Sweden's credit reporting agencies face AI Act assessments from December 2027

The register and the agencies

The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) publishes a list of entities that hold a credit reporting licence under the Swedish Credit Information Act ^[1]. The register is updated as licences are granted or withdrawn. At the time of writing, three agencies hold licences for nationwide credit reporting on all Swedish residents over 15 years old: UC AB, Bisnode Business Information Group AB, and Creditsafe Sverige AB ^[1].

These agencies collect and process data on payment behaviour, creditworthiness and solvency, and provide that information to lenders, insurers and other parties making decisions about individuals ^[1]. The scope of their data and the decisions influenced by their reports put them in a position where the use of AI can have significant consequences for the people in their files.

When credit assessment becomes high-risk AI

The AI Act lists the evaluation of creditworthiness of natural persons as a high-risk use case ^[2]. That classification applies when an AI system is used to assess or score the creditworthiness of individuals, with limited exceptions. The exceptions cover AI intended solely to detect financial fraud, and systems used to assess creditworthiness in relation to a person acting in a professional or business capacity ^[2].

For systems falling within the high-risk definition, the obligations are substantial. Providers must implement risk management procedures, data governance, technical documentation, automatic logging of events, human oversight and quality management ^[2]. They must also undergo a conformity assessment before placing the system on the market ^[2]. For deployers—the organisations that put high-risk AI into use—Article 27 adds another layer.

The fundamental rights impact assessment

Article 27 of the AI Act requires certain deployers to carry out a fundamental rights impact assessment before using a high-risk system ^[3]. The requirement applies to public authorities, to private entities providing public services, and to anyone using AI for the credit assessment of natural persons or the pricing of life and health insurance ^[3].

The assessment must identify the specific risks the system may pose to fundamental rights, describe the measures in place to address those risks, and explain how the deployer will monitor outcomes ^[3]. The assessment is not a one-off. It must be updated when the use of the system changes in a way that might alter the risk profile ^[3].

These requirements take effect on 2 December 2027, the date by which high-risk obligations under Annex III apply ^[4]. Credit reporting agencies that use AI to assess individuals will need to prepare their processes well in advance of that date.

The evidence question behind the logs

Logging is part of the high-risk toolkit. Article 12 of the AI Act states that high-risk systems shall technically allow for the automatic recording of events over the system's lifetime ^[2]. That means keeping a record of what the system did, and when.

The AI Act does not prescribe how logs must be protected. It says what to log, not how to secure it. The question of evidential value is a separate one. If a log can be quietly edited by whoever keeps it, its usefulness in a dispute or an audit is limited. A change that nobody outside the organisation can detect is a change that nobody outside the organisation can rule out.

A digital witness addresses that gap. It creates an independent fingerprint of the log at the time of sealing. If the content changes later, the fingerprint will no longer match. The record cannot be altered in silence, because the alteration shows. That does not make the log infallible—it does not prove the underlying data are accurate—but it does make tampering visible, even when carried out by someone with full access to the system.

What this means for you

If you run or advise a credit reporting agency in Sweden, these questions are worth asking now:

• Does your agency use AI to assess the creditworthiness of natural persons? If so, are the exceptions in Annex III applicable, or does the system fall within the high-risk category?
• If the system is high-risk, who in your organisation will be responsible for the fundamental rights impact assessment, and when will the work begin?
• How do you currently log decisions and events in your AI systems? Could you show a supervisor or an auditor that those logs have not been changed since the events they record?
• Have you mapped the other high-risk requirements—risk management, data governance, human oversight, conformity assessment—against your current processes?

These are not distant concerns. The deadline is fixed, and the work takes time.

What to watch

Two dates matter here. The first is 2 August 2027, when the general transparency requirements of the AI Act come into force ^[4]. That includes the obligation to inform people when they are interacting with an AI system, unless it is obvious from the circumstances ^[4]. The second is 2 December 2027, when the high-risk requirements under Annex III apply ^[4].

IMY's register will continue to reflect changes in the licensed population. New licences may be granted, existing ones may be amended or withdrawn. The register is public, and checking it is straightforward ^[1]. If your work touches credit reporting, it is worth keeping an eye on who holds a licence and what their AI does with it.