Yes, in most cases. No EU or UK law bans AI from business lending as such. But the EU AI Act calls AI that scores the credit of natural persons high risk. GDPR also limits decisions that only a machine makes about people. A company is not a person, but a sole trader or a personal guarantor is.
This is not legal advice. I checked the sources below on 28 October 2026. Rules and guidance change, so ask a lawyer before you build a process on this.
The EU AI Act
The AI Act sorts AI uses by risk. Annex III lists the high-risk uses. Point 5(b) covers "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score". It leaves out AI used to detect financial fraud. You can read the list on the AI Act Service Desk of the European Commission. The full law is Regulation (EU) 2024/1689 on EUR-Lex.
So scoring a limited company is not on the list. Scoring a sole trader is, since a sole trader is a natural person. So is scoring a director who gives a personal guarantee.
High risk does not mean banned. It means extra duties for the maker and the user of the system. These cover data quality, records, human oversight and clear information for the person.
On dates, the Commission's AI Act page says the rules for the Annex III high-risk areas "have been extended to 2 December 2027". The same page says the rules on AI literacy have applied since 2 February 2025. That means staff who use AI should understand it. The Commission updated the page on 19 October 2026, and I read it on 28 October 2026.
I think a tool that only reads documents, lists what is missing and runs checks does not judge creditworthiness. A tool that gives a score or advice about a person may. If you are not sure which one you have, ask a lawyer.
GDPR Article 22
Article 22 gives a person the right not to be subject to a decision "based solely on automated processing". It applies when the decision has legal effects, or a similar big effect, on that person. A refused loan is an example.
There are exceptions. The decision may be needed for a contract, the law may allow it, or the person may give explicit consent. Even then, safeguards apply. The person can ask for a human to look at the decision, give their view and contest it. The text is in the GDPR on EUR-Lex and is also quoted in the judgment below.
The rule protects people and not companies. A decision about a limited company falls outside it, unless it is really a decision about the person behind the company.
What the SCHUFA ruling added
In December 2023 the EU's top court ruled on a German credit agency. The case is C-634/21, known as SCHUFA on EUR-Lex. The court held that an automated score of a person's ability to pay can itself be an automated decision under Article 22(1). That is so when another firm "draws strongly" on the score to start, run or end a contract with that person.
For a lender this has a clear meaning. If a score drives your decision, a human who clicks approve does not make it a human decision. The review must be real. The court did not write a checklist for what real means. The UK regulator gives the clearest guide I found.
The UK position
The UK has its own version of these rules. After the Data (Use and Access) Act 2025 they sit in Articles 22A to 22D of the UK GDPR. The ICO updated its guidance on automated decision-making on 31 March 2026. It is still draft guidance, so the final text may change.
On human involvement, the ICO says it must be active and not a token gesture. The reviewer should be able to change the outcome. They should be trained and should look at the data behind the decision. Spot checks are not enough. A person who only designed the system does not count.
The ICO gives the automatic refusal of a credit application as a decision with a big effect. It says people should be told about such decisions. They should be able to give their view and to ask for a human review.
The FCA says on its AI approach page that it does not plan to add extra rules for AI. It relies on rules that already exist, such as the Consumer Duty and the senior managers regime.
Lending to limited companies mostly sits outside FCA authorisation. Gov.uk says you probably need authorisation if your customer is a sole trader or a small partnership. A partnership with fewer than four partners counts as small, and so does an unincorporated association. So again, the people who fall inside the rules are the ones who are not companies.
What to do in practice
- Split each AI step into one of four jobs: it reads, it checks, it scores or it decides.
- Note who is assessed in each case, since a company alone is one case and a company with a personal guarantee is another.
- If a score is used for a person, make the review real. The reviewer sees the facts and their sources, can change the result, and writes down why.
- Keep a record of what the system showed, who looked at it and what they decided.
- Tell applicants when AI is used and give them a way to ask for a human review.
- Train the staff who use the tools.
A worked example
This is an example with made-up details. It is not a real lender.
A lender uses a model that gives each application a score from 0 to 100. A credit officer approves anything above 70 with one click and does not open the file. A limited company applies, and its only director gives a personal guarantee.
The loan is to a company, so Article 22 does not cover that decision. But the model also scores the director as the guarantor, and the officer relies on that score. The director is a natural person. The AI Act treats scoring them as high risk. Under SCHUFA, a one-click approval is unlikely to count as human review.
A better design has the officer open the facts, each linked to a document. If you use a model, it shows its reasons. The officer can change the outcome and writes down why.
What can and cannot be automated
Reading documents, finding facts, chasing missing papers and running checks you have set are lower-risk jobs. They prepare the file. They do not judge a person.
A decision about a person's credit is different. If you automate that, treat the system as high risk and keep a person who truly decides.
Klarefi is built for the first group. It reads what the applicant sends, asks for what is missing, runs the checks you set and links each fact to its source. It does not score or decide. Your credit team makes the decision.
For the rest of the file, use the document checklist as a base. Our guide to loan software covers the wider process.