Banca Lumen, a fictional pan-European retail bank headquartered in Milan with branches in Frankfurt, Madrid, Amsterdam, Paris, and Dublin, has just signed off on the deployment of an in-house XGBoost credit-decisioning model called LumenCredit-v3.2. The model will score 10,000 consumer-loan applications per quarter across the EU-27 footprint, integrated directly into the loan-origination workflow at the point of submission. The Chief Credit Officer wants go-live on August 2, 2026: not by coincidence, but because Annex III §5(b) creditworthiness-scoring deployments face the universal-deployer FRIA obligation on the August 2, 2026 sectoral track regardless of the Omnibus VII delay to the stand-alone Annex III deployment dates. The Chief AI Officer and the Chief Risk Officer share one deliverable between the March 2026 model-validation sign-off and the August 2 launch: a Fundamental Rights Impact Assessment under Article 27 of Regulation (EU) 2024/1689, covering the seven mandatory sections of Article 27(1)(a)-(f), with the Article 27(3) notification to the national market surveillance authority filed in coordination with the Italian financial supervisor before the first scoring request hits production. The lesson that follows is the worked FRIA for LumenCredit-v3.2: seven sections drafted to the standard the Banca d'Italia, the AGID, and the EU AI Office will read, with the disparate-impact testing methodology, the Article 86 right-to-explanation design, the human-review pathway, and the SR 11-7 / ECOA / CFPB multi-jurisdiction overlays sequenced into the appendices. This is what a defensible Annex III §5(b) FRIA actually looks like when it lands on the desk.

Why This FRIA Matters - The §5(b) Credit-Scoring System and the August 2, 2026 Universal-Deployer Track

Annex III §5(b), "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud", is the most regulator-attended Annex III sub-category. Fair-lending jurisprudence (ECOA in the U.S., EU Consumer Credit Directive recital 60), the Article 86 right-to-explanation attaching to §5(b) and §5(c), the universal-deployer FRIA obligation, and the financial-supervisor overlay (Banca d'Italia, BaFin, ACPR, AFM, Central Bank of Ireland) make §5(b) the highest-stakes FRIA category.

Three timing pressures define the build. First, the Aug 2, 2026 sectoral track. The Omnibus VII political agreement of May 7, 2026 pushed the stand-alone Annex III deployment date to December 2, 2027, but §5(b) creditworthiness-scoring and §5(c) life/health insurance pricing were carved out: the high-risk classification was already in force from August 2, 2025, and the Council insisted consumer-facing financial-services AI not benefit from the delay. Any EU lender deploying creditworthiness-scoring AI for natural-person consumers must have a complete Article 27 FRIA and Article 27(3) notification filed on or before August 2, 2026. Second, the GDPR Article 22 overlay. A pure-automated credit decision sits within Article 22(1) prohibition with the Article 22(2)(a) contract-necessity exception. Article 22(3) safeguards, human intervention, point of view, contest, overlay every step. Third, the SR 11-7 / OCC 2011-12 / PRA SS1/23 model-risk overlay. Any U.S.- or UK-touching deployer layers independent validation, ongoing monitoring, and periodic review onto the FRIA refresh cadence.

LumenCredit-v3.2 is the modal mid-tier-European-bank §5(b) deployment. Banca Lumen is a EUR 240-billion retail/SME bank with subsidiaries in five EU Member States. The XGBoost classifier was trained on the 2018-2025 application-and-performance dataset (4.2M applications; 720K funded loans; 38K 90-day-past-due events) plus a CRIF/Experian-equivalent EU-bureau covariate pool, producing a 0-1 probability-of-default driving auto-approve / auto-decline / refer-to-human routing. Banca Lumen is both deployer and (for this in-house model) provider, facing the FRIA universally. The program runs through a Joint AI Governance Committee co-chaired by the Chief AI Officer and Chief Risk Officer, with model-risk routed through the SR 11-7-aligned MRM function.

Section 1 - Deployment Process and Intended Purpose (Article 27(1)(a))

Article 27(1)(a) requires "a description of the deployer's processes in which the high-risk AI system will be used in line with its intended purpose." Section 1 carries the FRIA: vague integration, thresholds, or cohort description makes subsequent sections weak. Drafting discipline: SR 11-7-validator fidelity.

