A new law, no inventory.
Halden & Co. lends to households and small businesses in four Nordic markets. Credit decisions relied on statistical and machine-learning models built by different teams over a decade, and no one could say how many were in production.
- 27models found in production
- 9used in credit decisions
- 0with complete documentation
Credit scoring is one of the high-risk uses named in the EU AI Act, and Halden’s supervisor had announced a thematic review of model governance. Data science, risk and IT each owned part of the picture, but no one owned the whole.
The chief risk officer asked for a framework that would satisfy the supervisor and that her own team could keep running after we left.
Find, classify, then govern.
Our legal and regulatory team worked with Halden's CRO, data science leads and internal audit, with monthly updates to the board risk committee.
- 01
Build the inventory
We interviewed 31 model owners and traced every automated decision back to the model behind it, finding 27 in production.
- 02
Classify the risk
We assessed each model against the Act and confirmed nine credit-decision models as high-risk, with gaps listed for each.
- 03
Hand over the framework
We wrote the governance policy, documentation templates and sign-off process, and trained the CRO's team to run them.