- Home
- Industries
- Consumer lending
AI agents for consumer lenders and lending platforms
Consumer lenders and lending platforms answer the same loan questions all day, chase documents, help people who fall behind and handle complaints against deadlines, often in several languages. We build AI agents for that work. None of them approves, prices or scores a loan.
The problems we hear first
The same loan questions, all day
Balance, due dates, fees, early repayment, a new bank account: the answers exist, but support teams type them again in every channel.
Documents back and forth
Applications stall on a missing payslip, an unreadable ID or a statement from the wrong month, and each round trip costs days.
Customers in payment difficulty
Someone who has missed a payment needs a calm, accurate account of their options, not pressure. CCD2 asks for reasonable forbearance and a route to debt advice.
Complaints under deadlines
Each complaint has to be registered, investigated and answered in plain language within the deadline your policy and supervisor set.
Several markets, several languages
Cross-border lending means every answer in the customer’s language, with the right local rule, and the same record behind it.
Each one prepares. A person decides.
Examples of what we build in this sector, not client work. For each one: where a person approves, and what it never does.
Support agent
Answers questions on loans, repayments and fees from your approved terms, in the customer’s language, and says it is an AI in its first message.
- A person approves
- Hands over to a person on request, on a complaint, on any sign of difficulty and on anything outside the terms.
- It never
- Change a loan, promise a concession, or recommend a credit to a person.
Complaints and quality desk
Registers each complaint, classifies it, gathers the file and drafts a reply with the deadline on it. Scores the agent’s own conversations against your quality bar.
- A person approves
- A complaints handler decides and sends every reply.
- It never
- Decide a complaint, or score your staff: it reviews agent conversations only.
Application and documents assistant
Checks an application for completeness, says what is missing or unreadable, and drafts the request to the applicant.
- A person approves
- Your credit team does the assessment and takes the decision.
- It never
- Assess creditworthiness, or approve, decline or rank an applicant.
Payment-plan assistant
Explains the options your policy allows to a customer who has missed a payment, and prepares a plan from the customer’s own figures.
- A person approves
- A person approves every plan before it is confirmed.
- It never
- Use pressure, urgency or signs of vulnerability to push payment. It is designed against AI Act Art. 5(1)(b).
KYC and AML document review assist
Checks identity and source-of-funds documents against your checklist and assembles the file, each item with its source.
- A person approves
- A compliance analyst decides onboarding and any escalation.
- It never
- Accept or refuse a customer, or file a report.
Investor desk
For lending and investment platforms: answers investors from your published risk statements and product terms, and passes questions about suitability to a person.
- A person approves
- Your team answers anything that is advice.
- It never
- Give investment advice, or describe returns beyond your published documents.
The red line, in the regulation’s words.
No agent we build approves, declines, prices, limits, scores or ranks a loan, or profiles a borrower’s finances.
- AI Act Annex III 5(b)
High-risk: AI “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score”, except AI used to detect financial fraud. These rules apply from 2 December 2027.
- AI Act Art. 6(3)
The way out for narrow procedural and preparatory tasks closes where a system “performs profiling of natural persons”. GDPR Art. 4(4) counts analysing or predicting a person’s “economic situation” as profiling.
- GDPR Art. 22
A person has the right “not to be subject to a decision based solely on automated processing, including profiling” with legal or similarly significant effects. Where an exception applies, they keep the right to human intervention, to give their view and to contest the decision.
- CCD2 Art. 18(8)
Where the creditworthiness assessment involves automated processing, the consumer has the right “to request and obtain from the creditor human intervention”, a clear and comprehensible explanation, to give their own view and to request a review. Directive (EU) 2023/2225 applies from 20 November 2026 (Art. 48).
So our agents stay out of the substance of the assessment. They explain, collect, check completeness and draft, and a person decides. If your counsel concludes that an agent does touch the assessment, the Art. 18(8) notice and rights are built in from the start.
Read on 12 November 2026: the AI Act on the consolidated reprint, GDPR on gdpr-info.eu, CCD2 on an unofficial reprint of Directive (EU) 2023/2225. Not legal advice: your counsel confirms how they apply in each market.
One job, step by step, with the person inside the flow.
A missed payment
A customer writes in the chat that they missed this month’s payment and asks what happens now. The agent explains the options and prepares a plan; a person approves it.
