Algorithmic Creditworthiness and EU Fundamental rights: the Role of the GDPR and the AI Act

Sammanfattning

This thesis examines how the EU Artificial Intelligence Act and the General Data Protection Regulation (GDPR)regulate the use of AI in credit assess- ment, with a focus on protecting fundamental rights such as transpar- ency and non-discrimination. Using a doctrinal legal method, the analysis ex- plores key legal obligations under both frameworks, including Article 22 GDPR, the classification of high-risk systems under the AI Act, and the role of Data Protection Impact Assessments (DPIAs) and Fundamental Rights Im- pact Assessments (FRIAs). The findings show that while both legal instruments aim to safeguard individ- uals from harm, gaps in clarity, enforceability, and oversight standards limit their effectiveness. In particular, the thesis identifies challenges in defining automated decision-making, ensuring meaningful human oversight, and op- erationalising FRIA obligations in practice. By comparing regulatory mechanisms and highlighting a practical example, the thesis concludes that the current EU framework forms a strong foundation but requires further clarification, enforcement coordination, and institutional support to ensure that AI-driven credit decisions are not only compliant, but also fair and just.