The machine can make the recommendation in milliseconds. The duty to explain, review and defend the outcome still belongs to people and institutions.
A consumer applies for a loan on a phone, connects a bank account, consents to a credit check and receives a rejection before the kettle boils. Behind that apparently simple answer may sit a bank's underwriting policy, a fintech interface, a credit-bureau file, an alternative-data feed, a fraud model, a machine-learning score and a vendor's decision engine. If the result is wrong, discriminatory, inexplicable or based on bad data, who is responsible?
The intuitive answer - the algorithm - is legally useless. Software has no licence to lose, no board to question and no customer complaint desk. Accountability attaches to the organisations that design, deploy, supply data to, rely on and supervise the system. The harder question is how that responsibility is divided when several firms participate in a decision that no single employee fully reconstructs in real time.
That division is becoming clearer, but not uniform. In the United States, current Regulation B still requires creditors to give specific reasons for adverse action, while bank regulators make clear that outsourcing does not outsource compliance. In Europe, data-protection case law has pushed accountability upstream toward credit scorers, and a new consumer-credit regime will add explicit rights to human intervention and review from 20 November 2026. The EU AI Act adds another layer, although its key high-risk requirements for Annex III systems were delayed in July 2026. The result is not one global rule, but a common direction: automated lending must remain attributable to accountable humans and legal entities.
The first principle: a lender cannot point at the machine
For a regulated bank, the starting point is blunt. The Federal Reserve, FDIC and OCC say in their interagency guidance on third-party relationships that using a third party does not diminish a banking organisation's responsibility to operate safely and comply with applicable law to the same extent as if the activity were performed in-house. That matters because many AI lending stacks are assembled rather than built: a bank may buy the score, rent the model, outsource the onboarding interface and rely on a cloud provider, yet still own the regulated activity.
Responsibility can also overlap. Under the current Regulation B definition of a creditor, a person that regularly participates in a credit decision - including by setting the terms of credit - can itself be a creditor. The official interpretation says the term includes all persons participating in the credit decision. A fintech that merely supplies generic software may therefore occupy a different legal position from a fintech that determines eligibility, sets pricing or materially participates in underwriting. The commercial label on the partnership is less important than what each party actually does.
This creates an accountability stack rather than a single accountable actor. The bank cannot contract away its own regulatory duties. A vendor may separately face contractual, data-protection, consumer-reporting or AI-provider obligations. A credit bureau can be responsible for the accuracy and handling of its data. Senior management remains responsible for governance and escalation. When a system fails, regulators and courts can ask several different questions at once: who made the credit decision, who supplied the decisive data, who controlled the model, who could have stopped the outcome and who owed the consumer a remedy?
In US law, the rejection notice is where accountability becomes visible
US law does not give every rejected applicant a right to inspect a lender's source code. It does, however, force the lender to translate a denial into a humanly intelligible reason. Current Regulation B section 1002.9 requires adverse-action reasons to be specific and to identify the principal reason or reasons. Saying that an applicant failed to meet an internal policy or did not achieve a qualifying score is insufficient. The official interpretation adds a crucial constraint for automated underwriting: the reasons disclosed must relate to and accurately describe factors that were actually considered or scored.
That distinction is important. An adverse-action notice is not the same thing as a complete technical explanation of a model. Regulation B does not require the creditor to explain every mathematical step or disclose proprietary code. But a model that cannot reliably map its output back to the real factors that drove the decision creates an operational compliance problem. If the production system says no because of variable A, while the notice generator selects a plausible-sounding variable B, the institution has not merely produced a weak explanation; it may have produced an inaccurate one.
US regulatory update: do not rely on superseded AI circulars
The CFPB's 2022 circular on complex algorithms and its 2023 circular on adverse-action notices were withdrawn on 12 May 2025. They should not be presented as current CFPB guidance. The underlying notification rule remains in the current text of Regulation B: reasons must be specific and tied to factors actually considered or scored.
A second US regime can matter when a consumer report contributed to the decision. The Fair Credit Reporting Act requires users of consumer reports to notify consumers when adverse action is taken on the basis of such a report. The FTC's current business guidance explains that the notice identifies the consumer reporting agency, tells the consumer that the agency did not make the lending decision, and gives rights to obtain and dispute the report. This is a different accountability channel: the lender owns the decision, while the consumer can challenge the underlying file with the reporting agency.