System identification. LumenCredit-v3.2 (model ID BL-MRM-2026-014; owner: Head of Retail Credit Modeling; XGBoost gradient-boosted-tree classifier, 850 trees, max depth 6, learning rate 0.03; XGBoost 2.1 on Python 3.12; ONNX-exported, served via FastAPI behind the internal credit-decisioning microservice). Training data: 4.2M applications January 2018 - December 2025, joined with 24-month performance outcomes (default = 90+ days past due within 24 months), plus 142 covariates: applicant-supplied (age, employment, income, tenure, amount/term, purpose), bureau-supplied (utilization, delinquency, public-record items, credit-file-age), and internal-relationship (deposit tenure, savings band, prior-loan history). Out-of-time validation: 2025 hold-out; AUC 0.82; KS 0.45; calibration tested across deciles.

Use case. Three functions: (1) real-time scoring at submission via mobile, web, or branch, score returns within 800ms; (2) threshold-based routing, below 0.10 auto-approves to underwriting confirmation; above 0.55 auto-declines subject to adverse-action notice; 0.10-0.55 routes to loan-officer review (~42% of volume); (3) decision support: the loan-officer dashboard displays score, SHAP top-five contributions, and the counterfactual ("what minimum change moves the score below 0.10"). Intended purpose (model-card and instructions for use, February 5, 2026): "to evaluate creditworthiness of natural-person applicants for consumer loans EUR 1,000-75,000, terms 12-84 months, originated through Banca Lumen retail channels in the EU-27."

Integration architecture. Channels: mobile app (62%), web portal (27%), branch (11%). Normalized JSON POSTs to the microservice, which fetches bureau data via CRIF-equivalent API (350ms budget; thin-file failover), enriches with core-banking data, invokes the ONNX model. Auto-decisions logged to the immutable decision log (10-year retention per Article 18); refer-to-human creates an officer work item with 4-hour SLO. No third-party scoring vendor.

Deployment scope. 10,000 applications/quarter (40,000/year) EU-27 - Italy 43%, Germany 22%, Spain 14%, France 10%, Netherlands 7%, Ireland 4%. Consumer loans only; SME (LumenSME-v2.1) and credit-card pre-approval carry separate FRIAs. Article 27(3) notification: Italy (Banca d'Italia coordinating with AGID as AI Act market-surveillance authority pending formal designation; courtesy filings to BaFin, ACPR, AFM, Central Bank of Ireland for cross-border populations).

What the system is NOT used for. Excluded: (i) loan amounts above EUR 75,000 or terms above 84 months; (ii) mortgages (separate FRIA in development); (iii) SME/commercial lending; (iv) credit-card pre-approval; (v) fraud detection (Annex III §5(b) carve-out; separate model outside §5(b) FRIA scope); (vi) collections/recovery/post-default servicing; (vii) pricing/interest-rate (separate downstream model consuming the score, Appendix G). The "not used for" list forecloses scope-creep and clarifies any expansion is a substantial modification triggering Article 27 refresh and Article 27(3) re-notification.

Section 2 - Period, Frequency of Use, and Affected Persons (Article 27(1)(b)-(c))

Article 27(1)(b) requires period and frequency; Article 27(1)(c) requires affected categories. Section 2 captures the operational footprint, refresh cadence, and applicant demographics driving Section 4 disparate-impact testing.

Period. Continuous 24x7 from go-live (August 2, 2026); blue-green deployment, zero scheduled downtime. v3.2 runs through Q3 2027; v3.3 retrain triggered by calendar (annual) or drift alarms (PSI > 0.2 on any top-10 feature; AUC drop > 0.03 on rolling-90-day; default-rate outside +/- 15% on rolling-365-day). Transitions follow SR 11-7 change-control: shadow-mode, A/B parallel scoring, full-cutover sign-off.

Frequency. Real-time at every submission. ~10,000/quarter (~110/business day); peak ~380/day. Each application scored exactly once; recursive re-scoring disabled to prevent "model shopping." Re-application within 30 days surfaces the prior decline reason. ~42% route to officer review; 56 EU officers (~80 referrals/week, 18 min/review). Senior-credit-officer escalation on ~12% of referrals.

FRIA refresh cadence. Quarterly bias-monitoring (calendar-aligned). Annual full refresh (each August 2 anniversary). Triggered refresh (within 30 days) for: retrain or version update; threshold adjustment > 0.02; feature add/remove; scope expansion (country, product, range); regulatory development (Banca d'Italia circular, EBA guidelines, EU AI Office decision, GDPR Article 22 jurisprudence, ECOA/CFPB enforcement); material default-rate shift; adverse-action complaint pattern (> 5 from a single cohort/quarter); SR 11-7 independent-validation finding requiring remediation.

