AI in Lending: Use Cases, Risks and a 90-Day Plan

Most lenders already use AI somewhere, and most of them cannot explain all of it. In the Bank of England and FCA survey Artificial intelligence in UK financial services 2024, 75% of firms said they were already using AI, a further 10% planned to within three years, and 46% admitted only a "partial understanding" of the AI technologies they use. That gap between adoption and understanding is the whole story of AI in lending right now.

The opportunity is real. Credit is a data business with thin margins, long manual queues and expensive mistakes, which is exactly the profile where machine learning and generative AI earn their keep. The risk is also real, because credit decisions sit under some of the oldest and least forgiving consumer protection law in existence. A model that cannot explain why it declined someone is not a clever model. In the United States it is a compliance problem, and in the European Union it will soon be a high-risk AI system.

This guide is written for the people who run lending operations: heads of credit, COOs of lenders and credit unions, founders of specialty finance companies, and the boards that oversee them. It covers where AI in lending pays back first, where it creates exposure, what the rules actually require, how to score your own readiness, and a 30/60/90 day plan that gets a first use case into production without betting the license on it.

What AI in lending actually means in 2026

The phrase covers three different families of technology, and confusing them is the first mistake most lenders make.

Predictive machine learning. Gradient boosted trees, neural networks and similar models trained on historical loan performance. They score applicants, predict default, flag fraud and estimate prepayment. This is the oldest and most regulated family, and it is where most of the measurable credit value has come from so far.

Generative AI. Large language models that read, summarize and draft. In lending they do not decide who gets credit. They read bank statements, extract data from tax returns and pay stubs, summarize a 90-page commercial credit file, draft adverse action letters for human review and answer borrower questions. Their value is speed on unstructured documents.

Agentic AI. Systems that chain steps together and take actions: request a missing document, reconcile it against the application, update the loan origination system, route the file to the right underwriter. This is the newest family and the least proven in regulated credit workflows.

The practical point is simple. Each family has a different risk profile and a different owner. A credit scoring model belongs to credit risk and model validation. A document extraction tool belongs to operations. An agent that touches the system of record belongs to both, plus IT security. When one committee tries to govern all three with the same checklist, it either blocks everything or approves everything.

Where the value pools sit

Lending value chains look similar whether you finance mortgages, small business loans, auto, equipment or consumer installment credit. The value from AI concentrates in five places:

1. Intake and document processing: turning PDFs, scans and statements into structured data.
2. Underwriting and decisioning: better risk separation, more approvals at the same loss rate, or fewer losses at the same approval rate.
3. Fraud and identity: synthetic identities, document tampering, first-party fraud.
4. Servicing and collections: early warning signals, contact strategy, hardship handling.
5. Portfolio and capital management: forecasting, stress testing, pricing.

Most lenders should not start with item two. I will explain why in the use case section.

Why AI in lending is different from AI anywhere else

I have worked on AI adoption in hospitality, healthcare, distribution and agriculture. In none of those sectors does a single model decision carry legal obligations to the person on the other side. In lending it does, and that changes the economics of every project.

Every decline needs a reason. Under the Equal Credit Opportunity Act and Regulation B, section 1002.9, a creditor that takes adverse action must give the applicant a statement of specific reasons, generally within 30 days of a completed application. The Consumer Financial Protection Bureau said explicitly in Circular 2022-03 that this obligation applies with no exception for complex or "black-box" algorithms. In May 2025 the CFPB withdrew dozens of guidance documents as part of a broader rollback, but the underlying statute and Regulation B did not change. If your model cannot produce accurate reasons, you cannot use it to decline people.

Fair lending exposure is measured on outcomes. A model can be built without any protected characteristic and still produce disparate outcomes through proxies such as geography, education or shopping behavior. Research published as an NBER working paper by Bartlett, Morse, Stanton and Wallace found that lenders charged Latinx and African-American borrowers 7.9 basis points more on purchase mortgages and 3.6 basis points more on refinances. The same study found that fintech algorithms also discriminated, but about 40% less than face-to-face lenders. The lesson cuts both ways: algorithms can reduce bias relative to human discretion, and they can also encode it at scale.

