Directive (EU) 2023/2225, the recast Consumer Credit Directive, was published in the Official Journal on October 30, 2023; member states had to transpose it by November 20, 2025 and its rules apply from November 20, 2026. Article 18 requires a thorough creditworthiness assessment and, where that assessment involves automated processing of personal data, gives the consumer the right to request and obtain human intervention from the creditor, a clear explanation of the assessment and of the logic and risks of the automated processing, and a review of the decision. Its recitals expressly tie this to the AI Act's classification of credit scoring as high-risk.
| Document | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions |
| Issued by | Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act |
| Type | Statute |
| Status | Final · applies from Nov 20, 2026 |
| Published | Oct 30, 2023 |
| Effective | Nov 20, 2026 |
| Applies to | Creditors and credit intermediaries offering consumer credit in the EU, as transposed by member states |
| Official source | eur-lex.europa.eu ↗ |
| Use cases | Credit scoring & underwriting · Fair lending & discrimination · Data & privacy |
What are the key points of Consumer Credit Directive (EU) 2023/2225?
- Art. 18: creditworthiness assessment must be based on relevant, sufficient and proportionate information on income, expenses and financial circumstances; credit granted only if the assessment indicates the obligations are likely to be met.
- Art. 18(8): where automated processing is used, the consumer may request human intervention, obtain a clear and comprehensible explanation of the assessment including the logic and risks of the automated processing, express a view and request a review.
- Art. 18(6): consumers must be informed when a refusal is based on automated processing; special-category data such as health or social-media data cannot be used for the assessment.
- Art. 6: no discrimination based on nationality, residence or Charter grounds when granting credit; Art. 8 bans unsolicited credit sales.
- Scope widened to buy-now-pay-later, loans under €200 and interest-free credit; caps on charges to be set nationally (Art. 31).
- Transposition deadline November 20, 2025; application from November 20, 2026 (Art. 48); repeals Directive 2008/48/EC.
What did Consumer Credit Directive (EU) 2023/2225 change for banks?
CCD2 is the first EU consumer-credit law drafted with AI scoring in mind: it converts GDPR-style rights into explicit lending-law duties — explanation of the logic, human review on request, a ban on social-media and health data — enforced by consumer and financial regulators rather than only data-protection authorities. It applies from November 20, 2026, a year before the AI Act's Annex III regime, so it is the nearer compliance date for EU retail lenders.
When does the new Consumer Credit Directive apply?
Member states had to transpose Directive (EU) 2023/2225 by November 20, 2025, and its measures apply from November 20, 2026.
What must a lender do if it uses AI to assess creditworthiness under CCD2?
Under Article 18 the consumer has the right to request human intervention, receive a clear and comprehensible explanation of the automated assessment including its logic and risks, express their point of view and obtain a review of the decision — and must be told when a refusal was based on automated processing.
| Date | Document | Status |
|---|---|---|
| Jul 24, 2026 | Regulation (EU) 2026/1744 (Digital Omnibus on AI) — Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) | In force |
| May 19, 2026 | Draft Commission guidelines on high-risk classification — Draft Commission Guidelines on the classification of high-risk AI systems under Article 6 of the AI Act | Proposed |
| Nov 21, 2025 | EBA factsheet on the AI Act — AI Act: implications for the EU banking and payments sector (EBA factsheet) | Final |
| Jul 10, 2025 | General-Purpose AI Code of Practice — General-Purpose AI Code of Practice under the AI Act (Transparency, Copyright, and Safety and Security chapters) | In force |
| Feb 4, 2025 | Commission guidelines on prohibited AI practices — Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act) | In force |
| Jul 12, 2024 | Regulation (EU) 2024/1689 — Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) | In force |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →