Helios Credit Group: Sequencing EU AI Act Obligations Against a Live Product Roadmap
Helios Credit Group provides consumer lending in three EU member states and the US. Four systems are in question. First, a creditworthiness scoring model for unsecured loans in the EU, using application and bureau data, with limited human review for low-value loans. Second, a recruitment tool used by Helios HR to screen CVs and, in a pilot, to analyse candidate video interviews for 'engagement and composure'. Third, a US-only customer service chatbot that answers questions about balances and payments. Fourth, a foundation model licensed from a US provider and embedded inside the scoring pipeline for feature summarisation, with the vendor refusing to share training data details. Legal has asked for a defensible position by the next board meeting and wants to know what must change this quarter versus what can be planned. Helios has no quality management system for AI and no EU-registered conformity documentation.
1. Classify each of the four systems under the EU AI Act and identify what must change immediately rather than later.
Read the worked answer
1. Creditworthiness scoring (EU): high-risk under Annex III, which covers AI used to evaluate the creditworthiness of natural persons. The limited human review for low-value loans weakens the human-oversight position. This is a planning item with a long lead time, not a this-week fix.
2. Recruitment CV screening (EU): high-risk under Annex III, which covers employment and worker-management uses including candidate selection. The video component is the urgent issue: AI inferring emotions in a recruitment or workplace context falls within the prohibited practices, which have applied since February 2025. Stop the video pilot now, before the board meeting, and document the decision. A prohibited practice is not a risk to be managed with controls.
3. US-only chatbot: outside the EU AI Act's territorial scope. US exposure is primarily FTC Act Section 5 deceptive-practice risk and emerging state AI disclosure law; the practical control is clear disclosure that the user is interacting with AI and accurate escalation paths. Do not spend EU compliance effort here.
4. Third-party foundation model in the scoring pipeline: the Act's value-chain logic means Helios, as deployer and as a party putting the system into service under its own name, carries obligations that do not disappear because a vendor is uncooperative. Vendor refusal to provide technical documentation is itself a procurement and contractual risk, and possibly a blocker to placing the system on the market.
Immediate: stop the emotion-inference pilot; freeze any expansion of the scoring model's scope; open vendor discussions. Planned: classification register, gap assessment, quality management system, technical documentation, logging, human oversight designed for the low-value loan path.
2. Build a two-quarter sequencing plan. What has to be true before Helios can credibly claim readiness, and where are the schedule risks?
Read the worked answer
Quarter 1 - contain and baseline.
- Stop the video-emotion pilot; record the decision and notify HR and the vendor.
- Complete an AI system inventory with classification decisions per system and per jurisdiction, signed off by legal and the second line. This is the artefact the board actually needs.
- Contract remediation on the foundation model: require the provider's technical documentation, intended-purpose statement, known limitations, evaluation results and incident notification. If it is unavailable, escalate to a build-or-switch decision on feature summarisation.
- Gap assessment against the high-risk requirements for the scoring model: risk management system, data governance, technical documentation, record-keeping, transparency and instructions for use, human oversight, accuracy/robustness/cybersecurity.
Quarter 2 - build the evidence machine.
- Establish a quality management system covering the high-risk systems, with document control and review cadence.
- Design and test human oversight on the low-value loan path: the reviewer must have the information and authority to override, and override rates should be monitored. A nominal reviewer with no time to review is not oversight.
- Implement logging and post-market monitoring, and define serious-incident reporting routes and timelines.
- Prepare registration and conformity assessment planning, including whether an internal-control assessment route is available for this Annex III use or a notified body is required. Confirm this with counsel; it turns on whether harmonised standards were applied.
Readiness is credible when documentation, logs and oversight evidence exist for the live system, not when a policy is signed.
Schedule risks: high-risk obligations under Annex III are scheduled for August 2026, but the Act is subject to amendment proposals - do not design to a date that may move, design to the obligations. Notified-body capacity is constrained. Vendor documentation may never arrive. HR may resist losing the video tool.
3. How do you use governance tooling to evidence compliance, and where must you warn the client not to over-trust it?
Read the worked answer
Where tooling earns its place:
- A single classified inventory of AI systems with jurisdiction, role (provider or deployer), risk class and accountable owner. Classification is a legal judgement, but it must be recorded against the system record and versioned.
- Factsheets per system capturing intended purpose, data, model lineage, evaluation results, limitations and the human-oversight design - the traceable backbone of the technical documentation.
- Control mapping from obligations to controls to evidence, so that the gap assessment is a living register rather than a one-off spreadsheet.
- Workflow and audit trail for approvals, changes and reviews, with timestamps and named approvers.
- Monitoring evidence attached to the same record: performance, drift, fairness and override rates on the human-oversight path.
Where to warn against over-trust: a control-mapping template is not a legal opinion, and a green dashboard does not mean conformity. Conformity assessment, CE marking, registration and the EU database entry are acts with legal consequence that the platform cannot perform. Nor can it manufacture vendor documentation, cure a prohibited practice, or make a reviewer competent and empowered.
Practical framing for the board: the platform reduces the cost of producing evidence and prevents the inventory from decaying. Legal owns the classification and conformity position; the model owners own the evidence; the second line owns challenge. Present it as an evidence supply chain with named owners, or the board will hear 'the tool does compliance'.