ACPR as AI market surveillance authority for credit and insurance from December 2027

What the AI Act provides¶

Two financial use cases appear in Annex III of Regulation (EU) 2024/1689. Point 5(b) covers systems intended to evaluate the creditworthiness of natural persons or establish their credit score, except systems used to detect financial fraud. Point 5(c) covers systems intended for risk assessment and pricing of natural persons in life and health insurance.

For these systems, Article 74(6) names the default market surveillance authority. Where the system is used by financial institutions regulated by Union financial services law, it is "the relevant national authority responsible for the financial supervision of those institutions," in so far as the use is directly connected with the provision of those financial services. Article 74(7) lets a Member State name another authority, provided coordination is ensured. Choosing the ACPR follows the logic of the Regulation.

The timetable is fixed. The Digital Omnibus moved the application of Chapter III, Sections 1 to 3, to 2 December 2027 for Annex III high-risk systems. The deployer obligations apply from the same date, including the Article 27 fundamental rights impact assessment (FRIA) for creditworthiness evaluation and life and health insurance pricing.

Where the French designation stands¶

The designation runs through the bill on various provisions adapting French law to EU law (DDADUE). Tabled in the Senate on 10 November 2025 under the accelerated procedure, it was adopted by the Senate at first reading on 18 February 2026 and sent to the National Assembly on 20 February 2026 (bill no. 2518).

In the Senate, the Government secured an amendment that sets the governance scheme: the CNIL becomes one of the competent authorities under Article 70 of the AI Act and the market surveillance authority for several Annex III categories. The amendment's explanatory statement says that systems used by financial institutions to assess the creditworthiness, risk, or pricing of natural persons fall within the ACPR's remit.

In the release for its algorithmic-fairness consultation, updated on 24 September 2026, the ACPR writes that under the DDADUE bill, which Parliament is examining, it would be designated market surveillance authority for high-risk use cases linked to financial services, and that its new tasks would start on 2 December 2027. As of 2 October 2026 the bill has not been finally adopted. Treat the designation as proposed; the AI Act applies directly whichever authority is finally named.

What the ACPR has said about its method¶

At its market meeting of 1 July 2026, the ACPR presented its roadmap on the working assumption that it will be designated. Three points matter to compliance and risk teams.

Two sources of competence. The ACPR draws its AI supervision powers from the AI Act, for cases 5(b) and 5(c), and from existing sectoral rules, for every AI system that carries prudential or conduct risk, including customer protection and AML-CFT. Under technology neutrality it already holds those powers, "even if in practice it does not use them yet," in the words of its slides. An AI agent that triages AML alerts is outside Annex III and remains within supervision.

Four priority areas. Performance and robustness, explainability, fairness, and cybersecurity and privacy. These are the axes of an AI audit methodology the ACPR says it wants to build with the sector and presents as intended to become a reference framework over time.

A two-part roadmap. Design proportionate supervision (information collection, risk scoring, prioritisation, internal organisation), and help institutions build the human and technical capacity to prove that the requirements are met.

The algorithmic-fairness consultation¶

On 1 July 2026 the ACPR published a discussion paper, "L'équité algorithmique dans le secteur financier" (algorithmic fairness in the financial sector), and opened a public consultation until 30 September 2026. The question is how to reconcile risk-based differentiated pricing with preventing unfair or discriminatory treatment, in particular treatment linked to sensitive personal characteristics. The scope refers to the two high-risk use cases: credit, and life and health insurance.

The paper covers the applicable legal framework, fairness concepts and metrics, methods to identify, measure, and correct bias, and ways to build these into institutions' practice. It draws on technical workshops with volunteer institutions. The ACPR states that it is not an official ACPR position.

For an institution the consequence is concrete. Fairness will be one of the four supervisory axes, and the consultation supplies the vocabulary the questions will use: which definition of fairness the institution applies to each model, which metrics it tracks, how it handles variables correlated with sensitive characteristics, and what record it keeps of the trade-offs.

The CNIL and CIANum note on agentic AI¶

On 20 July 2026 the CNIL and the Conseil de l'IA et du Numérique published an exploratory note, "IA agentique et protection des données personnelles : équation à inconnues multiples pour les utilisateurs" (agentic AI and personal data protection). It creates no new obligation. It describes how the move to agents strains GDPR principles and notes that the AI Act contains no rules specific to AI agents.

Several findings bear directly on banks. Persistent agent memory supports very precise user profiles; data flows across services make responsibility harder to assign; and the opacity of these architectures increases the risks of automated decisions, with regulated sectors such as finance named as examples. Among the suggested paths are stronger transparency rules on agent actions, mandatory human validation for the most critical decisions, and, by design, compartmentalised agent memory, execution in isolated environments, and an emergency stop button.

An institution that hands part of a credit or underwriting journey to an agent sits where the two regimes meet: the ACPR for the high-risk system and conduct, the CNIL for personal data. The note shows the questions the CNIL will ask, and they overlap with the ACPR's on traceability and human control.

Preparing the evidence for an examination¶

The ACPR has not yet published its audit methodology. Its four priority areas and its 2020 criteria (data management, performance, stability, explainability) are enough to start preparing evidence now. The table is a practical reading; it does not reproduce a published requirement.

What we learned about evidence exports¶

While preparing a demo in July 2026, we generated a sealed evidence bundle from our own test environments. The export finished as "completed with omissions": two security events from a non-authoritative source were missing, and the export flagged them as a warning. That is the right behaviour: an evidence bundle should state what it does not contain. An examiner who finds an undeclared gap stops trusting the rest of the file.

For a bank preparing for an ACPR examination, the rule applies beyond any tool. The system inventory, the validations, and the decision logs should each state their scope and their exclusions, with the reason for each.

Timeline¶

The dates known as of 2 October 2026.

What to do before December 2027¶

Four workstreams. List the systems that fall under points 5(b) and 5(c), including those supplied by third parties and credit functions embedded in wider journeys. For each, prepare the Article 27 FRIA and the evidence for the four priority areas. Document a fairness definition and metrics per model, using the ACPR discussion paper. For agents, record each proposed action, the rule applied, and the human decision where one is required, so that a decision can be replayed for an examiner.

For steps of a journey handed to an agent, a runtime checkpoint evaluates each action before it executes and produces those records. KLA Control Plane implements this pattern with four outcomes (allow, warn, require_approval, block) and one record per decision. The deployer duties are set out in the FRIA template and the worked credit-scoring FRIA.