- Sector
- Consumer lending
- Risk class
- Not creditworthiness (Annex III 5(b)); reasons kept
- Who decides
- A collections specialist
- Message received“I missed my payment this month. What happens now?” In the customer’s language (sample).Done
- AI notice, then the customer’s loginSays it is an AI. The customer is identified by your login, never by asking for card details in the chat.AI Act Art. 50Done
- Only this loan readBalance, due date, the missed instalment and the options your policy allows; no other account data.GDPR Art. 5(1)(c)Done
- Options explainedPlainly, without urgency: pay now, move the date, or a payment plan. Fees as your terms state them, and where to find free independent debt advice.CCD2 Art. 35Art. 36Done
- Difficulty signalThe customer mentions losing their job. The agent does not push; it offers a person and a plan.AI Act Art. 5(1)(b)Flagged
- Plan preparedThree monthly amounts the customer proposed, checked against your policy’s limits (sample figures).Drafted
- Waiting for a collections specialistThe plan is held until a person approves it. The customer is told it is a proposal.Approve the planChange itCall the customerAI Act Art. 14GDPR Art. 22Waiting for a person
- Plan confirmed to the customerOnly after the person’s approval.Locked
- Run recordedThe conversation, the options shown, the plan and who approved it.AI Act Art. 12On record
A sample, scripted on invented data: no model is called and nothing here is client work.
Where the law draws the line for you
Each rule with the day we read it. An engineer’s reading for your counsel to confirm, not legal advice. How we read the AI Act.
| Rule | What it says (our summary; quotes are verbatim) | What it means for an agent |
|---|---|---|
| CCD2 Art. 18(3)Read 12 November 2026 | The creditworthiness assessment is based on relevant and accurate information on income and expenses; it shall not include special categories of data under GDPR Art. 9(1). | Our agents don’t feed the assessment. Documents they collect go to your credit team as they are. |
| CCD2 Art. 18(9)Read 12 November 2026 | A rejected applicant is told without delay, referred to debt advice where relevant, and told if the assessment was automated and of their right to a human assessment. | Decision letters stay with your team; an agent can draft them from the decision a person took. |
| CCD2 Art. 35, 36Read 12 November 2026 | Creditors exercise “reasonable forbearance” before enforcement, where appropriate, and independent debt advice is available to consumers in difficulty. | The payment-plan assistant explains forbearance options and the debt-advice route; a person approves every plan. |
| AI Act Art. 5(1)(b)Read 12 November 2026 | Bans AI that exploits vulnerabilities “due to their age, disability or a specific social or economic situation” to distort behaviour in a way that causes significant harm. Applies since 2 February 2025. | No pressure, no urgency tactics, and signs of difficulty only ever route the customer to help. |
| GDPR Art. 9Read 12 November 2026 | Special-category data, such as health, needs an Art. 9(2) condition, and CCD2 keeps it out of the credit assessment. | When a customer mentions illness, the agent hands over and doesn’t store more than the conversation itself. |
| AI Act Art. 50(1)Read 12 November 2026 | Providers make sure people are told they are interacting with an AI system, unless that is obvious. Applies from 2 August 2026. | Customer-facing agents open with an AI notice in their first message. |
Nine layers around every agent, each with what is partial.
- Access and identityGoogle sign-in, revocable keys, an agent’s rights narrowed by its spec.Partial No MFA of our own and no enterprise SSO; open sign-up is on.
- Separation between clientsEvery record and search index filtered by the signed-in identity; a live agent gets its own containers and database.Partial Logical separation in one shared database, not yet tested independently.
- Hosting, network, encryptionHetzner, Nuremberg; HTTPS with HSTS; no inbound web ports; credentials sealed.Partial Stored data in general is not encrypted at rest.
- Only the data the task needsThe agent reaches only the systems its approved spec declares; secrets are scrubbed.Partial Personal data is not masked before the model.
- The model stepProvider set per deployment; each request admitted and recorded before it is sent.Partial The region is named in your contract, not promised EU-only.
- Untrusted content and testingDocuments are data, never instructions; a safety pack that must all pass.Partial No independent penetration test yet.
- A person decidesWrites wait for a person; a person approves every release; Stop and spend caps.Partial A live agent’s held actions are approved by our operator, not on your screen.