Primary affected category: loan applicants. The 10,000/quarter EU consumer-loan pool. Composition (privacy-preserving aggregation under GDPR Article 89 and AI Act Article 10(5)): ~53% male, 46% female, 1% non-binary/undisclosed. Age: ~22% 18-29, ~38% 30-44, ~28% 45-59, ~12% 60+. Income (annual EUR): ~18% under 20K, ~34% 20-40K, ~32% 40-70K, ~16% over 70K. Employment: ~71% permanent, ~14% self-employed, ~9% fixed-term, ~6% other. Race/ethnicity not systematically collected (EU Member-State practice); Banca Lumen runs a proxy-based disparate-impact analysis using Bayesian Improved Surname Geocoding (BISG) and country-of-birth, with documented methodology limitations.

Intersectional and vulnerable categories. The FRIA explicitly considers: women 45-59 (post-divorce financial-restart); 18-25 with thin credit files; self-employed variable-income (gig-economy, freelancers); recent-migration (less than 5 years EU residence; foreign-credential employment); 65+ (pension-reliant). Per AI Office Article 27(1)(c) guidance and Banca d'Italia consumer-protection priorities, four vulnerable categories receive heightened scrutiny: (i) thin-file applicants, impact on young adults, recent migrants, individuals returning to credit-active life; (ii) self-employed/gig-economy, income variability not fitting employment-stability features; (iii) prior debt-restructuring or insolvency, prior events over-weighted relative to current creditworthiness; (iv) applicants with disabilities, patterns may diverge from baseline; accessibility may affect data completeness.

Secondary affected category: loan officers. 56 EU consumer-loan officers and ~14 senior credit officers are workers whose tasks are augmented (and potentially deskilled). Article 26(7) deployer obligations apply: Banca Lumen completed June 2026 consultation with Italian unions (CGIL, CISL, UIL), the German Betriebsrat, Dutch OR, Spanish comité de empresa, French comité social et économique, and Irish staff representative (Appendix E).

Tertiary and group-level. Household dependents (housing, durable goods, education, medical financing), recorded for Charter Article 34 analysis. Group-level effects: postal-code-clustered cohorts (geocoded proxies for socioeconomic status) and cumulative EU-lender-ecosystem patterns.

Section 4 - Specific Risks of Harm to Fundamental Rights (Article 27(1)(d))

Article 27(1)(d) requires "the specific risks of harm likely to have an impact on the categories of natural persons or groups of persons identified pursuant to point (c), taking into account the information given by the provider pursuant to Article 13." For §5(b), Charter articles at risk read longer than for §4 hiring: credit decisions touch non-discrimination, personal data, dignity, good administration, effective remedy, plus (uniquely) social security/social assistance and economic harm. Each ties to mitigation in Section 5 or 6.

Charter Article 21 - Non-discrimination. The dominant risk. Sources: (i) training-data bias, 2018-2025 approvals/defaults encode historical patterns differing from today's qualified-applicant pool; (ii) feature bias, "deposit-account tenure" or "prior loan history" disadvantage new-customer cohorts; (iii) proxy bias, postal code, employer, occupation may proxy for race, ethnicity, gender, socioeconomic status; (iv) threshold disparate impact, 0.10/0.55 thresholds are policy choices with consequences for clustered populations; (v) refer-to-human band bias, officers in 0.10-0.55 may default to the model on protected-class applicants vs. exercising independent judgment on majority-class. Testing methodology (Appendix C): four-fifths-rule selection-rate; equalized-odds (true-positive-rate parity for actual non-defaulters); predictive parity (positive-predictive-value parity by group); default-rate disparate-impact among approved applicants; adverse-action disparity. Per the fairness-metric-selection memo (lesson 017): four metrics in parallel with explicit impossibility-theorem trade-off acknowledgment and equalized-odds as primary, four-fifths-rule and predictive-parity as secondary. Harm vectors: qualified protected-class applicants systematically declined; thin-file young-adults over-declined; self-employed over-referred (throughput delays); recent-migration over-declined; older applicants over-declined despite lower observed default rates.

Charter Article 34 - Social security and social assistance. The Charter's expansive credit-exclusion interpretation is increasingly argued in EU courts, part of why the AI Office identified §5(b) as high-risk. (i) financial-inclusion harm, credit-exclusion cycle across the applicant's economic life; (ii) essential-service-access, declines on loans for medical care, housing deposits, employment vehicles translate to material deprivation; (iii) cohort-level exclusion across the lender ecosystem.

