AI financial fraud detection: the Annex III carve-out

Short answer: The AI Act classifies creditworthiness assessment as high-risk, but Annex III point 5(b) makes one explicit exception: AI systems used to detect financial fraud do not fall within that high-risk category. The carve-out is deliberately narrow. It covers fraud detection, not credit assessment presented as fraud detection. The GDPR and sound governance continue to apply in full.

What the carve-out actually says

Annex III, point 5 classifies AI for creditworthiness assessment and credit scoring as high-risk. Immediately after comes the exception: this does not apply to AI systems used to detect financial fraud. The reasoning is that fraud detection protects the consumer and makes the financial system resilient, whereas credit scoring decides on access to services. See also AI in credit scoring, where the main regime does apply.

Why the carve-out is narrow

The exception cannot be used to lift a credit-decision system out of the regime by calling it "fraud detection". What matters is the actual function and the effect on the data subject. A system that in practice decides whether someone gets credit remains high-risk — even if it contains a fraud-risk component. A system that flags anomalous transactions or identity fraud falls under the carve-out. A mixed system must therefore be dissected at function level.

What still applies without high-risk status

Being carved out of Annex III does not mean unregulated. Fraud detection processes personal data and falls fully under the GDPR: legal basis, purpose limitation, data minimisation and transparency. Where the system leads to decisions with significant effects (such as blocking an account) on a purely automated basis, GDPR Article 22 is engaged. In addition, the general AI Act provisions not tied to high-risk apply, as do the sectoral requirements for financial institutions, including operational resilience under DORA.

What to do

• Test the real function: does the system detect fraud, or does it effectively decide on credit? Document that analysis.
• Dissect mixed systems at component level and classify each part separately.
• Stay GDPR compliant: arrange legal basis, purpose limitation and human intervention for intrusive automated decisions.
• Keep governance in place: include carved-out systems in your AI governance framework too.
• Ensure explainability: a wrongful fraud flag hits the customer hard; provide remediation and appeal routes.

The fraud carve-out is real but tight. Stretching it to credit decisions slides you into the high-risk regime without a conformity assessment.