Beyond the AI Act, three pieces of EU legislation govern how banks use AI. GDPR Article 22 (applicable since May 25, 2018) limits decisions based solely on automated processing, such as automated credit refusals, and gives people the right to human intervention and to contest the decision. The recast Consumer Credit Directive (EU) 2023/2225 applies from November 20, 2026 and gives consumers whose creditworthiness is assessed with automated processing the right to human intervention, an explanation of the logic and a review. DORA (Regulation (EU) 2022/2554, applicable since January 17, 2025) treats AI systems and AI vendors as ICT assets and services under its risk-management, incident-reporting and third-party rules. None of them has a single EU enforcer: data protection authorities, national consumer-credit authorities and banks' financial supervisors apply them.
| Full name | European Union — EU legislation outside the AI Act that governs bank AI (GDPR, the Consumer Credit Directive, DORA), adopted by the European Parliament and Council on a European Commission proposal and enforced by national data protection authorities (GDPR, coordinated by the European Data Protection Board), the national competent authorities each member state designates (Consumer Credit Directive), and banks' financial supervisors — the ECB for significant institutions and national competent authorities — with the EBA, EIOPA and ESMA overseeing critical ICT third-party providers (DORA) |
| Role | EU legislation whose data-protection, consumer-credit and operational-resilience rules apply to bank AI alongside the AI Act, each enforced by national authorities rather than a single EU AI regulator |
| Force on banks | Binding law |
| Applies to | Banks, lenders, payment institutions and other financial entities operating in the EU, and any controller processing personal data of people in the EU: GDPR Article 22 for solely automated decisions, the recast Consumer Credit Directive for automated creditworthiness assessments of consumers, and DORA for the ICT risk of AI systems and AI vendors |
| Key document | Consumer Credit Directive (EU) 2023/2225, Article 18 (applies from Nov 20, 2026) — the first EU rule written for automated creditworthiness assessment outside the AI Act |
| Latest move | Nov 20, 2026: the recast Consumer Credit Directive's rules, including the right to human intervention and an explanation for automated creditworthiness assessments, apply in member states that transposed it by the November 20, 2025 deadline |
| Documents tracked | 3 · all documents → |
These instruments predate or sit beside the AI Act and do not mention AI by name in their operative articles, but each reaches the decisions banks most often automate. GDPR Article 22 and the transparency duties in Articles 13-15 cover any solely automated decision with legal or similarly significant effects, which the European Data Protection Board and the Court of Justice treat as including credit scoring that a lender relies on. The Consumer Credit Directive's Article 18 adds a sector-specific right for consumer borrowers, and its recitals tie it to the AI Act's classification of credit scoring as high-risk.
DORA is the operational side. Because AI models, platforms and cloud services bought from vendors are 'ICT services', a bank's AI estate falls under DORA's ICT risk management framework, major-incident reporting, resilience testing and third-party rules, including the register of information and exit strategies. The European Supervisory Authorities designate and oversee critical ICT third-party providers; their first list of 19, published on November 18, 2025, includes the large cloud providers that host banks' AI workloads but no stand-alone AI model developer.
What has the European Union actually published on AI?
| Date | Document | Status |
|---|---|---|
| Oct 30, 2023 | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions | Final · applies from Nov 20, 2026 |
| Dec 27, 2022 | DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA) | In force |
| May 4, 2016 | GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling | In force |
| Date | Type | Document / event |
|---|---|---|
| Nov 18, 2025 | Milestone | ESAs designate the first critical ICT third-party providers under DORA. The EBA, EIOPA and ESMA published the first list of 19 critical ICT third-party providers subject to EU oversight under DORA, including major cloud providers that host banks' AI workloads. source ↗ |
| Oct 30, 2023 | Statute | Consumer Credit Directive (EU) 2023/2225 — Directive (EU) 2023/2225 on credit agreements for consumers (CCD2) — automated creditworthiness assessment provisions. Directive (EU) 2023/2225, the recast Consumer Credit Directive, was published in the Official Journal on October 30, 2023; member states had to transpose it by November 20, 2025 and its rules apply from November 20, 2026. source ↗ |
| Dec 27, 2022 | Regulation | DORA (Regulation (EU) 2022/2554) — Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act, DORA). Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA), was adopted on 14 December 2022, published in the Official Journal on 27 December 2022 and has applied since 17 January 2025 (Article 64). source ↗ |
| May 4, 2016 | Statute | GDPR Article 22 — Regulation (EU) 2016/679 (GDPR), Article 22 — Automated individual decision-making, including profiling. Article 22 of the General Data Protection Regulation (Regulation (EU) 2016/679, applicable since May 25, 2018) gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects — with automated credit refusal the textbook example. source ↗ |
- Consumer Credit Directive 2023/2225 rules — including the right to human intervention in automated creditworthiness assessments — applying from November 20, 2026, and which member states transposed late
- How data protection authorities apply GDPR Article 22 to AI credit scoring alongside the AI Act's high-risk duties from December 2, 2027
- DORA oversight of critical ICT third-party providers and whether a later designation list adds AI model providers
Which EU laws apply to bank AI besides the AI Act?
Three matter most: GDPR Article 22 on solely automated decisions (since May 25, 2018), the recast Consumer Credit Directive (EU) 2023/2225 on automated creditworthiness assessments (from November 20, 2026), and DORA, Regulation (EU) 2022/2554, on ICT risk including AI systems and AI vendors (since January 17, 2025).
Who enforces these EU rules at a bank?
Not one body. National data protection authorities enforce GDPR, coordinated by the European Data Protection Board; the authorities each member state designates enforce its transposition of the Consumer Credit Directive; and banks' financial supervisors (the ECB for significant institutions, national competent authorities for the rest) supervise DORA, with the EBA, EIOPA and ESMA overseeing critical ICT third-party providers.
Follow every move these regulators make
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning