Is an AVM high-risk under the EU AI Act?

What point 5(b) says

Annex III, point 5, covers "access to and enjoyment of essential private services and essential public services and benefits". Two of its four entries concern private financial services:

• 5(b): "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud."
• 5(c): "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance."

Neither mentions property, collateral or valuation. Point 5(c) is limited to life and health insurance, so an insurer using an AVM to check a sum insured on a house is outside it.

The question for a bank is therefore whether its AVM is "intended to be used to evaluate the creditworthiness of natural persons". The answer turns on the words *intended* and *creditworthiness*.

What creditworthiness means

The AI Act does not define creditworthiness. The Commission's draft guidelines on high-risk classification, published on 19 May 2026, do (paragraph 296): "the assessment of a natural person's ability and willingness to fulfil its contractual obligations to pay for the services provided or the credit granted." The inputs the draft names are about the person: "demographic data (such as age, the level of education or the place of residence) and/or ... financial data including payment behaviour, credit history and income".

The draft does not mention property valuation or collateral in its section on point 5(b). It is a draft; the Commission ran a consultation on it, and the final text can change.

EU mortgage law already treats the property's value and the borrower's ability to pay as two separate questions. Article 18(3) of the Mortgage Credit Directive reads: "The assessment of creditworthiness shall not rely predominantly on the value of the residential immovable property exceeding the amount of the credit or the assumption that the residential immovable property will increase in value". Article 19 then deals with property valuation on its own, with its own standards and its own independence rules for appraisers.

Where a combined system may still be caught

The draft guidelines draw a line that helps here. A system used only for pricing a loan is not covered by point 5(b), "even if it relies on data obtained from a creditworthiness assessment", but "an AI system which combines the two functionalities in one system in an integrated process ... will qualify as such a high-risk use case" (paragraph 300).

The same logic applied to valuation gives three cases:

Prudential use and the Article 6(3) filter

Recital 58 of the AI Act deals with prudential use. After explaining why credit scoring is high-risk, it adds: "AI systems provided for by Union law ... for prudential purposes to calculate credit institutions' and insurance undertakings' capital requirements should not be considered to be high-risk under this Regulation." Since CRR3, Article 208(3a) of the CRR provides for models that monitor collateral values, and Article 229(1) lets banks use those monitoring results when they set the property value that feeds capital requirements. A recital does not bind, but it shows what the legislator meant.

Article 6(3) then sets a filter. Even a system that falls under Annex III is not high-risk if it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons", for example because it performs "a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III". The exception is a system that profiles natural persons, which Article 6(3) says "shall always be considered to be high-risk". A provider relying on Article 6(3) must document its assessment and register the system in the EU database (Article 6(4) and Article 49(2)); the Digital Omnibus shortened what that registration has to contain.

Is an AVM an AI system?

The Act defines an AI system as "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions" (Article 3(1)).

The Commission's guidelines on that definition, published in February 2025, place some kinds of system outside it. Two of those kinds matter for AVMs. One is simple prediction systems that rely on basic statistical rules; the other is tools that only speed up established methods such as linear regression. A gradient-boosted model that learns price patterns from tens of thousands of properties is unlikely to fall in those groups. A plain hedonic regression might. Banks should classify each model they use on its own.

What applies anyway

Even if an AVM is not high-risk, three sets of rules still apply to it:

1. 1

   AI literacy (Article 4, as amended by the Digital Omnibus)

   Providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf".

2. 2

   Banking rules on models

   CRR Article 208(3a) and EBA guidelines Section 7.4 already require documentation, back-testing against transaction prices, data quality, responsibility and independent validation. EBA mapped the AI Act against banking law in 2025, with a focus on credit scoring. It found "no significant contradictions" and called the Act "complementary to EU banking and payment sector legislation, which already provides a comprehensive framework to manage risks".

3. 3

   Data protection

   An address linked to an owner is personal data under the GDPR.

The dates after the Digital Omnibus

1. 1 August 2024

   The AI Act enters into force

   Regulation (EU) 2024/1689, Article 113
2. 2 February 2025

   Prohibited practices and AI literacy apply

   Article 113
3. 19 May 2026

   The Commission publishes draft guidelines on high-risk classification

   European Commission
4. 8 July 2026

   The Digital Omnibus on AI is signed

   Regulation (EU) 2026/1744
5. 24 July 2026

   The Digital Omnibus is published in the Official Journal

   Regulation (EU) 2026/1744
6. 27 July 2026

   The Digital Omnibus enters into force, three days after publication

   Regulation (EU) 2026/1744
7. 2 August 2026

   General date of application of the AI Act

   Article 113
8. 2 December 2027

   Obligations for the high-risk systems in Annex III, including point 5(b), apply

   Article 113 as amended by Regulation (EU) 2026/1744
9. 2 August 2028

   Obligations for high-risk systems covered by Annex I (products) apply

   Article 113 as amended by Regulation (EU) 2026/1744

What to do now

• List every model that touches a lending decision, and for each, write down its intended purpose in one sentence.
• Keep valuation and borrower scoring as separate systems with separate documentation, if that matches how they are used.
• Where a valuation feeds a decision on a natural person, record how, and who reviews it.
• Watch for the final Commission guidelines on high-risk classification.

Where Bytero Engine fits

Bytero Engine values properties. It takes no information about borrowers, assigns no credit score and makes no lending decision. A bank that uses it for collateral monitoring keeps the valuation separate from its own credit assessment, which is the setup the table above reads as outside point 5(b).