Abstract

The article examines the obligations associated with consumer creditworthiness assessments conducted using AI systems under the forthcoming Polish Second Consumer Credit Act (implementing the CCD2) and the AI Act. In the first part, the article analyses the key provisions of the draft Second Consumer Credit Act that will govern creditors’ obligations in relation to consumer creditworthiness assessments. In the second part, it examines the provisions of the AI Act applicable to AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score. In both regulatory frameworks, one of the central safeguards designed to protect natural persons (consumers) against the potentially adverse effects of AI systems – particularly high-risk AI systems – or, more broadly, automated processing of (personal) data, is the requirement to ensure meaningful human intervention. However, within the next few years societies may increasingly face a different question: whether certain tasks should continue to be performed by humans (high-risk human intelligence) and, if so, whether individuals should also be guaranteed at least a right to AI intervention.

Keywords

Consumer credit, creditworthiness assessment, high-risk AI systems, creditors, deployers.

Bartosz Wyżykowski

Introduction

The aim of this article is to examine the obligations associated with the consumer creditworthiness assessment conducted with the use of AI systems[1], within the framework of the forthcoming Polish Second Consumer Credit Act (which will implement the CCD2[2]) as well as under the AI Act. Given that legislative work on the draft Consumer Credit Act is currently ongoing, the analysis will be based on the most recent version of the draft (UC82) of 17 April 2026 („Draft CCA2”)[3]. Additionally, in May 2026, it was announced that work on Draft CCA2 would not continue and that a new proposal would be introduced[4]. It should be assumed that the final text of the act, which is expected to enter into force on 20 November 2026[5], may differ to some extent from the draft currently under consideration, which could affect both the analysis and the conclusions presented in this article. Nevertheless, the article touches on issues that are largely based on the provisions of the CCD2, and therefore the article will likely remain relevant for the most part in the context of the new draft and future law.

At present, the use of AI systems by creditors[6] granting consumer credits[7] for the purposes of conducting creditworthiness assessments is governed by two key legal acts, namely the currently applicable CCA and the GDPR[8]. Depending on the status of the creditor, other legal acts may also apply, such as the Banking Law Act[9] or the Credit Unions Act[10]. In turn, with regard to creditworthiness assessments carried out for the purposes of granting mortgage credit, the Act on Mortgage Credit[11], implementing Directive 2014/17[12] will be applicable. Where the granting of credit is simultaneously linked to the provision of a payment service, the provisions of the Payment Services Act[13] apply, and soon the Payment Services Regulation[14], will also be of relevance. Insofar as the use of AI systems involves the outsourcing of activities to third parties, particular importance will be attached to outsourcing regulations, as well as the DORA[15] (ICT TPSP regulations). Importantly, pursuant to Article 6(3)(1) of the Banking Law, outsourcing of activities by a bank may not include the assessment of creditworthiness or the analysis of credit risk[16]. Furthermore, where an AI system is classified as a product presenting a risk within the meaning of Regulation 2019/1020[17], additional obligations arising from that act will apply.

None of the aforementioned legal acts specifically regulate the use of AI systems for the purpose of conducting consumer creditworthiness assessments per se. Instead, these provisions establish either horizontal obligations relating to creditworthiness assessment, irrespective of whether AI systems are employed for this purpose (e.g. the CCA, the Mortgage Credit Act, or the Banking Law Act), or obligations concerning the processing of personal data, also irrespective of whether such processing involves AI systems and regardless of whether it is carried out for the purposes of creditworthiness assessment (GDPR – although the GDPR does refer to wholly or partly automated processing of personal data).

The situation is different in the case of the AI Act. This Regulation governs the placing on the market and use of AI systems, including those intended to be used to evaluate the creditworthiness of natural persons or establish their credit score. This regulation has already entered into force[18], and certain of its provisions are already applicable[19]. Nevertheless, the key provisions of the AI Act were originally intended to apply from 2 August 2026[20]. This includes in particular Article 6(2) of the AI Act, which classifies as high-risk AI systems (HRAI systems) those systems referred to in Annex III of the Act. Annex III includes, inter alia, AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud (within the scope of access to and enjoyment of essential private services and essential public services and benefits) – point 5(b) of Annex III to the AI Act. However, at the end of 2025, the EU legislature proposed amendments to the AI Act, including with respect to the timelines for the application of the Regulation[21]. From the perspective of the analysis conducted, the key provision is the proposed amendment to Article 113 of the AI Act, which provides that:

1. Chapter III, Sections 1, 2, and 3 of the AI Act (which includes Article 6(2) of the AI Act), shall apply following the adoption of a decision of the Commission confirming that adequate measures in support of compliance with Chapter III are available, 6 months after the adoption of that decision as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III of the AI Act[22],
2. In the absence of the adoption of the decision within the meaning of subparagraph 1, or where the dates below are earlier than those that follow the adoption of that decision, Chapter III, Sections 1, 2, and 3, shall apply on 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III of the AI Act[23].

The aim of this article is to analyse provisions that, at present, are not yet in force or applicable. While there is a considerable body of academic literature addressing creditworthiness assessment, particularly under the currently applicable legal framework, there are relatively few studies that explicitly examine this issue in the context of artificial intelligence (or, more precisely, the use of AI systems). Understandably there is also a limited number of contributions referring to the Draft CCA2. The subject matter of this paper thus falls within a regulatory area that remains relatively underexplored in legal scholarship. Accordingly, the first part of the article will examine the key provisions of the Draft CCA2, which in the future will govern the obligations of creditors[24] granting consumer credits[25] related to creditworthiness assessment. To a significant extent, these provisions implement the CCD2 (by comparison, the CCD contained only very limited provisions concerning creditworthiness assessment[26]). At the same time, some of the proposed rules constitute solutions introduced by the Polish legislator that are not reflected in the CCD2 and often draw on provisions of the current CCA, in particular Article 9a thereof.

It should be positively assessed that, as a rule, all obligations relating to creditworthiness assessment provided for in the Draft CCA2 are intended to apply to all creditors, regardless of whether they are banks, lending institutions, or other categories of creditors. The current solution, under which additional obligations set out in Article 9a of the CCA apply only to lending institutions, lacks systemic justification[27]. Creditworthiness assessment is intended to prevent both excessive consumer indebtedness and credit risk for creditors, irrespective of their legal status[28]. However, in my view, it would be advisable to introduce somewhat greater facilitation for creditors granting so-called trade credits (e.g. deferred payment arrangements or instalment sales), in particular where such agreements do not involve additional costs for consumers (interest-free credit), of course to the extent that the Polish legislator introduces solutions in compliance with the CCD2. The Draft CCA2 provides for certain facilitations in this respect, although these remain rather limited[29].

Second, the article will analyse the provisions of the AI Act insofar as they relate to AI systems intended intended to be used to evaluate the creditworthiness of natural persons or establish their credit score. The AI Act imposes obligations on various actors within the AI value chain (e.g. providers[30], deployers[31], distributors[32], collectively referred to as the operators[33]). This article will be limited to an examination of the obligations imposed on deployers, as I assume that most creditors using AI (...)