Charter Article 8 - Protection of personal data. System processes financial data, inferred data (score; SHAP attributions), and special-category where applicable (health-related in counterfactuals on medical-leave gaps; ethnicity proxies via BISG). (i) special-category over-collection, bias-monitoring infers ethnicity proxies under AI Act Article 10(5) and GDPR Article 9(2)(g) substantial public interest, with strict access controls limiting inferred-ethnicity to the bias-monitoring function only and excluding it from decisioning; (ii) GDPR Article 15 DSARs surface the score, attribution, counterfactual, and immutable decision-log entry; (iii) GDPR Article 22, auto-approve and auto-decline are within Article 22(1) with the Article 22(2)(a) contract-necessity exception engaged; Article 22(3) safeguards operationalize through the Article 86 pathway in Section 5; (iv) cross-border, data hosted Milan and Frankfurt; bureau intra-EU; no Schrems-II transfer in scope; (v) retention per Banca Lumen Records Retention Schedule (approved loans for life plus 10 years; declined for 5 years per AML layered on Article 18).

Charter Article 41 - Good administration. Auto-decisions within 800ms; refer-to-human within 4 business hours; senior credit officer escalation within 2 business days. Right to know reasons via the Article 86 pathway.

Charter Article 47 - Effective remedy. Risks: opaque AI forecloses remedy; inadequate complaint-handling forces applicants to Banca d'Italia or financial-ombudsman proceedings; lack of remediation prolongs harm. Section 6 establishes the complaint channel, investigation, remediation, and coordination with Banca d'Italia, the Arbitro Bancario Finanziario, and Member-State financial-ombudsman pathways.

Economic-harm risk. §5(b) FRIAs are expected to address direct economic harm: (i) erroneous decline of a creditworthy applicant, forgone financing; possible higher-cost predatory alternative; (ii) erroneous approval, debt-burden the applicant cannot service plus default loss; (iii) systematic mis-pricing, market-distortion. Part of the Joint AI Governance Committee's risk-scoring alongside Charter risks.

Risk scoring. Likelihood × consequence (1-5 × 1-5), integrated with SR 11-7 MRM tiering. Article 21: inherent 20/25, residual 8. Article 34: inherent 16, residual 6. Article 8: 12 / 4. Article 41: 8 / 3. Article 47: 9 / 3. Economic: 16 / 8. Reviewed quarterly per Section 2.

Section 5 - Human Oversight, Article 86 Right to Explanation, and Human-Review Pathway (Article 27(1)(e), Article 14, Article 86)

Article 27(1)(e) requires "a description of the implementation of human-oversight measures, according to the instructions for use", connecting the FRIA to Article 14. For §5(b), this section also operationalizes Article 86 (right to explanation for affected persons subject to a high-risk decision producing legal or similarly significant effects), the canonical §5(b) target.

Measure 1, loan-officer review of every refer-to-human decision. Every 0.10-0.55 application routes to an officer. Dashboard: model score; SHAP top-five with magnitude and direction; counterfactual ("smallest changes to features X, Y, Z that move the score below 0.10"); full bureau pull; relationship data; prior-application history; borderline flags. Officer records the decision (approve / decline / request information / escalate); the decision, not the score, is the operative action. Training: 24-hour initial certification (model-card reading, feature-interpretation, automation-bias mitigation, fair-lending, Article 86 explanation-design); 8-hour annual refresh.

Measure 2, auto-decline review on request. Every auto-declined applicant receives an Article 86-compliant adverse-action notice within 30 days (EU Consumer Credit Directive recital 60 timing) with explicit right to request human review. On request, the application routes to a loan officer with the full dashboard plus original auto-decision context.

Measure 3, borderline escalation. Any application within 0.05 of either threshold (0.05-0.15 or 0.50-0.60) flags for senior credit officer review where the officer's initial decision is decline. Senior officers have policy-level override authority; patterns logged for monthly analysis in measure 5.

Measure 4 - Article 86 right-to-explanation pathway. Article 86 requires "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken." Four layers: (a) at-decision disclosure, plain-language notification that an AI system contributed, integrated with the Article 50(1) transparency notice; (b) per-decision explanation, adverse-action notice includes top three contributing features in plain language ("scored partly on: shorter-than-average tenure at current employer; existing-credit utilization above 65%; recent bureau inquiries pattern"); approvals include a one-line acknowledgment; (c) counterfactual where feasible ("If your existing-credit utilization had been below 50%, your application would have qualified for our auto-approve tier"); generated by the same SHAP/Wachter-style engine, with explicit documentation that the counterfactual is illustrative, not a guarantee; (d) human-review escalation, every adverse-action notice carries the right triggering Measure 2. Integrated with EU Consumer Credit Directive recital 60 and Member-State implementations.

