What happens when the loan officer who decides your mortgage is a model, not a person? By 2027, that question stops being theoretical. Banks in New York, Frankfurt and London already run machine learning models that score creditworthiness, flag fraud and screen customers. The rules governing those models are now splitting into three distinct regimes, and anyone working in banking compliance needs to understand how they differ.
Here is the practical picture: what changes in 2027, what does not, and where the real compliance work sits.
The Short Version: Three Regimes, Three Philosophies
The European Union writes binding law. The United States supervises through existing rules and lets agencies set the tone. The United Kingdom relies on its regulators applying principles already on the books.
| Region | Core approach | Main legal hook | What bites in 2027 |
|---|---|---|---|
| EU | Prescriptive statute | AI Act (Regulation 2024/1689) plus DORA | High-risk credit scoring duties, phased through 2026 and 2027 |
| US | Supervisory guidance | Model risk rules, fair lending law, state statutes | Colorado’s AI Act, bank exams, fair lending enforcement |
| UK | Regulator-led principles | Consumer Duty, senior manager rules, operational resilience | Outcomes testing, governance expectations, possible new legislation |
That table hides a lot of nuance, so let’s take each region in turn.
EU: The AI Act Turns Credit Scoring Into a Regulated Product
The EU AI Act entered into force on 1 August 2024. It does not arrive all at once. Prohibitions applied from February 2025, and obligations for general-purpose AI models applied from August 2025. The bulk of the regulation applies generally from 2 August 2026. By 2027, banks are living inside it.
The part that matters most for lenders sits in Annex III. AI systems used to evaluate the creditworthiness of natural persons or to establish their credit score are classified as high-risk. That label is not cosmetic. High-risk systems carry obligations around risk management, data governance, logging, technical documentation, human oversight and conformity assessment.
In plain terms, a bank cannot simply plug in a vendor scoring model and hope for the best. It needs a documented risk file, traceable data lineage, and a human in the loop who can actually override the machine.
Where the 2027 Dates Come From
High-risk obligations were scheduled from 2 August 2026, with some duties tied to product safety law arriving on 2 August 2027. That is the origin of most “2027 deadline” headlines. It is worth being precise: 2027 is largely a phased implementation year, not the birth of a brand new US or UK banking AI statute.
One caution flag. Late in 2026 there were reports of a “digital omnibus” proposal that could delay parts of the Act. Anyone quoting dates should check the current legal text rather than a blog post from last spring.
DORA Already Applies
Separately, the Digital Operational Resilience Act (Regulation 2022/2554) has applied since 17 January 2025. It covers ICT risk, including systems that depend on AI. So even before the AI Act’s high-risk duties fully bite, EU banks must already map AI vendors into their ICT third-party risk registers.
The Financial Sector Carve-Out
Here is a detail people miss. Where an AI system is a safety component of a product under sectoral law, the AI Act defers to existing financial supervision. Banking prudential and conduct rules under CRR, CRD, MiFID II and DORA continue to apply alongside. The AI Act adds a layer; it does not replace the stack. If you want the underlying logic of how rule-based systems get built and audited, this algorithm plain english guide to the rules behind modern software is a useful grounding.
US: No Single AI Banking Statute, and That Is the Point
Ask a US banker which federal AI rule governs their credit model and the honest answer is: none specifically. Federal banking agencies have not issued a binding AI-only rule for banks. Supervision runs through frameworks that predate the current wave of models.
The backbone is SR 11-7, the Federal Reserve’s 2011 model risk management guidance. It asks banks to validate models, document assumptions, and govern them through a clear chain of accountability. A large language model used in underwriting gets pulled into that net whether or not it was designed for it.
On top of that sits fair lending law. The Equal Credit Opportunity Act and Regulation B prohibit discrimination. If a model produces disparate outcomes, the fact that nobody intended it is not a defence.
States Move First
Where federal rulemaking has stalled, states have stepped in. Colorado’s AI Act (SB 24-205, signed in 2024) targets “consequential decisions,” and lending is squarely on that list. Its effective date was pushed to 30 June 2026, so by 2027 it is live. Expect developers and deployers of high-risk systems to face impact assessments and disclosure duties.
Other states have taken narrower swings, mostly around algorithmic discrimination in insurance and employment. The patchwork is the story. A national bank can face one standard in Colorado, another in New York, and a third from its federal examiner.
What US Exams Actually Look At
In practice, examiners ask familiar questions dressed in new clothes:
- Can you explain how the model reaches a decision?
- Who owns the model, and who can override it?
- How do you test for bias, and how often?
- What happens when the model drifts or a vendor changes it silently?
- Can you reproduce a decision from two years ago?
If your team cannot answer question five, start there. It is the one that sinks institutions in enforcement actions.
The Practical Trap
The most common US mistake is treating AI governance as an IT project. It is not. Model risk lives with the business line, fair lending lives with compliance, and vendor oversight lives with third-party risk. When those three teams use different inventories of the same model, exams get ugly fast. Building one shared register, with one owner per model, fixes more problems than any new tool.
UK: Principles Over Prescriptions
The UK has taken a deliberately different road. There is no AI-specific banking statute. Instead, the FCA and PRA apply rules that already exist, under a pro-innovation, sector-regulator approach set out in the government’s AI white paper of March 2023 and refined since.
The centrepiece is the Consumer Duty (PS22/9, July 2022). It applied to open products from 31 July 2023 and closed products from 31 July 2024. It requires firms to deliver good outcomes and to evidence that they have. That is the hook for AI.
If an AI chatbot gives a customer wrong information about a mortgage, or a model nudges vulnerable customers toward expensive products, Consumer Duty is the rule that catches it. Not a new AI law.