Model risk management is a supervisory expectation, not a nice to have. In April 2026 the OCC, the Federal Reserve and the FDIC replaced the model risk framework that had governed banks since 2011 with revised, more risk-based guidance. According to the Orrick summary of the revised model risk guidance, the new text is framed as most relevant to organizations above 30 billion dollars in assets and expressly excludes generative and agentic AI from its scope. That exclusion is not a free pass. It means those tools must be governed through the institution's broader risk management, without a ready-made template.

In Europe, credit scoring is high-risk AI by name. The EU AI Act lists, in Annex III, point 5(b), AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud. After the 2026 amendments, high-risk obligations for Annex III systems apply from 2 December 2027. Any lender serving EU consumers with a scoring model should treat that date as a build deadline, not a review date.

None of this means AI in lending is too risky. It means the cost of a project is not the license. It is the license plus explainability, validation, fairness testing, documentation and monitoring. Lenders who budget for the full stack ship. Lenders who budget for the model alone stall in validation for a year.

AI in lending use cases that pay back first

Here is the order I recommend, ranked by speed to measurable value and inversely by regulatory exposure.

1. Document intake and data extraction

This is the best first project for almost every lender. A loan file is a pile of documents: bank statements, tax returns, pay stubs, business financials, leases, titles, insurance certificates. Underwriters and processors spend a large share of their day reading them and retyping numbers into a system.

Generative AI and modern document models read these files, extract the fields, check internal consistency (does the income on the pay stub match the deposits in the statements?) and flag gaps. A human still reviews. The model never decides creditworthiness.

Why it pays back first:

• The output is checkable against the source document, so accuracy is easy to measure.
• It does not trigger adverse action rules because it does not decide.
• The metric is operational: minutes per file, files per processor per day, rework rate.
• It improves data quality for every downstream model, including your existing scorecards.

What to watch: extraction errors that silently flow into decisions. The control is a confidence threshold. Fields below the threshold go to a human. Fields above it are sampled weekly.

2. Fraud detection and identity verification

Fraud models were among the earliest machine learning deployments in financial services, and the Bank of England survey lists AML and combating fraud among the areas where firms see the highest current benefits. They also sit in a friendlier regulatory zone. The EU AI Act carves fraud detection out of the high-risk credit scoring category, and a fraud referral to manual review is not the same as a credit decline.

The newer opportunity is document fraud. Generative tools make fake pay stubs and edited bank statements cheap to produce. The defense is a mix of metadata analysis, cross-document consistency checks and transaction pattern analysis. This is a place where buying from a specialist usually beats building, for reasons I cover in the build vs buy AI software decision framework.

3. Underwriter co-pilot for commercial and specialty credit

For small business, commercial real estate, equipment and asset-based lending, the bottleneck is not a score. It is an experienced credit analyst reading a file and writing a memo. A generative AI co-pilot can draft the first version of the credit memo from the file: business summary, financial spreads, covenant analysis, key risks, comparable deals.

The analyst edits, challenges and signs. In practice the time saving comes from the first draft, and the quality gain comes from consistency: every memo covers the same sections, every covenant gets checked.

The rule: the co-pilot writes, the human decides, and the memo records which parts were machine-drafted. When an examiner or an investment committee asks how a decision was made, you want a clear answer.

4. Servicing, early warning and collections

Once a loan is on the books, AI helps in three ways. Early warning models predict which borrowers are drifting toward delinquency weeks before a missed payment. Contact strategy models decide when and how to reach out. Generative assistants help agents prepare for hardship conversations and summarize call outcomes.

The value here is loss mitigation, and it compounds. A 60-day head start on a struggling small business borrower is often the difference between a restructure and a charge-off.

Watch the conduct risk. Collections is where consumer protection enforcement concentrates. Automated messaging must respect contact frequency rules, consent and hardship disclosures. Any generative component that talks to borrowers needs tight scripting and logging.

5. Credit decisioning models

This is the use case everyone wants to start with, and the one I recommend doing fourth or fifth. Machine learning can separate risk better than traditional scorecards, especially for thin-file applicants, small businesses and borrowers whose income does not fit standard documentation. The upside is approving more good borrowers at the same loss rate.