Measure 5, monthly QA and override-pattern analysis. The Credit Operations Manager samples 10% of refer-to-human decisions monthly: (i) engagement vs. rubber-stamp; (ii) override rate by officer (low = over-deference); (iii) demographic disparity in overrides; (iv) Article 86 explanation quality. Findings feed the quarterly bias-monitoring review.

Measure 6, quarterly bias-monitoring by Joint AI Governance Committee. Consumes disparate-impact metrics (four-fifths-rule, equalized-odds, predictive-parity, default-rate disparate-impact, adverse-action disparity) across protected classes (sex, age, country-of-birth migration proxy, BISG-inferred ethnicity proxy, intersectional cohorts from Section 2), override patterns, complaint outcomes, model-monitoring drift. Attendees: Chief AI Officer, Chief Risk Officer, Chief Credit Officer, Chief Privacy Officer, Head of Retail Credit Modeling, Head of Credit Operations, annual external fairness-audit consultant.

Measure 7 - SR 11-7 model-risk overlay. SR 11-7 / OCC 2011-12 / PRA SS1/23 is the internal standard: independent validation by MRM (separate from development) at build, after material change, and at least annually; ongoing monitoring (PSI, AUC, KS, calibration, default-rate); tiered periodic review (LumenCredit-v3.2 is Tier-1: annual independent + quarterly self-assessment); model-risk-rating integration with enterprise risk reporting. MRM findings feed the FRIA refresh cycle.

Article 14(4) capabilities. (a) understand capacities/limitations, 24-hour initial plus 8-hour annual training; (b) avoid automation bias, QA sampling, rotation, override monitoring; (c) interpret output, SHAP, counterfactual, calibration; (d) disregard/override/reverse, unrestricted logged override with policy-level authority; (e) intervene/interrupt, Chief AI Officer with Chief Credit Officer suspends on serious incident per the AI Incident Response Plan.

Oversight-effectiveness metrics. Loan-officer override 8-20% on refer-to-human (low = over-deference, high = model-officer disconnect); senior-credit-officer override 15-35% of escalations; QA 100% within 10 business days of period close; quarterly review within 30 days of quarter end; annual SR 11-7 validation; Article 86 explanation rate 100% on auto-declines (zero-tolerance).

Section 6 - Risk Materialization, Complaints, and Article 27(3) Notification (Article 27(1)(f), Article 27(3))

Article 27(1)(f) requires "the measures to be taken in the case of the materialization of those risks, including the arrangements for internal governance and complaint mechanisms." Credit decisions create direct exposure to the financial supervisor on top of the AI Act. Article 27(3) layers the notification obligation to the market surveillance authority.

Bias-drift alert escalation. Quarterly drift vs. rolling four-quarter baseline. (i) green, within 5%; no action; (ii) amber, 5-15% drift or four-fifths-rule dropping into 80-83%; Joint AI Governance Committee notification within 5 business days; root-cause within 30 days; (iii) red, > 15% drift, four-fifths-rule failure (< 80%), default-rate disparity beyond control band, or adverse-action-disparity pattern; immediate notification to Chief AI Officer, Chief Risk Officer, Chief Credit Officer, Chief Privacy Officer, General Counsel; remediation engaged within 24 hours; consideration of suspension or threshold adjustment.

Remediation playbook. Five sequenced steps on red-tier or confirmed incident: (1) contain, adjust thresholds, restrict auto-decline to manual-only-decline, or suspend on affected cohort/product; (2) investigate, training-data, features, threshold, officer overrides, bureau-data quality, integration flows, MRM findings; (3) remediate, retraining (MRM validation sign-off), threshold adjustment, feature deprecation, counterfactual recalibration, officer retraining, bureau-integration correction; (4) verify, re-run disparate-impact on hold-out and next quarterly cycle; MRM re-validation; (5) document, incident log with Article 73 classification.

Threshold authority. < 0.02: Head of Retail Credit Modeling with MRM concurrence. 0.02-0.05: Joint AI Governance Committee. > 0.05: board sign-off plus triggered FRIA refresh and Article 27(3) re-notification. Bias-remediation changes additionally require fair-lending review by Chief Risk Officer and General Counsel.

