The AI Act wants debt collectors to log decisions, not prove them

What the AI Act asks for

Debt collection agencies keep asking what the AI Act actually wants from them. The short version is this: if you use AI to assess creditworthiness or take decisions about payment capacity for private individuals, you are likely running a high-risk AI system under Annex III ^[1]. From 2 December 2027, that means automatic logging under Article 12, risk management, technical documentation and a conformity assessment before you put the system on the market ^[2].

Article 12 says the system must technically allow for the automatic recording of events over its lifetime, for traceability and monitoring ^[3]. It tells you what to log. It does not say how to protect the logs.

Think of it like a black box on an aeroplane: it records what happened, but the law does not say how you prove nobody rewrote the tape.

What people can already ask for

If a decision is made solely through automated processing and has legal or similarly significant effects on someone, GDPR Article 22 already gives them the right to human intervention, to express their views and to contest the decision ^[4]. That has been in force since May 2018. It applies to decisions about credit, debt collection and similar cases where the outcome matters to the person's legal position or financial situation.

Article 86 of the AI Act adds a new layer from 2 December 2027: people affected by high-risk AI decisions under Annex III have the right to a clear explanation of the AI system's role and the main elements of the decision ^[5]. For a debt collector, that could mean explaining which model was used, what inputs it considered and how the score influenced the decision to pursue payment.

The gap between logging and proving

The tricky bit comes months later. Someone contests a decision. They want to know what it was based on. You pull up the log.

The question is whether anyone will believe it.

A log your own organisation can quietly edit is easier to challenge than one you can prove has not changed. Article 12 tells you what to log, not how to protect it, but the evidential value matters when someone asks to see it. If the person contesting the decision has a screenshot or a letter and your log says something different, whose version holds up?

That is where the logging duty meets the evidence question. You need the log to comply with Article 12 and to answer requests under Article 86. Whether it holds up as evidence is another matter.

What this means for you

If you run a debt collection agency or a credit assessment service using AI, here are three questions to ask now:

1. Which of your systems fall under Annex III as high-risk, and when do the logging requirements apply to them?
2. What exactly are you logging, and how long are you keeping it? Article 19 says providers must keep logs for at least six months, and Article 26 says the same for deployers, unless another law requires more ^[6].
3. If someone disputes a decision in a year's time, can you show that the log record you produce is the one written on the day, unchanged?

The first two are compliance questions. The third is an evidence question, and it is worth sorting out before the first dispute lands.

How a digital witness fits here

This is a case where a digital witness fits well. The thing to seal is each decision record as it is written to the log: the debtor reference, the model version, the score, the decision and the reviewer. Sealing takes a fingerprint of the record, not the record itself, so the data never leaves your systems.

You seal it when the decision is recorded. Later, if it is challenged, anyone you share the record with can check the fingerprint and see that it is exactly what was written at that time. Auditors, supervisors, the person affected and, if it comes to it, a court can all do the check.

What it shows is that the record has not changed since it was sealed. What it doesn't show is that the decision was right, fair or lawful, or that the log is complete. It doesn't replace your compliance work. It gives you a way to prove the log you are required to keep is the log you actually kept.

You start by calling WitniumChain through the REST API, the SDK or the MCP server, which sends the fingerprint and gets a witness ID back. The content stays with you. The first 2,000 witnesses a month are free. Read the docs to see how it works in practice.

How it would work

1. Your system writes a decision record and calculates its fingerprint.
2. The fingerprint is sealed, and you store the witness ID with the record.
3. When the record is questioned, you calculate the fingerprint again and check it against the sealed one. If it matches, nothing has changed.

What to watch

2 December 2027 is the date when high-risk requirements for Annex III systems apply ^[1]. That includes the logging duty in Article 12, the explanation right in Article 86 and the deployer's duties in Chapter V. The same date applies to general-purpose AI models with systemic risk, but that is a separate question.

For Annex I systems, the corresponding date is 2 August 2028 ^[2]. Annex I covers safety components in products like machinery and medical devices, so if your AI is embedded in such a product the timeline is different.

Keep an eye on guidance from the AI Office and your national supervisory authority. In Sweden, that is IMY for most AI matters and FI for financial services ^[7]. They will publish more detail as the deadline approaches, and the conformity assessment procedures for high-risk systems are still being worked out.

Sources

1. Article 6(2) and Annex III of Regulation (EU) 2024/1689 (AI Act), European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6, accessed 9 January 2025.
2. Timeline for implementation of the EU AI Act, European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act, accessed 9 January 2025.
3. Article 12 of Regulation (EU) 2024/1689 (AI Act), European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12, accessed 9 January 2025.
4. Article 22 of Regulation (EU) 2016/679 (GDPR), EUR-Lex, https://eur-lex.europa.eu/eli/reg/2016/679/oj, accessed 9 January 2025.
5. Article 86 of Regulation (EU) 2024/1689 (AI Act), EUR-Lex, https://eur-lex.europa.eu/eli/reg/2024/1689/oj, accessed 9 January 2025.
6. Article 19 and Article 26(6) of Regulation (EU) 2024/1689 (AI Act), European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-19, accessed 9 January 2025.
7. The Swedish Authority for Privacy Protection (IMY) and the Swedish Financial Supervisory Authority (Finansinspektionen, FI) are the supervisory authorities for the AI Act in their respective areas, according to the government's implementation proposal, Regeringen, https://www.regeringen.se/, accessed 9 January 2025.