But it carries the full regulatory stack: adverse action reasons, fair lending testing, model validation and, in the EU, high-risk AI obligations. If your data pipeline is still manual and your model governance is a spreadsheet, a new decisioning model will spend a year in validation. Do items one to three first, and you will arrive at decisioning with clean data, a working governance process and a team that has already shipped something.

If you want a sharper view of which of these five fits your book and your data today, this is the kind of diagnostic I run with lending teams. A short consultation request through the site is enough to start the conversation.

A worked example: one small business loan file

Abstract use cases are easy to agree with. Here is what the first three use cases look like on a single file, a 250,000 dollar working capital loan to a regional distributor.

Before AI. The processor receives 14 documents by email: two years of tax returns, twelve months of bank statements, interim financials, an accounts receivable aging, a lease and the owner's personal financial statement. She retypes revenue, debt service and balances into the origination system, chases two missing statements and passes the file to an analyst, who spends most of a day spreading financials and writing the memo.

With document intake. The extraction tool reads all 14 documents, fills the fields, links each value to its page and flags that the deposits in the bank statements run 18% below reported revenue. The processor reviews the flagged fields only and sends one targeted request to the borrower instead of two generic ones.

With fraud checks. The document tool notices that one bank statement has font and metadata inconsistencies with the others. The file is routed to fraud review before an analyst spends time on it.

With the co-pilot. The analyst receives a draft memo with the spread, the revenue gap, the covenant analysis and three questions to ask the owner. She rewrites the risk section, adds her judgment on the customer concentration and recommends approval with a tighter covenant.

The decision stayed human. The time moved from typing to thinking, and the file left a complete audit trail.

The risks that actually sink lending AI projects

Every project risk list includes "data quality" and "change management". These are the ones I see kill lending projects specifically.

Explainability bolted on at the end. Teams build a high-performing model, then discover that the explanation method produces reasons that are unstable or misleading. The fix is to choose the model and the explanation method together, test the reasons with real declined files, and confirm that a credit officer would sign each reason as accurate.

Proxy discrimination nobody tested for. A variable that looks neutral, like the type of device used to apply or the time of day, can correlate with protected characteristics. Fair lending testing must run before launch and on a schedule after it, on approval rates, pricing and terms, not only on the model's inputs.

Third-party models nobody understands. The Bank of England survey found that a third of AI use cases are third-party implementations, and firms reported weaker understanding of vendor models than of internal ones. If a vendor scores your applicants, you still own the adverse action notice and the fair lending outcome. Your contract must give you access to reason codes, validation evidence and performance data.

Generative AI hallucinating into a credit file. A model that invents a covenant, misreads a number or summarizes a document that was never uploaded can push a bad decision into the system. Controls: source citations on every extracted fact, confidence thresholds, and a rule that generated text never overwrites source data.

Shadow AI in underwriting. Analysts paste borrower financials into personal chatbot accounts to save time. That is a data protection incident waiting to happen and a governance blind spot. I wrote about the pattern in detail in the guide to shadow AI risk management. The answer is not a ban. It is a sanctioned tool that is faster than the workaround.

Drift after launch. Credit models are trained on a particular economic period. When rates, unemployment or a specific industry shift, performance degrades. Monitoring must compare predicted and actual default by segment, monthly, with a defined trigger for review.

What regulators expect, in plain terms

This is not legal advice, and your counsel should map these rules to your specific products and jurisdictions. But the common core is clear enough to plan around.

United States

• Adverse action reasons: specific, accurate, principal reasons for every decline or unfavorable change in terms, under ECOA and Regulation B. Generic statements that the applicant failed internal standards are not sufficient.
• Fair lending: no discrimination on prohibited bases in any aspect of a credit transaction, including through models. Testing for disparate impact and searching for less discriminatory alternatives is standard practice.
• Model risk management: banks follow the revised interagency guidance issued in April 2026; non-bank lenders often face similar expectations from partners, investors and state regulators.
• Vendor oversight: using a third-party model does not transfer responsibility.