Article 73 serious-incident reporting decision tree. Article 73 places primary obligation on providers; as deployer of a self-developed model, Banca Lumen bears full obligation as both deployer and provider. "Serious harm to fundamental rights" in §5(b) plausibly includes confirmed systemic bias on a protected class at material scale; large-scale erroneous-decline patterns; data breach of applicant special-category or financial data; algorithmic exclusion of an identifiable protected group from substantial credit-decision volume. Tree: (i) attributable to system vs. officer or bureau-data error? (ii) meets Article 73 serious-incident definition? (iii) report to AI Office and Italian market-surveillance per Article 73 timelines (15 days standard; immediate for life-threatening; periodic for widespread infringements per Article 73(2)); (iv) parallel notification to Banca d'Italia under supervisory-reporting; (v) parallel notification to the Garante per la protezione dei dati personali if a personal-data breach under GDPR Article 33. Templates pre-drafted in the AI Incident Response Plan.

Internal governance. Joint AI Governance Committee co-chaired by Chief AI Officer and Chief Risk Officer; membership includes Chief Credit Officer, Chief Privacy Officer, CISO, General Counsel, Head of Retail Credit Modeling, Head of Credit Operations, Head of MRM, external fairness-audit consultant. Monthly standing; ad hoc on incident. Quarterly briefing to Board AI Risk Committee and Board Risk Committee; annual to full Board.

Applicant complaint channel. Published at https://bancalumen.example.com/credit-complaints with Member-State-language sub-pages. Describes: scope (decision, AI role, adverse-action notice, data handling, human-review); how to file (web, email [email protected], postal, in-branch); acknowledge within 5 business days, respond within 30 calendar days; right to escalate to the Arbitro Bancario Finanziario and equivalent Member-State financial ombudsmen; right to complain to the Garante under GDPR; right to complain to Banca d'Italia (or equivalent national financial supervisor); right to escalate to AGID-or-designated AI Act market-surveillance authority; right to effective judicial remedy under Charter Article 47. Referenced in the Article 50(1) disclosure and the Article 86 adverse-action notice.

Triage. Credit Complaints Team (5 FTE) triages within 5 business days into: (i) information request, Article 86; 10 business days; (ii) process complaint, escalates to senior credit officer and Head of Credit Operations; 20 business days; (iii) bias complaint, escalates to Joint AI Governance Committee with cohort disparate-impact sub-analysis; 30 business days; (iv) data complaint, routed to DPO; Article 12-22 response; (v) data-accuracy, facilitates bureau-rectification and re-scores. Template-only responses not acceptable.

Remediation menu. On confirmed complaint: (i) re-evaluation by senior credit officer with model assistance excluded; (ii) compensation for out-of-pocket costs (late fees, higher-cost alternative loan); (iii) policy corrections; (iv) where processing violated GDPR, full DSAR plus erasure where requested; (v) on systemic bias the Section 6 playbook engages and the applicant is informed; (vi) bureau-data correction and re-decision where applicable.

Article 18 record-keeping. AI system logs (application data, score, attributions, counterfactual, routing, officer decision, overrides, complaints, investigations, remediation) retained 10 years from credit decision or complaint, whichever is later: aligning with Article 18's "at least six months" floor, AML 10-year retention, SR 11-7 model-evidence retention, and EU/Member-State fair-lending/consumer-credit statutes.

Financial-supervisor coordination and Article 27(3) notification. Lead supervisor is Banca d'Italia (with ECB direct supervision under SSM for the consolidated group). Banca d'Italia receives the Article 27(3) notification as a courtesy filing in parallel with the AGID-or-designated AI Act market-surveillance filing, per Banca d'Italia 2026 supervisory expectations on bank AI deployment. Cross-border escalations to non-Italian supervisors (BaFin, ACPR, AFM, Central Bank of Ireland, Banco de España) coordinate with Banca d'Italia under the EBA cross-border framework. AI Act enforcement is expected to follow analogous cooperation through the EU AI Office and the European Artificial Intelligence Board, with financial-services coordination through the EBA. Article 27(3) plan: (i) filed with AGID-or-designated Italian authority on or before go-live (August 2, 2026); (ii) parallel courtesy filings to Banca d'Italia, the Garante, BaFin, Banco de España, ACPR, AFM, Central Bank of Ireland; (iii) Commission template tool under Article 27(5) when issued, or Commission-aligned interim template; (iv) FRIA in substantive entirety plus Appendices A-G; (v) refreshed notification on substantial modification (retrain, threshold > 0.05, scope expansion, bureau-vendor change); (vi) notification register tracking each filing, authority, date, and acknowledgment.

