Watching Conformly audit Kreda
Kreda is a neobank putting AI into production, sure the EU AI Act doesn't apply to them. Scroll down to see what a two-minute audit actually finds — and what each finding means, without the legal jargon.
Kreda
Banking that thinks ahead. · Consumer fintech / neobank (fictional)
“We're just a banking app. The AI Act is for the big AI labs, not for us — we don't even build models.”
- Loan DecisioningApproves or declines credit applicationsdeclared
- Help botIn-app customer support assistantdeclared
- Trust ScoreRates customers from social & behavioural dataundeclared
- AI Coach avatarSynthetic video 'financial coach' in the appundeclared
- Spending CategorizerLabels transactions (groceries, rent…)undeclared
The founder named 2. A read-only scan of the code found 5. Here is what each one means — in plain words.
Trust Score
Scrapes a customer's social media and unrelated behaviour into a general 'trustworthiness' score that changes what the app lets them do.
This is banned. Ranking people with a general 'good citizen' score built from unrelated behaviour — and then treating them worse because of it — is exactly the social-scoring the Act outlaws. It has to go.
In plain words: You can't give people a life-score from their social media and then punish them with it. That's the thing the law was written to stop.
Art. 5Article 5(1)(c) prohibits social scoring: evaluating people from social behaviour or personal traits in a way that leads to detrimental treatment in contexts unrelated to where the data was collected. In force since 2 February 2025.
Switch it off. A general cross-context 'trust' score has no compliant form.
Conformly classifies it as a prohibited practice with the article and the reason, so it's caught internally — not in a regulator's letter.
An inspector would open with: "Explain every score you assign to a customer, what data feeds it, and what it changes for them."
Loan Decisioning
Decides who gets a loan or credit limit, and how much.
Deciding whether someone can borrow money is high-stakes for their life, so the law makes it high-risk. You can keep it — but you must prove it's fair, keep a human able to overrule it, and document the whole thing.
In plain words: If the computer decides your loan, the rules say it has to be checkable, fair, and never fully on autopilot.
Annex IIIAnnex III(5)(b) lists AI that evaluates creditworthiness or sets a credit score of natural persons as high-risk (fraud detection excepted), triggering Articles 9–15.
Begin the high-risk checklist: fairness/bias testing, a human-override path, and the Annex IV technical file.
Conformly generates the obligation list, tracks the evidence, and produces the Annex IV file and the customer-facing transparency the Act expects.
An inspector would open with: "Show your risk-management system and the records proving the model doesn't discriminate."
Help Bot
Answers customer questions in the app.
Same simple rule as any chatbot: tell people it's an AI. One clear sentence covers it.
In plain words: A helpful bot is fine — as long as it admits it's a bot.
Art. 50Article 50(1) requires people interacting with an AI system to be told so, unless it is obvious. Applies from 2 August 2026.
Add "You're chatting with Kreda's AI assistant" to the chat header.
Conformly hosts the public transparency page and the embeddable disclosure chip for you.
AI Coach Avatar
A synthetic video avatar that gives users spoken financial tips.
A realistic AI-generated person on screen has to be labelled as artificial — visibly, because it looks like a real human — and the media itself must carry a machine-readable mark.
In plain words: If the friendly face giving advice is a deepfake, users have to be told it isn't a real person.
Art. 50(2) & 50(4)Article 50(2) requires machine-readable marking of synthetic media; Article 50(4) adds a visible disclosure for deepfakes that resemble real people. Marking transition runs to 2 December 2026.
Add a visible "AI-generated" label to the avatar and machine-readable provenance to the video.
The obligation lands on your task list, and the watermark checker confirms whether the video already carries provenance metadata.
Spending Categorizer
Sorts transactions into categories like groceries or rent.
Nothing owed. It tidies up a list; it doesn't decide anything about the person. Minimal risk.
In plain words: Auto-sorting your receipts doesn't affect anyone's rights. It's fine.
—Not high-risk and outside Article 50 — minimal-risk, voluntary good practice only.
No action required. Keep it listed so the record is complete.
Conformly records it in your inventory so your 'nothing else here' is documented, not assumed.
The verdict
Kreda thought the AI Act was somebody else's problem. The scan found a feature they had to kill immediately, a lending model that needs a full compliance file, and two disclosure fixes — while their receipt-sorter was fine all along.
That startup was made up. Your AI isn't.
The same deterministic engine can classify your real systems in two minutes — no sign-up, no sales call. Or drop the read-only scanner into your codebase and see what it finds.
npx conformly-scan --dry-run
An example audit — a realistic walkthrough of how Conformly's deterministic engine classifies this kind of AI product. Not legal advice.