European Union

• High-risk classification: creditworthiness and credit scoring of natural persons is listed in Annex III. Obligations for these systems apply from 2 December 2027. They include risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness requirements.
• Fraud detection exception: AI used to detect financial fraud is excluded from that specific high-risk category.
• Existing rules still apply: consumer credit rules, data protection law and banking supervision requirements continue to apply alongside the AI Act.

For a broader view of how compliance teams are using AI to meet these obligations, see the guide to AI for compliance.

What this means for your build plan

Three design decisions follow directly from the rules.

1. Separate decisioning from assistance. Tools that assist humans (extraction, summarization, drafting) carry a lighter burden than tools that decide. Keep the boundary explicit in your architecture and your documentation.
2. Log everything that touches a decision. Inputs, model version, outputs, reasons, human overrides. If you cannot reconstruct a decision six months later, you are not ready to automate it.
3. Make human oversight real. A reviewer who approves 400 files an hour is not oversight. Define what the human checks, how long it takes, and what authority they have to override.

The economics: where the money comes from

Lending AI business cases fail when they promise vague efficiency. They succeed when they tie to four numbers your CFO already tracks.

Cost per funded loan. Document automation and co-pilots reduce processing and underwriting hours per file. Measure minutes per file before and after, multiplied by loaded hourly cost.

Time to decision. Faster decisions win borrowers, especially in small business and commercial lending where competitors are a click away. Measure median days from complete application to decision, and pull-through rate.

Approval rate at constant loss. Better risk separation lets you approve more applicants without raising expected losses, or hold approvals and reduce losses. This is the largest value pool and the hardest to prove, because it requires a champion-challenger test or a careful back-test.

Fraud and credit losses avoided. Fraud models and early warning systems reduce charge-offs. Measure losses per million originated, by segment.

A practical rule I use with clients: a first lending AI project should pay back on cost per funded loan alone, within twelve months. Approval rate and loss improvements are upside, not the base case. That discipline keeps the first project small enough to ship and honest enough to survive a board review.

For the general method of building and defending an AI business case, the AI ROI for business guide walks through the structure in detail.

A note on scale

Lenders often assume AI only pays at bank scale. My experience in other sectors says otherwise. A sports distribution company I worked with grew sales by 30% with AI-driven marketing without building anything proprietary. A hotel moved from 9 to 10 million in revenue. A medical center gained 20% capacity. None of them started with the most advanced tool on the market. The pattern repeats in lending: the first gains come from removing manual work on documents and decisions you already make, not from inventing a new credit model.

Self-assessment: is your lending operation ready for AI?

Score each statement from 0 (not true) to 2 (fully true). Be honest. The scorecard is for you, not for a vendor.

Data foundation

1. Loan application data is captured in a structured system, not mainly in PDFs and email.
2. We can join application data with performance data (payments, delinquencies, losses) for at least three years.
3. We know where every field used in a credit decision comes from and who owns it.

Governance

4. We have a model inventory that lists every model and rule set used in credit decisions.
5. Every decisioning model has documented validation, including a test of its adverse action reasons.
6. We run fair lending analysis on approvals, pricing and terms at least annually.
7. We have a written policy on employee use of generative AI tools, and a sanctioned tool available.

Operations

8. We measure minutes per file, time to decision and pull-through by product.
9. Underwriters and processors have a named owner who can approve workflow changes.
10. We have at least one person who can evaluate an AI vendor's model documentation critically.

Vendor management

11. Our credit and fraud vendor contracts give us access to reason codes, performance data and validation evidence.
12. We know which of our vendors already use machine learning or generative AI inside their products.

How to read your score

• 0 to 8: Start with data and governance. A document extraction pilot is possible, but fix the model inventory and the generative AI policy first.
• 9 to 16: You are ready for one or two assistive use cases (document intake, underwriter co-pilot, early warning). Do not start with decisioning.
• 17 to 24: You can consider a decisioning model, provided validation, fair lending testing and adverse action reasons are designed in from day one.

A more general version of this exercise, not specific to credit, is in the AI readiness assessment guide.

