In short Under the EU AI Act (Regulation (EU) 2024/1689), AI systems that evaluate people's creditworthiness or establish their credit score are high risk, except fraud detection, as are systems for risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). A score that rates the authenticity and quality of lead data is not one of those. After the Digital Omnibus on AI (Regulation (EU) 2026/1744), the high-risk obligations for these systems apply from 2 December 2027. GDPR Article 22 applies already, and the Court of Justice has held that a score passed to a third party can itself be an automated decision.
Two very different scores
"Lead score" can mean two things.
- A data quality score. It tells you whether a lead is real and usable: the email accepts mail, the phone number is valid, the fields are consistent, it is not a duplicate, the source has a clean history and the form was not filled in by a script.
- A score about the person. It tells you how likely someone is to repay a loan or how much they would cost to insure. It draws on income, debts, payment history or health.
The second is a lender's or an insurer's job, and the AI Act treats it as high risk.
What Annex III, point 5 says
Article 6(2) of the AI Act makes the systems listed in Annex III high risk. Under point 5, on access to essential private services, the list includes:
- point (b): AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for detecting financial fraud;
- point (c): AI systems intended for risk assessment and pricing in relation to natural persons for life and health insurance.
Recital 58 explains why: these systems decide access to finance and to services such as housing, electricity and telecoms, and they can discriminate. The same recital words the fraud carve-out more narrowly than the annex, referring to systems "provided for by Union law" to detect fraud in financial services. That gap is worth raising with a lawyer.
What matters is the intended purpose. A system that checks form data does not become a credit scoring system because the form is about a loan. It becomes one if it is built or used to predict who will repay.
Article 6: high risk and the exceptions
Article 6(3) lets an Annex III system escape the high-risk category if it does not pose a significant risk of harm to health, safety or fundamental rights, for example because it:
- performs a narrow procedural task;
- improves the result of a previously completed human activity;
- detects decision-making patterns or deviations without replacing human assessment;
- performs a preparatory task to an assessment.
There is a hard limit: an Annex III system that performs profiling of natural persons is always high risk. A provider relying on the exception will have to document its assessment before placing the system on the market and register it (Articles 6(4) and 49(2)).
That exception only matters for systems already in Annex III, and a data quality score that evaluates neither creditworthiness nor insurance risk is not one. Whether such a score counts as profiling under Article 4(4) GDPR depends on the signals it uses. The definition expressly mentions a person's economic situation, health and reliability. Ask a lawyer to check your signals.
The dates after the Digital Omnibus on AI
Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on the third day after publication. It is adopted law, not a proposal. Three changes matter here:
- the high-risk obligations (Chapter III, Sections 1 to 3) apply from 2 December 2027 for Annex III systems and from 2 August 2028 for systems linked to Annex I products. For Annex III the original date was 2 August 2026;
- Article 4 on AI literacy has been rewritten. Providers and deployers must take measures to support the AI literacy of their staff and of others using AI systems on their behalf, without having to guarantee any specific level for each individual;
- Article 50 on transparency was not postponed and applies from the general date of 2 August 2026. Only for marking AI-generated content (Article 50(2)) do providers whose systems were on the market before that date have until 2 December 2026.
The Commission's separate data package, the Digital Omnibus proposal COM(2025) 837 of 19 November 2025, would among other things rewrite Article 22(1) and (2) of the GDPR. That one is still a proposal: on 3 November 2026 the European Parliament's procedure file showed it awaiting a committee decision.
National law can add to this. Italy's Law no. 132 of 23 September 2025, in force since 10 October 2025, applies alongside the AI Act and must be read in line with it (Article 1).
Transparency rules that already apply
Two duties apply even outside high risk:
- an assistant or chatbot that talks to people must tell them they are dealing with AI, unless that is obvious (Article 50(1));
- a publisher that publishes AI-generated or AI-manipulated text to inform the public on matters of public interest must disclose it. This does not apply where the text has gone through human review or editorial control and someone holds editorial responsibility (Article 50(4)).
GDPR Article 22 and the SCHUFA judgment
Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. The exceptions are contract, law and explicit consent. In the contract and consent cases, you need safeguards: at least the right to human intervention, to express a point of view and to contest the decision. Recital 71 gives the automatic refusal of an online credit application as an example.
In its judgment of 7 December 2023 in Case C-634/21, the Court of Justice ruled on scores passed to others. A credit information agency's automated calculation of a probability value about a person's ability to pay is itself automated decision-making, where a third party to which it is sent draws strongly on it to establish, implement or end a contract with that person.
The lesson for anyone selling leads: the risk depends less on what you call your score than on what the buyer does with it. If a lender uses your score to accept or refuse a loan application, the Court's reasoning may reach you.
The UK: a different regime
The EU AI Act also reaches providers and deployers outside the EU when the output of their system is used in the EU (Article 2(1)(c)), which matters to UK publishers with EU buyers.
In UK data protection law, Article 22 has gone. Since 5 February 2026 the UK GDPR contains Articles 22A to 22D instead, substituted by section 80 of the Data (Use and Access) Act 2025. A decision is "based solely on automated processing" if there is no meaningful human involvement. Significant decisions of that kind are restricted where they rely on special category data or on the new lawful basis in Article 6(1)(ea) (Article 22B). Wherever such a decision is taken, the controller must put safeguards in place: information about the decision, a way to make representations, human intervention and a way to contest it (Article 22C).
What to keep out of the score
A practical checklist, not a legal rule:
- Leave out: income, debts, existing credit, dealings with lenders or credit reference agencies, health, habits that hint at health, and special category data (Article 9 GDPR).
- Keep in: email and phone validity, field consistency, duplicates, source history, signs of scripted or bulk form filling.
- Write down the score's intended purpose, and do not change it without a fresh assessment.
- In partner contracts, state that the quality score must not be used to decide on credit or on insurance pricing.
How we are designing Markmatix for this
Markmatix is in development. The lead quality score is being designed to measure the authenticity and quality of lead data, never creditworthiness or insurance risk. Income, debts and health will not be among the AI score's signals, and every score will come with an explanation of why. Suspicious sources will be quarantined until a person reviews them. Before launch the plan includes a data protection impact assessment and a legal review. This applies to the loan leads and insurance leads sectors too.
Sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), 13 June 2024: Articles 2, 4, 6, 49, 50 and 113; Annex III, point 5; recital 58. EUR-Lex
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L series, 24 July 2026. EUR-Lex
- Regulation (EU) 2016/679 (GDPR): Articles 4(4), 9 and 22; recital 71. EUR-Lex
- Court of Justice of the European Union, judgment of 7 December 2023, Case C-634/21 (SCHUFA Holding). curia.europa.eu
- UK GDPR, Articles 22A to 22D, as substituted by the Data (Use and Access) Act 2025, section 80, from 5 February 2026. Article 22A · Article 22B · Article 22C
- Italy, Law no. 132 of 23 September 2025 on artificial intelligence (Official Gazette no. 223 of 25 September 2025), Article 1. Normattiva
- European Commission, proposal COM(2025) 837 final of 19 November 2025 (Digital Omnibus), procedure 2025/0360(COD). EUR-Lex · Legislative Observatory
This guide explains the rules in general and is not legal advice: for your case, ask a lawyer.