtors for likelihood of repayment, allocates accounts to recovery strategies based on a model output, or sets payment plan terms based on an automated affordability assessment falls inside this category. Pure dialler-routing AI (which agent answers which call) generally does not.

Point 5(a) of Annex III separately covers AI used by public authorities to evaluate eligibility for essential public services and benefits. A collections AI system used by a public-sector creditor (a tax authority, a social security agency) to make decisions about payment plans for benefit overpayments triggers point 5(a) in addition to or instead of 5(b). Point 5(c) covers AI used to evaluate emergency calls, which is not relevant here. The EBA's guidelines on loan origination and monitoring set the prudential expectations that overlap with the Act's data-governance and human-oversight obligations [2].

Article 22 of the GDPR prohibits decisions based solely on automated processing, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them, unless the decision is necessary for entering into or performing a contract, is authorised by Union or Member State law with appropriate safeguards, or is based on the data subject's explicit consent [3]. A fully-automated decision to refer a debt to litigation, to register a default with a credit bureau, or to refuse a payment plan all qualify as "significantly affecting" the data subject.

The European Data Protection Board has clarified, most recently in its December 2023 guidelines on automated individual decision-making and through CJEU C-634/21 (SCHUFA), that a credit-scoring output passed to a third party who then makes a decision can itself be the Article 22 decision when the third party's decision draws strongly on the score [4]. The operational consequence: the human who reviews the AI's collections recommendation must be a meaningful reviewer with authority and information to overturn the recommendation, not a rubber-stamp.

Two triggers in practice. First, intended purpose. If the provider's documentation describes the system as a "creditworthiness evaluation" or "scoring" tool, point 5(b) is triggered automatically. Second, deployment context. A propensity-to-pay model that the deployer uses to set legally-significant terms (interest rate, payment plan duration, collateral release) is functionally a creditworthiness model regardless of how the provider describes it.

The Article 6(3) carve-out applies in narrow cases - a model that ranks accounts for the order in which a human collector reviews them, without setting any decision parameter, can qualify as a "preparatory task." That justification has to be documented in the technical file. The European Banking Authority's December 2023 final guidelines on the application of MiFID II suitability rules and the related EBA work on AI in banking set the convergent regulator expectation that scoring outputs which feed legally-significant decisions are themselves regulated outputs [2].

Annex IV of the AI Act sets the documentation contents: general description, design specifications, training data and data-governance evidence, validation and testing procedures, human oversight design, monitoring and post-market plan, risk management system, change log, applied standards, and EU declaration of conformity [1]. For collections AI, three Annex IV elements deserve disproportionate attention.

One: the Article 10 data-governance evidence. Training data must be representative across debtor segments. A model trained predominantly on prime-segment defaults will under-perform and discriminate on subprime debtors; the bias-evaluation pass must show the protected-category breakdown explicitly. Two: the Article 14 human-oversight design. The reviewer interface has to surface the input features, the model output, and the confidence band, with override logged. Three: the Article 15 accuracy and robustness evidence. The model has to perform within stated bounds on out-of-distribution data, including economic-cycle-shifted holdout sets. The EDPB's binding decision on Meta-related cases set the precedent for documentation depth that supervisory authorities expect [5].

Three operational tests. First, capability. The reviewer must have authority and information to overturn the recommendation. A junior collector with a "confirm" button is not oversight; a portfolio manager with access to the model inputs, the model output, the confidence band and the alternative outcomes is. Second, frequency. A 100%-review regime at launch, tapered to a sampled review regime once the model's drift is understood, is the EBA-aligned pattern [2]. Third, logging. Every override has to be logged with reason code, reviewer ID, and timestamp; that log is the audit evidence for both the AI Act and the GDPR Article 22.

Article 86 of the AI Act, which applies from 2 August 2026, gives affected individuals the right to obtain a clear and meaningful explanation of the role of the AI system in the decision-making procedure when a decision based on the output of a high-risk system produces legal or similarly significant effects. Collections AI providers should design the explanation artefact at build time, not retrofit it under a complaint.

Impetora ships every collections AI system with a written risk classification analysis (point 5(b) yes or no, with the Annex III reasoning written out), a data-governance description aligned with Article 10 and the EBA loan origination guidelines, a draft technical documentation pack aligned with Annex IV, a human-oversight design spec mapped to GDPR Article 22 and the EDPB SCHUFA guidance, an Article 86 explanation artefact, and a post-market monitoring plan with named drift metrics, owners and reporting cadence.

The five-artefact deliverable lands in the master services agreement, not as an upsell. Cross-references: the EU AI Act overview, the debt collection industry hub, the decision-support AI use case, and the TRACE methodology.