A 30/60/90 day roadmap for AI in lending

This plan assumes a mid-size lender or credit union starting with an assistive use case, which is the right first step for most.

Days 1 to 30: choose, scope, protect

• Pick one product line and one bottleneck. For example, small business loan document intake, or commercial credit memo drafting. Not "underwriting" in general.
• Baseline the metrics. Minutes per file, rework rate, time to decision, pull-through. Without a baseline you will not prove anything.
• Write the generative AI policy. What data can go into which tool, who approves new tools, how outputs are reviewed. Launch a sanctioned tool at the same time so the policy has an alternative to offer.
• Inventory existing models and vendors. You will be surprised how much machine learning is already inside your fraud, identity and decisioning vendors.
• Define the boundary. Write down, in one page, that the pilot assists humans and does not make credit decisions. Get credit risk and compliance to sign it.

Days 31 to 60: build and test in the shadow

• Run the tool in parallel. The AI extracts or drafts; humans keep doing the work the old way. Compare outputs file by file.
• Measure accuracy by field. Income, debt, account balances, dates. Set confidence thresholds per field based on the results.
• Test failure modes. Poor scans, unusual document formats, missing pages, deliberately altered statements.
• Train the users. Underwriters need to know what the tool does well, what it gets wrong and how to report errors. Ten hours of focused training beats a hundred-page manual.
• Prepare the documentation. Purpose, data, performance, limitations, controls, owner. This is the file you will show an examiner or auditor.

Days 61 to 90: go live with controls

• Switch to assisted production. The tool does the first pass; humans review and correct. Track corrections as a quality metric.
• Set up monitoring. Weekly sample review, monthly accuracy report, a named owner for drift and incidents.
• Report results to the board or credit committee. Before and after on the baseline metrics, incidents, lessons, and a recommendation on the next use case.
• Decide the next step. Extend to another product line, add a co-pilot, or begin designing a decisioning model with the governance you have now proven.

If you would like help pressure-testing a plan like this against your own products and constraints, you can request a consultation through the site, and we can look at it together.

How to choose AI vendors for lending

Most lenders will buy more than they build. The questions that separate good lending AI vendors from the rest are specific.

On models and data

• Which decisions does your product make, and which does it only support?
• What data was the model trained on, and how recent is it?
• Can we see validation results on a sample of our own files before we sign?

On explainability and fairness

• How does your product generate adverse action reasons, and how do you test that they are accurate?
• What fair lending testing do you perform, and will you share the results?
• How do you handle a request from our regulator for model documentation?

On generative AI specifically

• Is customer data used to train your models or your provider's models?
• Does every extracted value link back to its source location in the document?
• What happens when the model is uncertain? Is there a confidence score we can act on?

On operations

• Where is our data stored and processed, and can we choose the region?
• What are the logs we get, and how long are they retained?
• What is the exit path if we switch vendors?

A vendor that cannot answer these clearly is selling you a demo, not a lending tool. For the broader picture on how banks and credit unions are deploying AI across the institution, not only in credit, see the AI for banking guide.

The operating model: who owns lending AI

Technology is rarely the constraint. Ownership is.

Business owner. The head of the product line or of credit operations owns the outcome and the metric. Not IT, not innovation.

Model risk and validation. An independent function, internal or outsourced, that challenges the model before launch and reviews it on a schedule. In smaller lenders this can be a qualified external validator.

Compliance and fair lending. Reviews the use case boundary, adverse action design, consumer communications and testing results.

Data and IT. Owns pipelines, access control, logging and vendor integration.

Front line. Underwriters, processors and collectors who use the tools daily. Their feedback is the most reliable early warning signal you will get. Give them a simple way to flag errors and show them that flags lead to changes.

One governance committee should see all AI use cases in one inventory, with a risk tier for each. Assistive tools can follow a lighter approval path. Decisioning tools go through full validation. The AI agent governance guide covers the additional controls needed once systems start taking actions, which is where lending operations are heading next.

