Level 4 · Consumer credit — AI Act + DORA

🟡 Partial — The risk loop is re-derivable today from the committed outputs of the public vldemo-loan-scoring repo (one tag per beat) and — unlike retina — it runs on a CPU in under a minute, so this level is RUN IT YOURSELF: you clone, check out the beat, and re-derive the verdict locally. The DORA layer is taught honestly as a deliverable, NOT a verdict: the engine emits a signed Register of Information (xBRL-OIM) + crosswalk, never a 'DORA-conformant' statement (the fairness verdict belongs to the AI Act / ISO, and it closes GREEN after treatment). The four loan tag links resolve on github.com/Venturalitica/vldemo-loan-scoring.

TL;DR

A consumer-credit scoring model (the demo bank is NovaCredit) reads an applicant’s profile and decides approve / deny. That decision gates someone’s access to credit, so the system is EU AI Act high-risk — but notice how. Level 3’s retina screener was high-risk through Art. 6(1) + Annex I (the product-safety route — it was a medical device). This one is high-risk through Annex III §5(b) — the USE route: evaluation of creditworthiness / credit scoring of natural persons. And there is a second regime, but it stacks for a different reason: the operator is a financial entity, so the model is also an ICT asset under DORA (Reg. EU 2022/2554). James (Quality) and Martha (engineer) run the familiar loop on the real Statlog (German Credit) dataset, measured OUT-OF-FOLD over all 1,000 rows (5-fold StratifiedKFold: every row is predicted by a model that never saw it train). The fairness gate is the lesson, and the lesson is honesty: the arc is AMBER → GREEN, not a one-shot manufactured RED→GREEN. With real power (1,000 rows, not a 200-row held-out) the untreated V1 is still inconclusive (its measured demographic_parity_diff ≈ 0.1050 sits above the < 0.092 gate, but the bootstrap CI dips to 0.0425 — it straddles the line). Martha applies the fairlearn DemographicParity treatment; the number drops to ≈ 0.0065 and this time the whole CI lands below the threshold (ci_high ≈ 0.0645) — the treatment demonstrates the residual, with real power. GREEN, conclusively. Then James requests and quality approves with the proxy-discrimination residual on record (cl. 11 turns from Gap to Covered) — a legitimate self-declaration (§5(b) credit has no external notified body), unlike retina’s pause. And DORA? DORA contributes a signed Register of Information (xBRL-OIM) — a deliverable the entity hands its compliance officer — never a conformity verdict. The one line to carry out: the fairness verdict is AI Act / ISO (GREEN after treatment); DORA is documentation, never “DORA gobernada”.

If you have not met the spine, the overlay idea, or your first overlay (health/MDR), read these first:

Level 3 · Retina screening — your first overlayThe first overlay: a retina screener that is AI Act high-risk via the product route (Art. 6(1) + Annex I) AND an MDR Class IIa device, closing at the honest notified-body GAP. Level 4 keeps the three-role structure (PO Nerea + QM James + dev Martha) and stacks a finance overlay (DORA) instead — and closes with a legitimate approve, not a pause.

More than the AI ActThe concept this level runs on: a sectoral regime stacked on the AI Act spine; one system, N regimes; the same signed bundle projected onto multiple catalogs — governed standards get real verdicts, MDR/DORA get a signed crosswalk + deliverable, NOT a verdict.

Prerrequisitos

Level 2 (the high-risk spine), More than the AI Act and Level 3 (your first overlay), plus What is a risk? for the RED / AMBER / GREEN vocabulary. A note on materials, because this level is different from retina:

You run it yourself. Retina was GPU-bound, so you watched the evidence. This one trains on Statlog (German Credit) — all 1,000 rows, measured OUT-OF-FOLD (5-fold) — on a CPU in under a minute. You can clone, check out a beat, and re-derive the verdict locally (§3). The committed evidence + nightly gate remain the source of truth — a fresh local re-train can drift on dependency versions; the gate never retrains.
Nerea (portal) declares the system; James (portal) reviews and approves; Martha (CLI + git) executes the pipeline and signs the evidence.

By the end you'll be able to…

Explain why this system is high-risk through Annex III §5(b) (the use route — creditworthiness), and contrast it with Level 3’s Art. 6(1) product route.
Say why DORA stacks on top (the operator is a financial entity, so the model is an ICT asset) and recite the GTM red line: DORA is ICT operational resilience, NOT model governance — never “DORA gobernada”.
Read an honest AMBER → GREEN arc and explain why measuring with real power (OOF over all 1,000 rows, not a 200-row held-out) is what lets the treatment demonstrate the residual — and why the engine won’t fabricate a RED, or a GREEN, its evidence can’t support.
Explain why this cycle closes with a legitimate approve (request + approve-with-residual-on-record), unlike retina’s notified-body pause.
Describe Article 12 (record-keeping) as git-native, ex-ante logging — the commit graph is the log — and state its honest boundary (it covers code / model / dataset reproducibility, not infra resilience).
Describe the DORA Register of Information (xBRL-OIM: B_01.01 entity / B_07.01 ICT function / B_05.01 third-party) as a signed deliverable + cross-map, NOT a conformity verdict, and name its honesty markers (fictitious LEI, sparse B_05.01, lossy vocabulary).

Lessons in this level

The framing — two regimes in financeA consumer-credit scoring model that is high-risk via the USE route (Annex III §5(b), creditworthiness) and, because the operator is a financial entity, carries DORA on top; what each law governs.

The arc, by handoffsThe fairness gate is honest AMBER→GREEN (measured OOF over all 1,000 rows: untreated V1 is AMBER, the fairlearn treatment demonstrates the residual and closes GREEN) and closes with request + approve-with-the-proxy-residual-on-record, a legitimate self-declaration.

In depth — Art. 12, DORA and the revisited articlesArticle 12 (record-keeping) as git-native logging, DORA as a deliverable (the xBRL-OIM Register of Information, not a verdict) and Articles 9/10/11 revisited under the second regime.

Practice & recapRun the credit arc on your laptop (CPU, ~1,000 rows), review the legitimate self-declaration with the residual on record, and self-check what you learned.