Zotta Lending Briefs · AI compliance
AI in lending: what applies in the UK, Europe and US?
Rules, practice examples and guidance carry different weight. Watch the 91-second comparison.
Watch the 91-second video
AI-generated narration · English captions · General information, not legal advice.
At a glance
Three jurisdictions. Different legal weight.
Practice examples
FCA examples explain the existing framework. They create no new requirements.
19 October · updated 20 October 2026 European UnionA limited presumption
A quality-management standard supports the Article 17 requirements it covers.
Commission: 19 October 2026 United StatesRules and guidance
Regulation B and bank model-risk guidance have different status and scope.
Current rule · guidance: 17 April 2026Selected sources, checked 28 October 2026. This comparison is not an exhaustive legal survey or a ranking of compliance.
United Kingdom · reported facts
Existing requirements, practical examples
The FCA’s October publication illustrates AI practices under its existing framework. The examples are non-exhaustive: they neither create new requirements nor prescribe one model for every firm.
Zotta’s implementation questions: Who owns the workflow? How can consumers reach human support? What happens when the system fails? Test the answers against the actual use case, its risks and potential consumer impact.
Europe · EU framework
Identify the role and use case first
The Commission’s October announcement concerns EN 18286:2026, a quality-management standard for providers of high-risk AI systems. Implementing it gives a presumption of conformity with the Article 17 requirements covered by the standard.
The reference was published through Implementing Decision (EU) 2026/2274. This is a focused quality-management route; it does not establish conformity with every AI Act obligation.
United States · reported facts
Separate credit rules from banking guidance
Where an adverse-action reasons statement is required, Regulation B §1002.9 requires specific principal reasons reflecting the actual factors considered. Saying only that an applicant failed internal standards or a qualifying score is insufficient. The applicable notice route, timing and transaction-specific provisions still matter.
Separately, SR 26-2, dated 17 April 2026, replaces SR 11-7 and SR 21-8. It is nonbinding model-risk guidance, primarily relevant to banking organizations above $30 billion in assets, with qualifications for some smaller banks.
Its scope excludes generative and agentic AI. That does not exempt a system from other applicable obligations. This brief covers selected federal sources; state and other sector-specific rules need separate review.
Zotta’s interpretation
Three questions before implementation
Apply
Which requirements apply to this entity, product, role and use case? Record the exact source and relevant date.
Own
Who owns each control, the escalation route and the response when something fails?
Evidence
What testing and ongoing records show the controls work? Use fictional cases in supplier demonstrations.
Video
Full transcript
AI in lending: what applies in the UK, Europe and US?
Start by separating binding rules from examples and supervisory guidance.
In the UK, the FCA's October publication illustrates AI practice under the existing framework. It creates no new requirements. For a lending team, ask who is accountable, how consumers get human help, and what happens when the system fails.
In Europe, this comparison focuses on the European Union. Identify your organisation's role and AI use case first. The Commission's October announcement identifies a quality-management standard for providers of high-risk AI systems. Its presumption of conformity concerns the covered Article seventeen requirements, not every obligation under the AI Act.
In the US, Regulation B still matters. Where a statement of adverse-action reasons is required, it must explain the actual principal reasons. Separately, April's banking model-risk guidance has a defined scope. It does not cover generative or agentic AI. That is not an exemption from other applicable rules.
Three questions for your implementation review: Which requirements apply? Who owns the controls? What evidence shows they work?
Take those questions to your legal and compliance team. Zotta Lending Brief. General information, not legal advice or a product compliance certification.
Evidence
Primary sources and dates
- UK: FCA practice examples
- AI in financial services: good practice and areas for improvement. Published 19 October 2026; updated 20 October. Sections 1.1–1.2 distinguish existing requirements from illustrative examples.
- EU: Commission announcement
- First harmonised standard supporting the AI Act. Published 19 October 2026; updated 21 October. Explains the limited Article 17 presumption for high-risk AI providers.
- EU: implementing decision
- Commission Implementing Decision (EU) 2026/2274. Adopted 12 October; Official Journal publication and entry into force on 14 October 2026. Annex: EN 18286:2026. The decision’s entry into force is not a claim about every AI Act application deadline.
- US: current Regulation B
- 12 CFR §1002.9, Notifications. Current official text checked 28 October 2026, especially paragraphs (a) and (b)(2) and their interpretations. Existing regulation, not new October guidance.
- US: revised model-risk guidance
- Federal Reserve SR 26-2. Issued 17 April 2026; replaces SR 11-7 and SR 21-8. Dated background, not breaking news.
- US: guidance status and scope
- Supervisory Guidance on Model Risk Management. Pages 2–3 and footnote 3: nonbinding status, bank-size qualifications, and the generative/agentic AI exclusion.
Sources checked 28 October 2026. Local and transaction-specific requirements may also apply.