Appendices A-G

Audit-grade cross-references. Seven audit-grade cross-references prevent duplicate analysis: A, SR 11-7 MRM cross-reference (independent validation under SR 11-7 / OCC 2011-12 / PRA SS1/23 covering development, conceptual soundness, ongoing monitoring, outcomes analysis; Tier-1 high-criticality); B, ECOA and fair-lending (U.S. overlay) (maps disparate-impact methodology to ECOA effects-test and CFPB adverse-action under Regulation B §1002.9; readied for U.S. expansion); C, Disparate-impact testing methodology (four-fifths-rule, equalized-odds, predictive-parity, default-rate disparate-impact across sex, age, country-of-birth, BISG ethnicity proxy, intersectional cohorts, four vulnerable categories; cadence, significance thresholds, action tiers green/amber/red; cross-walk to the fairness-metric-selection memo lesson 017); D, GDPR Article 35 DPIA + Article 22 cross-reference (each Article 35(7)(a)-(d) DPIA item mapped to FRIA sections; Article 22(1) automated-decision-making with Article 22(2)(a) and Article 22(3); Article 9(2)(g) plus AI Act Article 10(5) for bias-monitoring inferred ethnicity; DPO sign-off); E, Worker-representative consultation (Article 26(7) records, Italian unions, German Betriebsrat, Dutch OR, Spanish comité de empresa, French CSE, Irish staff representative); F, AI Incident Response Plan (Section 6 remediation, Article 73 decision tree, financial-supervisor coordination, post-incident review); G, Downstream-model dependency (boundary between this FRIA's scope and the downstream pricing model consuming the LumenCredit-v3.2 score).

Cross-walks. EU AI Act Article 27 (full); Article 27(3); Article 10 + Article 10(5); Article 13 (doubled: Banca Lumen is both provider and deployer); Article 14; Article 18; Article 26 deployer obligations including (5) serious-incident reporting and (7) worker-representative notification; Article 50(1); Article 73; Article 86 (the canonical §5(b) target); Annex III §5(b); Charter of Fundamental Rights Articles 8, 21, 34, 41, 47; GDPR Article 22 + Article 35; EU Consumer Credit Directive recital 60 and Member-State implementations; ECOA + Regulation B + CFPB UDAAP (U.S. overlay readiness); SR 11-7 / OCC 2011-12 / PRA SS1/23 (MRM); ISO 42001 controls A.5 (impact assessment), A.6.1.1 (impact and risk considerations), A.7 (lifecycle); NIST AI RMF 1.0 Map 5 (impacts); fairness-metric-selection memo (lesson 017); Article 50(1) disclosure (lesson 030); FRIA scoping memo (lesson 044); §4 hiring FRIA (lesson 045) as the sister-system template.

Retention. FRIA artifact, Appendices, and AI system logs retained 10 years from the latest applicable date (filing, system retirement, last applicant-affected decision, complaint disposition) per Article 18 floor extended for §5(b) aligned to AML, SR 11-7 model-evidence retention, and ISO 42001 A.7 lifecycle.

Mistake 1 - Skipping intersectional disparate-impact testing

Single-axis tests (sex; age; BISG ethnicity) can pass while intersectional cohorts (women 45-59; thin-file young-adult migration-background; self-employed older-age) fail. Run intersectional testing across the four vulnerable categories per Appendix C.

Mistake 2 - Missing the Article 86 right-to-explanation pathway

Article 86 attaches specifically to §5(b). Design the four layers (at-decision disclosure, per-decision explanation, counterfactual, human-review escalation) and document integration with the EU Consumer Credit Directive recital 60 adverse-action timing.

Mistake 3 - Weak human-review threshold design

"Loan officer reviews the borderline cases" is not a Section 5 description. Specify threshold bands, borderline-escalation logic (within 0.05 of either threshold), senior-credit-officer criteria, dashboard contents, override authority and logging, and QA for over-deference. The 0.10 / 0.55 with 0.05-band escalation is the worked template.

Mistake 4 - Missing the SR 11-7 model-risk overlay

For any U.S.- or UK-touching deployer (and increasingly EU deployers as Banca d'Italia and EBA expectations converge), independent validation, ongoing monitoring, tiered periodic review, and model-risk-rating integration onto the FRIA refresh cycle are non-optional.

Mistake 5 - Missing national financial-supervisor coordination

Article 27(3) notification goes to the AI Act market-surveillance authority, but §5(b) is also a banking-supervisor concern. File parallel courtesy notifications with Banca d'Italia, BaFin, ACPR, AFM, Central Bank of Ireland, Banco de España and coordinate ongoing supervisory dialogue.