Common mistakes to avoid

• Starting with the most regulated use case. Decisioning first is the slowest route to value.
• Buying a platform before defining the bottleneck. Tools in search of a problem become shelfware.
• Measuring model accuracy instead of business outcomes. An AUC improvement nobody can translate into approvals or losses will not survive budget season.
• Treating the vendor's validation as yours. Regulators and courts will look at your outcomes.
• Ignoring the front line. If underwriters do not trust the tool, they will redo its work and the savings disappear.
• No monitoring after launch. Credit environments change. A model that worked in a low-rate period may misbehave when conditions shift.

Where AI in lending goes next

Three shifts are already visible.

Agents in the origination workflow. Systems that request missing documents, reconcile them and route files will move from pilots to production in the next two years. The governance question will be who approves each action, and how errors are rolled back.

Cash flow underwriting. Bank transaction data, analyzed by machine learning, is extending credit to applicants with thin or unusual credit files. It is one of the most promising uses for financial inclusion, and one of the most sensitive for fair lending.

Regulatory convergence on documentation. Whether through the EU AI Act, revised model risk guidance or examiner expectations, the direction is the same: document purpose, data, performance, limitations and oversight. Lenders who build that documentation habit now will move faster later.

The lenders who win will not be the ones with the most advanced models. They will be the ones who can explain every decision, measure every improvement and ship one controlled use case after another.

FAQ

What are the best AI in lending use cases to start with?

The best starting points are assistive use cases that do not make credit decisions: document intake and data extraction, fraud and document tampering detection, and an underwriter co-pilot that drafts credit memos for human review. They pay back through lower cost per funded loan and faster decisions, their accuracy is easy to check against source documents, and they carry lighter regulatory exposure than decisioning models. Credit decisioning models usually come later, once data pipelines and model governance are proven.

Can lenders use AI models to approve or decline loans?

Yes, but with conditions. In the United States, ECOA and Regulation B require specific and accurate reasons for every adverse action, and the CFPB has stated that complex algorithms are not exempt. Lenders must also test for fair lending outcomes and validate the model. In the European Union, AI used to assess the creditworthiness of individuals is classified as high-risk under the AI Act, with obligations applying from 2 December 2027. The model can inform or make decisions only if it can be explained, tested and monitored.

How much does AI in lending cost to implement?

The license or build cost is only part of it. A realistic budget includes data preparation, integration with the loan origination system, model validation, fair lending testing, documentation, user training and ongoing monitoring. For a first assistive use case at a mid-size lender, these supporting costs often equal or exceed the software cost. A good rule is that the first project should pay back within about twelve months on cost per funded loan alone, without counting approval or loss improvements.

Is AI in lending regulated under the EU AI Act?

Yes. Annex III of the EU AI Act lists AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score as high-risk, with an exception for systems used to detect financial fraud. After the 2026 amendments, obligations for Annex III high-risk systems apply from 2 December 2027. They include risk management, data governance, technical documentation, logging, human oversight and accuracy requirements. Consumer credit, data protection and banking rules continue to apply alongside the AI Act.

Does AI reduce or increase bias in lending?

It can do either. Research by Bartlett, Morse, Stanton and Wallace found that fintech algorithms still charged minority mortgage borrowers more, but discriminated about 40% less than face-to-face lenders. Algorithms remove some human discretion, yet they can also learn bias from historical data or proxies such as location. The outcome depends on fair lending testing before launch and after it, on approval rates, pricing and terms, and on searching for less discriminatory alternatives when gaps appear.

Will AI replace underwriters?

Not in the near term, and not in complex credit. AI removes the most repetitive parts of the job: reading documents, retyping numbers, drafting the first version of a memo. Underwriters spend more time on judgment, exceptions and borrower relationships. In small business and commercial lending the human decision remains central, and regulators expect meaningful human oversight of automated tools. The role changes from data processor to reviewer and decision maker.

How long does it take to deploy a first AI use case in lending?

A focused assistive use case, such as document extraction for one product line, can reach controlled production in about 90 days: 30 days to scope, baseline and set policy, 30 days of parallel testing, and 30 days of assisted production with monitoring. Decisioning models take longer, often six to twelve months, because of validation, fair lending testing and adverse action design.