Governance Under SM&CR
The Senior Managers and Certification Regime means a named human is accountable. “The algorithm did it” is not a defence when a senior manager owns the outcome. Add operational resilience rules, which require firms to stay within impact tolerances during disruption, and you get a regime that cares about results rather than paperwork.
What UK Firms Should Watch
UK AI legislation status remained unresolved heading into late 2026, so firms should plan for both scenarios: continued regulator-led supervision, or a new statutory framework layered on top. Either way, the compliance work is similar. Map the models, document the outcomes testing, and keep the audit trail.
What Actually Works in Practice
Across all three regimes, the same handful of habits separate calm institutions from panicked ones.
Build one model inventory. Not three. Every AI system that touches a customer decision gets an entry, an owner, a risk rating and a review date. This single artefact satisfies EU documentation duties, US model risk expectations and UK governance questions.
Test outcomes, not inputs alone. Fair lending and Consumer Duty both focus on what customers actually experience. Run disparate impact analysis on real decision data, not synthetic samples. Document what you found and what you did about it.
Treat vendors as part of your model. Most banks do not build their scoring engines. They buy them. Under DORA and under US third-party risk guidance, a vendor’s opacity is your problem. Get contractual rights to documentation, change notification and validation access before signing.
Write the human oversight story down. The EU requires human oversight of high-risk systems. A reviewer who rubber-stamps 400 decisions an hour does not meet that requirement, and an examiner will say so. Define override authority, log overrides, and review them monthly.
Rehearse the explanation. Pick a declined applicant at random each quarter and reconstruct the decision end to end. If it takes more than a day, your documentation has a gap.
Common Mistakes Worth Avoiding
- Assuming the EU AI Act only applies to EU-headquartered firms. It follows the market, not the mailbox.
- Reading “2027” as a single cliff edge. It is a sequence of dates, some of which may move.
- Letting legal, risk and data science run separate AI committees that never compare notes.
- Skipping the boring part: version control on training data. When a model is challenged, the data is the evidence.
Where the Money and Models Meet
It helps to remember what is actually being regulated. A credit score is a compressed judgement about whether someone will repay. The systems that produce it sit on top of deposits, lending books and payment flows, which is why supervisors care so much. If you want a clearer mental model of how the underlying financial plumbing works, this explainer on how money is made through notes, coins and bank deposits covers the basics that AI credit models are ultimately predicting against.
The same principle applies to gaming-style rule systems that people learn intuitively. Whether it is the starting money rule in Monopoly and why 1,500 is the number or a bank’s internal risk appetite thresholds, fixed parameters shape behaviour. Regulators know this. That is why they ask who set the threshold and who can change it.
How the Three Regimes Compare on Key Duties
| Duty | EU | US | UK |
|---|---|---|---|
| Formal high-risk classification | Yes, Annex III | No federal equivalent | No |
| Model documentation | Required | Expected under model risk guidance | Expected under governance rules |
| Bias testing | Required | Required via fair lending law | Required via Consumer Duty outcomes |
| Human oversight | Explicit legal duty | Supervisory expectation | Senior manager accountability |
| Vendor/ICT risk | DORA since Jan 2025 | Third-party risk guidance | Operational resilience rules |
| Primary enforcement style | Statutory penalties | Exams and enforcement actions | Supervisory intervention |
The pattern is clear. Europe legislates, America supervises, Britain principles. Firms operating in all three end up building to the strictest common denominator, which in most cases is the EU documentation standard plus US fair lending testing.
Conclusion
By 2027, AI in banking is not a frontier topic. It is a compliance one. The EU will be enforcing high-risk duties on credit scoring, with some obligations landing in August 2027. The US will keep supervising through model risk and fair lending frameworks while states like Colorado fill the legislative gap. The UK will keep asking firms to prove good outcomes and name accountable humans.
The institutions that handle this well will not be the ones with the most sophisticated models. They will be the ones that can explain a decision, show their testing, and point to a person who owns the result. Start with the inventory. Everything else follows.
Frequently Asked Questions
Is there a single US law regulating AI in banking by 2027?
No. There is no federal AI-specific banking statute. Supervision runs through existing frameworks, chiefly model risk management guidance and fair lending law, plus state statutes such as Colorado’s AI Act, which takes effect on 30 June 2026 and covers lending decisions.
Does the EU AI Act apply to banks based outside Europe?
It can. The Act follows the market. If a non-EU bank uses an AI system to evaluate the creditworthiness of people in the EU, that system falls into the high-risk category and the associated duties apply, regardless of where the bank is headquartered.
What exactly changes on 2 August 2027?
That date carries some high-risk obligations tied to product safety law, following the main high-risk duties scheduled from 2 August 2026. It is a phased sequence rather than a single switch. Because delay proposals have circulated, firms should confirm dates against the current legal text.
Is credit scoring always high-risk under the EU AI Act?
AI systems that evaluate the creditworthiness of natural persons or set their credit score are listed as high-risk in Annex III. That covers most consumer and small-business lending models, though the precise scope depends on how the system is used.
How does UK regulation of AI in banking actually work?
Through existing rules rather than a new AI statute. The FCA and PRA apply Consumer Duty, the Senior Managers and Certification Regime, and operational resilience requirements. Firms must show good customer outcomes and name an accountable senior manager for AI-driven services.
What is the first practical step a bank should take?
Build a single inventory of every AI system that affects a customer decision, with an owner, a risk rating and a review date. One shared register satisfies EU documentation duties, US model risk expectations and UK governance questions at the same time.