- Every run on recordEvery run recorded step by step, with approvals and who decided.Partial Append-only by convention, not tamper-evident; no client export screen.
- Deletion, export, backupsErasure with a receipt per step; a backup before every release.Partial Export and account deletion by hand, on request; backups not encrypted.
The supplier terms a supervisor expects.
DORA lists credit, payment and e-money institutions, investment firms and crowdfunding providers, among others (Art. 2(1)); a non-bank consumer lender may not be on that list. Banks, funders and supervisors often expect the same terms anyway, so we offer them either way.
- Register of informationThe facts your register needs for our contract: the service, the functions it supports, our sub-processors and where data is processed (Art. 28(3), Art. 30(2)(a), (b)).
- Audit and access rightsFor critical or important functions, unrestricted rights of access, inspection and audit for you, an auditor you appoint and your supervisor (Art. 30(3)(e)).
- An exit planAn exit strategy with a transition period, and the return of your data in an easily accessible format (Art. 28(8), Art. 30(2)(d), 30(3)(f)). Export is by hand today, on request.
- Incident reporting supportHelp in an ICT incident related to our service at a cost agreed in advance, fast enough for your initial, intermediate and final reports (Art. 19, Art. 30(2)(f)).
What the run records can tell your team.
An illustrative mock-up of a lender’s view. The figures are invented, not a client’s.
Why customers contact you
Complaint and risk signals
- Complaints opened
- 14
- Due within 3 days
- 2
- Difficulty signals routed to a person
- 37
- Payment plans held for approval
- 6
The records behind every view
Every run recorded step by step, every conversation visible, cost against daily and per-run caps, and test scores against your bar.
The dashboards themselves
Contact reasons, resolution and hand-off rates, complaint deadlines and risk signals are built in your project from those records, to the definitions your team signs.
A timeline up front, a fixed price after one call.
Most teams start with a readiness review of the process they have in mind, or go straight to a pilot when the use case is clearly outside the high-risk list. We don’t publish prices: the proposal after a short scoping call gives a fixed price for your scope, in EUR, excluding VAT.
All engagements and what moves the priceBook a callPrice on request
AI Act and GDPR readiness for one use case.
What’s in itBook a callPrice on request
One agent on one process, tested and approved.
What’s in itQuestions from consumer lending
Is an AI support agent for a lender high-risk under the AI Act?
Not if it stays out of creditworthiness and credit scoring. Annex III 5(b) lists AI used to evaluate the creditworthiness of natural persons or establish their credit score. A support agent that answers from your terms, collects documents and hands over to people is outside that point, and we write the reasons down. If its purpose moves towards the assessment, the classification changes with it.
What does CCD2 change for AI in consumer lending?
Directive (EU) 2023/2225 applies from 20 November 2026. Art. 18(8) gives consumers the right to human intervention, an explanation, to give their view and to request a review where the creditworthiness assessment involves automated processing. Art. 35 asks for reasonable forbearance and Art. 36 for access to independent debt advice. National laws set the details, so your counsel confirms them market by market.
Can an agent offer payment plans?
It explains the options your policy allows and prepares a plan from the customer’s own figures. A person approves every plan before it is confirmed. The agent is designed never to use pressure, urgency or signs of vulnerability (AI Act Art. 5(1)(b)).
Does DORA apply to a lender, and to you as its supplier?
DORA’s list in Art. 2(1) covers credit institutions, payment and e-money institutions, investment firms, crowdfunding providers and others; a non-bank consumer lender may not be on it. Many lenders still meet DORA’s ICT third-party terms because their banks, funders or supervisors expect it. We offer those terms either way: register entries, audit and access rights, an exit plan and incident support.
Can it work in several languages?
Yes. The agent answers in the customer’s language from your approved texts in that language, and each language gets its own test cases before release.
Do you score our staff’s conversations?
No. The quality desk scores the agent’s own conversations against your bar. Evaluating workers is a different use, listed separately in the AI Act’s Annex III (employment), and we don’t build it.
What does a first project cost?
Most start with a readiness review of one use case (2–3 weeks) or a pilot agent (6–10 weeks). We don’t publish prices: after a short scoping call, a written proposal gives a fixed price for your scope, in EUR, excluding VAT.
Related pages
Posts on these rules
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.