Annex III Pack: EU AI Act evidence for lenders running LLMs

Nobody I found sells exactly this: a pack for consumer lenders and BNPL firms that runs tests against their own LLM setup and maps the results to Annex III 5(b) requirements. But the separate parts are already covered. LatticeFlow created COMPL-AI and already sells evidence mapped to the AI Act through its platform. ValidMind and Yields.io already sit with model risk teams at EU banks and produce validation documents. Openlayer and Giskard market AI Act testing to credit and banking customers. Running COMPL-AI is free and open source, so that part has no value to sell. COMPL-AI also measures general model behaviour, not whether a particular credit workflow meets Articles 9 to 15. That means the real work is the mapping for the specific use case, and that is what LatticeFlow and the MRM tools are moving toward. A new entrant could still win in a few ways. It could serve the long tail of mid-sized consumer lenders and BNPL firms that cannot justify a 60,000 euro or more MRM platform or an enterprise governance contract. It could build tests specific to credit that general benchmarks miss, such as fairness across protected groups in affordability and adverse-action explanations, consistency of LLM-extracted income and expense data, and resistance to prompt injection through applicant documents. It could produce an approval-committee document that fits existing SR 11-7 or EBA-style model approval templates rather than a generic AI Act report. And it could treat each prompt or retrieval-data change as a model change that triggers re-validation. There are two risks. First, high-risk obligations now appear to start in December 2027, so budgets may not open soon. Second, few lenders put LLMs directly into credit decisions; most use them in nearby steps such as document intake or collections, which may fall outside Annex III 5(b). The realistic play may be a narrow vertical wedge, or a service plus software model, that is later sold to or partnered with one of the platforms above.

• LatticeFlow AI (COMPL-AI, AI GO! platform, AI Atlas)

  LatticeFlow co-created COMPL-AI. Its commercial platform already runs evaluations mapped to the EU AI Act and FINMA and produces what it calls evidence-based, audit-ready technical assessments. In July 2026 it launched a single platform to discover, evaluate and govern AI risk, and it sells to regulated Swiss buyers, including banks. This is the closest direct competitor, and it owns the benchmark the idea relies on.

• COMPL-AI (open source)

  A free, open-source framework from ETH Zurich, INSAIT and LatticeFlow. It maps AI Act principles to 27 benchmarks. Anyone can run it, so running COMPL-AI on its own is not something a customer will pay for. It also targets general-purpose LLM behaviour, not the Annex III high-risk requirements for a specific credit use case.

• ValidMind

  A model risk management platform for banks that automates validation documentation. It has EU AI Act demo templates and LLM testing, and it is already sold to the model risk teams the idea targets.

• Yields.io

  A model validation and MRM platform based in Ghent. It claims HSBC and BNP Paribas as clients and lists EU AI Act audit-readiness features. Pricing starts at about 60,000 euros. It is an incumbent with model risk teams at EU banks.

• Openlayer

  An AI evaluation and observability platform that markets directly to credit scoring under the EU AI Act (Annex III 5(b)), with guides for financial services. It appears in Gartner's 2026 Market Guide for AI evaluation platforms.

• Giskard

  A French LLM testing company (open-source plus enterprise) covering bias, security and harmful output. It names BPCE and Societe Generale as customers and has an EU-funded AI Act conformity platform. It is well placed to add credit-specific evidence packs.

• Modulos

  An AI governance platform built around EU AI Act and ISO 42001 compliance evidence, which it pulls from engineering systems into audit-ready documentation.

• Holistic AI

  A governance platform focused on producing statistical bias and risk evidence for conformity assessment of high-risk systems.

• Credo AI

  An AI governance platform that turns the AI Act into policy controls, questionnaires and an AI-system registry. It is more about the policy layer than technical testing, but it competes for the same compliance budget.

Checked 2026-10-24