Activities / What code does / Makes high-risk automated decisions

Makes credit decisions

credit_decisions

Your app makes or scores decisions about a person's credit, a loan or another financial service offered to them.

scope code
in the registry since 1.4
7 laws in 6 jurisdictions name it

What triggers it

The lint's definition. It makes or scores decisions about a person's credit, a loan or another financial service offered to them: creditworthiness, a credit score, a limit or its price. Fraud detection alone is not this.

This covers a credit-scoring model, an automated loan approval and a system that sets a credit limit or a rate, whoever runs it, a lender or its vendor.

It implies Makes high-risk automated decisions, so the rules written for every such decision reach it too.

What does not

A model used only to detect fraud does not count.

Often confused with Is a lender and Makes high-risk automated decisions.

The law it brings into scope

The kinds of law that name this activity in the LexLint law library, with the number of laws and jurisdictions in each, as of 19 Oct 2026. The examples are chosen by rule, laws in force first and the widest jurisdiction first; each section's page lists every law.

Area of law	Laws	Jurisdictions
AI law Tell people when they are dealing with an AI system or its output, and control the uses the law calls high-risk. Võlaõigusseadus Section 55^2, Explanations to Consumers and Human Intervention in Online Financial Services Estonia Consumer Protection Standards: reasons for rejecting an application or reducing credit, and complaint decisions United Arab Emirates CCPA Automated Decisionmaking Technology Regulations California	5	5
Privacy law Have a legal basis for personal data, honor people's rights over it, and report a breach. Ley N° 6534/2020, de Protección de Datos Personales Crediticios Paraguay Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)) European Union from 20 Nov 2026, in 4 weeks	2	2

Area of law

Laws

Jurisdictions

AI law

Tell people when they are dealing with an AI system or its output, and control the uses the law calls high-risk.

Privacy law

Have a legal basis for personal data, honor people's rights over it, and report a breach.

Ley N° 6534/2020, de Protección de Datos Personales Crediticios Paraguay
Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)) European Union from 20 Nov 2026, in 4 weeks

This activity implies Makes high-risk automated decisions, so every law that names that activity reaches it too. These areas of law reach it only that way:

Cybersecurity law: 91 laws in 67 jurisdictions, through Makes high-risk automated decisions
Build software securely, handle reported flaws, and report incidents on a deadline.
Product and AI liability law: 24 laws in 22 jurisdictions, through Makes high-risk automated decisions
Answer in damages when defective software or an AI system causes harm.

The law written for credit decisions

Every law in the LexLint law library written for credit decisions, by jurisdiction, each country before its states and cities, as of 19 Oct 2026. The domain tags are our reading of each law's scope, not the publisher's.

Jurisdiction	Law
European Union	AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) from 2 Dec 2027, in 13 months Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)) from 20 Nov 2026, in 4 weeks
Estonia	Võlaõigusseadus Section 55^2, Explanations to Consumers and Human Intervention in Online Financial Services
Paraguay	Ley N° 6534/2020, de Protección de Datos Personales Crediticios
United Arab Emirates	Consumer Protection Standards: reasons for rejecting an application or reducing credit, and complaint decisions
California	CCPA Automated Decisionmaking Technology Regulations
Colorado	SB 26-189 (2026), Automated Decision-Making Technology Act from 1 Jan 2027, in 2 months

Every law that names Makes high-risk automated decisions reaches credit decisions too, because it covers automated decisions of every kind: 587 laws in 204 jurisdictions. 198 of those jurisdictions have no law written for credit decisions.

Counterparties that usually come with it

a credit bureau
the vendor of a scoring model

A component that cannot run as documented without one of these names it in its ACTIVITIES.md under talks_to, with required: true. That party's jurisdiction then joins the run of every product that uses the component, and the finding says why it is there. A default the deployer can change is asked about, never added. Talking to a party never makes a product that party.

In a declaration

A library or framework that makes this possible enables it; an application whose shipped code does it performs it.

For a library

activities: - id: credit_decisions mentioned: enables enabled: requires_configuration where: [<the module that carries it>] note: <one sentence>

For an application

activities: - id: credit_decisions mentioned: performs enabled: by_default where: [<the module that carries it>] note: <one sentence: what it does, and the kind of law it attracts>

History

In the registry since version 1.4, 16 Oct 2026.

Added for AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) (European Union) from 2 Dec 2027, in 13 months, the law that turns on it.

In the glossary: Makes credit decisions.

The activity registry is LexLint's open list; this page's text is licensed under Creative Commons Attribution 4.0.