New consumer credit act: what applies to AI in credit assessments?

On November 20, 2026, a new Consumer Credit Act will enter into force in Sweden. The Riksdag decided on it on May 27, 2026, and it implements the EU's second Consumer Credit Directive, Directive (EU) 2023/2225.[1][2]

For those who use or plan to use AI in the credit process, the law is interesting for a specific reason. It contains explicit rules for what applies when credit assessments are based on automated processing of data. It addresses what data may be used, what the consumer is entitled to have explained, and when human intervention is required.

Please note: The article provides an overview and does not constitute legal advice. Regulations and guidance change. Last fact-checked on September 17, 2026.

What changes on November 20, 2026

More credits covered

Protection is extended to more forms of credit, including certain interest-free installment solutions provided by third parties. Companies that were previously outside the scope of the Consumer Credit Act may therefore be covered by the rules starting this autumn.[2]

Stricter credit assessments

The credit assessment must be made in the consumer's interest, and clearer rules are introduced regarding what data must be considered when assessing creditworthiness. The law also contains provisions on interest and cost caps, marketing, a strengthened right of withdrawal, and what the creditor must do when a consumer experiences payment difficulties.[1][2]

Authorization, knowledge, and competence

More actors offering or mediating credit will become subject to authorization and supervision, with requirements for knowledge and competence among staff. Finansinspektionen (the Swedish Financial Supervisory Authority) has sent out proposed regulations for consultation, specifying, among other things, what data must be collected and verified during credit assessments, how authorization is applied for, and what competence requirements apply. FI proposes that the regulations enter into force on the same day as the law, November 20, 2026.[3]

When the credit assessment is automated

The directive, and thus Swedish law, places specific requirements on credit assessments based on automated processing. The consumer has the right to:

• request that a human at the creditor reviews the assessment,

• obtain a meaningful explanation of how the assessment was made, including the main variables and logic used, and the risks associated with the processing,

• express their point of view and request that the assessment and decision be re-evaluated,

• be informed of these rights.[4]

There are also limits on the data basis. Special categories of personal data under Article 9 of the General Data Protection Regulation may not be used in the credit assessment, nor may data obtained from social networks. The assessment must be based on necessary and proportionate data on financial circumstances, such as income, expenses, and existing commitments.[4]

If an offer or a price is personalized to an individual consumer using automated processing of personal data, the consumer must be informed of this.[4]

What happens to company data when you use AI?

Three regulatory frameworks meet in the same process

A credit assessment supported by AI is affected by three regulatory frameworks simultaneously, and they answer different questions.

The Consumer Credit Act regulates the credit assessment itself: what is to be assessed, what data may be used, and what rights the consumer has when the processing is automated.

The General Data Protection Regulation (GDPR) regulates the processing of personal data. Article 22 applies to decisions based solely on automated processing which produce legal effects or similarly significantly affect the data subject. A credit assessment may fall under this provision, in which case specific conditions and safeguards apply.[5]

The AI Act regulates the system. AI systems intended to be used to evaluate creditworthiness or establish credit scores for natural persons are classified as high-risk under Annex III, with the exception of systems used for detecting financial fraud. Following the amendment by the digital omnibus regulation, the requirements for this type of high-risk system will start to apply on December 2, 2027.[6][7]

The timeline is therefore as follows: requirements on credit assessment apply from November 20, 2026, while the requirements on the AI system itself start to apply just over a year later. A system being built now will be subject to both.

AI Act, NIS2, DORA and GDPR – which requirements affect your AI solution?

What this means in practice for a creditor

The right to a meaningful explanation is the requirement that places the highest demands on the technical solution. To be able to explain an individual assessment afterward, the organization needs to be able to answer four questions for each decision:

1. Which version of the model, rules, and prompts was used at the time?

2. What data formed the basis of the assessment, and where did it come from?

3. Which variables had the greatest impact on the outcome?

4. Who reviewed it, and what was changed during the review?

This requires version control and logging built for the purpose, not subsequent reconstruction. At the same time, logs must be handled in accordance with data protection rules, including deletion and access control.

Human review also needs to be real. The reviewer must have the authority to change the decision, sufficient competence to understand the underlying data, and time to do so. A confirmation button in an interface does not constitute a review.

A third area is data sources. Since data from social networks and sensitive personal data must not be included in the credit assessment, you need to know exactly which sources reach the model, even indirectly via third-party data or enrichment.

Role-based AI with Microsoft Entra ID – how access works

Where AI can be useful without becoming a high-risk issue

Not all AI applications in a credit business constitute credit assessment. Summarizing incoming documentation, searching internal documentation, supporting customer service on questions regarding terms and right of withdrawal, drafting standard letters, and quality assuring internal routines are examples of use cases that do not in themselves mean the system is evaluating someone's creditworthiness.

Nevertheless, the boundary must be drawn on a use-case-by-use-case basis, and it needs to be documented. A system that in practice influences the outcome of the assessment is part of the assessment, regardless of what it is called internally. The AI Act has exemptions for systems that only perform narrow procedural tasks, but anyone claiming an exemption must be able to demonstrate the basis for their assessment.[6]

Checklist before November 20

1. Check if your business is covered by the extended scope and if authorization is required.

2. Map where automated processing currently occurs in the credit process, including rule engines and scoring models not referred to as AI.

3. Review your data sources and ensure that sensitive personal data and data from social networks are not included in the assessment data.

4. Build or verify your logging so that an individual assessment can be explained afterward.

5. Describe the routine for human review: who, what authority, what competence, and within what timeframe.

6. Draft the texts informing consumers of their right to an explanation, re-evaluation, and human review.

7. Review the competence requirements for relevant staff and complement their training.

8. Document the assessment of whether your AI systems might be classified as high-risk under Annex III, ahead of December 2, 2027.

Follow FI's regulatory work

At the time of writing this article, the regulations specifying the credit assessment were out for consultation and not yet finalized. Check Finansinspektionen’s decided regulations before establishing internal routines, and keep track of Konsumentverket’s (the Swedish Consumer Agency) guidance for marketing and information.[3]

From idea to pilot: what are PoC, prototype, and pilot?

Read more about security in the Violet AI Platform

Sources

1. Swedish Riksdag, A new Consumer Credit Act (report 2025/26:CU26): https://www.riksdagen.se/sv/dokument-och-lagar/dokument/betankande/en-ny-konsumentkreditlag_hd01cu26/

2. The Government, New Consumer Credit Act for strengthened consumer protection: https://www.regeringen.se/pressmeddelanden/2026/01/ny-konsumentkreditlag-for-starkt-konsumentskydd/

3. Finansinspektionen, FI proposes new regulations and general guidelines on credit in consumer relations: https://www.fi.se/sv/publicerat/nyheter/2026/fi-foreslar-nya-foreskrifter-och-allmanna-rad-om-krediter-i-konsumentforhallanden/

4. Directive (EU) 2023/2225 on credit agreements for consumers, EUR-Lex: https://eur-lex.europa.eu/eli/dir/2023/2225/oj/swe

5. Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj/swe

6. Regulation (EU) 2024/1689 (AI Act), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/swe

7. Regulation (EU) 2026/1744 (digital omnibus regulation on AI), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2026/1744/oj/swe