Mistake 6 - Static FRIA without quarterly refresh

A §5(b) system that satisfied Article 27 at go-live drifts through retrain, threshold adjustment, bureau-data changes, regulatory developments, or default-rate shifts. The discipline is the quarterly + triggered + annual cadence integrated with the SR 11-7 model-monitoring cycle.

Key Takeaways

• Annex III §5(b) creditworthiness-scoring deployments face the universal-deployer FRIA obligation on the August 2, 2026 sectoral track, independent of the Omnibus VII delay of stand-alone Annex III to December 2, 2027. EU banks and non-bank lenders must have the complete Article 27 FRIA and the Article 27(3) notification filed on or before August 2, 2026.
• The §5(b) FRIA stacks three concurrent frameworks. Article 27 FRIA + GDPR Article 22 automated-decision-making (with Article 22(2)(a) contract-necessity reliance and Article 22(3) safeguards) + SR 11-7 / OCC 2011-12 / PRA SS1/23 model-risk-management overlay. Each framework has its own content requirements and refresh cadence that must be integrated, not parallel-processed.
• Section 1 anchors specificity for the rest of the FRIA. System identification (model ID, algorithm, framework, training data lineage); use case (real-time scoring, threshold-based routing, decision support); integration architecture; deployment scope; explicit "not used for" list. The discipline is to write Section 1 with the precision an SR 11-7 model-risk validator would expect.
• Section 3 demographic granularity must include intersectional and vulnerable cohorts. Single-axis demographics (sex, age) miss intersectional disparate impacts (women 45-59 post-divorce; thin-file young-adult migration-background applicants; self-employed older-age cohorts; applicants with prior debt-restructuring). The four vulnerable categories (thin-file, self-employed, prior-restructuring, disability-related) receive heightened scrutiny.
• Section 4 enumerates Charter articles plus the §5(b)-specific economic-harm vector. Charter Article 21 non-discrimination is dominant; Charter Article 34 social security / financial inclusion is the §5(b)-specific addition; Charter Article 8 personal data; Charter Article 41 good administration; Charter Article 47 effective remedy; plus the economic-harm vector that regulators explicitly expect §5(b) FRIAs to address.
• Disparate-impact testing methodology runs four metrics in parallel. Four-fifths-rule selection-rate analysis; equalized-odds across qualified applicants (true-positive-rate parity); predictive parity by demographic group (positive-predictive-value parity); default-rate disparate-impact (separate from approval-rate disparate-impact); adverse-action disparity. The deployer documents the primary fairness target with the impossibility-theorem trade-offs acknowledged per the fairness-metric-selection memo.
• Article 86 right-to-explanation has four operational layers for §5(b). At-decision AI-disclosure; per-decision explanation with top-three contributing factors; counterfactual explanation where feasible; human-review escalation pathway. Integrated with the EU Consumer Credit Directive recital 60 adverse-action timing and Member-State implementations.
• Human-review pathway design has three threshold-based tiers. Auto-approve below the lower threshold; auto-decline above the upper threshold; refer-to-human in the middle band. Borderline escalation (within 0.05 of either threshold) routes to senior credit officer; override authority is logged and pattern-analyzed. SR 11-7 model-risk-management framework overlays independent validation, periodic review, and performance monitoring.
• Multi-jurisdiction overlay includes the national financial supervisor. Article 27(3) notification goes to the AI Act market-surveillance authority: Banca d'Italia, BaFin, ACPR, AFM, Central Bank of Ireland, Banco de España receive parallel courtesy notification on the banking-supervisory side. ECOA + CFPB UDAAP overlay readied for U.S. operations.
• Refresh cadence: quarterly + triggered + annual. Quarterly bias-monitoring review; annual full FRIA refresh on the August 2 anniversary; triggered refresh within 30 days of model retrain, threshold adjustment greater than 0.05, scope change, bureau-vendor change, SR 11-7 validation finding, regulatory development, cohort default-rate drift, or adverse-action complaint pattern.
• Article 27(3) notification is not optional. The FRIA artifact alone is insufficient: Banca Lumen's notification register tracks the filing with the AGID-or-designated Italian market-surveillance authority on or before August 2, 2026, with parallel courtesy filings to the Banca d'Italia and the cross-border financial supervisors, and refresh notifications on substantial modification.
• Six common mistakes to inoculate against. Skipping intersectional disparate-impact testing; missing the Article 86 explanation pathway; weak human-review threshold design; missing the SR 11-7 model-risk overlay; missing national financial-supervisor coordination; static FRIA without quarterly refresh. The Banca Lumen FRIA's Sections 1-7 and Appendices A-G structure systematically prevents each.