The US fair-lending backdrop also changed in 2026. A CFPB final rule published on 22 April and effective 21 July 2026 states that ECOA does not recognise disparate-impact liability and removes the regulation's effects test. Intentional discrimination and disparate treatment on a prohibited basis remain unlawful under Regulation B. The change narrows one federal theory of liability; it does not make model governance optional. Other federal statutes, state laws, contractual duties, prudential expectations and reputational risks may still matter, and inaccurate adverse-action reasons remain a separate issue.
Europe is pulling the upstream score into the accountability chain
Europe approaches the same problem through a denser combination of data protection, consumer-credit law and AI regulation. The GDPR says a person generally has the right not to be subject to a solely automated decision that produces legal or similarly significant effects, subject to specified exceptions and safeguards. Recital 71 uses the automatic refusal of an online credit application as an explicit example. Where the contractual-necessity or consent exceptions apply, Article 22 requires safeguards that include human intervention, the ability to express a point of view and the ability to contest the decision.
The Court of Justice of the European Union has made clear that responsibility cannot always be parked at the final lender. In the 2023 SCHUFA judgment, the Court held that an automatically generated probability score can itself amount to automated individual decision-making where the third party receiving the score draws strongly on it to establish, implement or terminate a contractual relationship. In other words, an upstream score can become legally significant when it effectively determines the downstream answer.
The Court went further on explainability in its February 2025 Dun & Bradstreet Austria judgment. It said that meaningful information about the logic involved in automated decision-making must explain the procedure and principles actually applied in a concise, transparent and intelligible way so the individual can understand how personal data were used to produce the specific result. A complex formula dump is not enough. This does not amount to a universal right to source code; it is a requirement for an explanation that makes the specific automated outcome understandable and contestable.
A further shift arrives soon. Article 18 of the EU Consumer Credit Directive 2023/2225 requires Member States, where creditworthiness assessment uses automated processing of personal data, to give consumers the right to obtain human intervention from the creditor, a clear and comprehensible explanation of the assessment and its logic and risks, the ability to express their view, and a review of both the creditworthiness assessment and the lending decision. Member States were required to transpose the directive by 20 November 2025, and the measures are to apply from 20 November 2026.
EU AI Act timing changed in July 2026
The EU AI Act classifies AI used to evaluate the creditworthiness or credit score of natural persons as a high-risk use case, subject to the Act's detailed conditions and exceptions. However, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, moved the application of key Chapter III high-risk requirements for Annex III systems to 2 December 2027. The delay does not suspend GDPR or sector-specific consumer-credit obligations.
Where accountability sits in an AI lending stack
The practical mistake is to search for one entity that is responsible for everything. Modern lending systems distribute functions, but regulators usually assign duties according to role. The following map is a governance view rather than a universal statement of legal liability; the exact answer depends on jurisdiction, contract and facts.
| Actor | Where responsibility usually attaches | Typical failure that exposes the gap |
| Lender / creditor | Credit policy, eligibility rules, pricing, final adverse action, notices, oversight of third parties. | A model is deployed without sufficient testing; notice reasons do not match production drivers; complaints cannot trigger meaningful review. |
| AI or decision-system vendor | Model design, documentation, change control, performance evidence and contractual obligations. It may also have direct regulatory duties depending on role and jurisdiction. | Opaque updates, undocumented feature changes, weak reason-code mapping, unreported model drift or subcontractor changes. |
| Credit bureau / data provider | Accuracy, provenance and dispute handling for data it supplies, subject to applicable consumer-reporting and data-protection rules. | Incorrect identity match, stale balance, corrupted attribute or an unexplained score that materially drives the decision. |
| Human reviewer / operations team | Meaningful review, authority to correct data, override where appropriate, record rationale and escalate recurring defects. | Rubber-stamp review, no access to relevant evidence, no authority to change the outcome, or no audit trail. |
| Board and senior management | Risk appetite, governance, accountability structure, vendor oversight and assurance that consumer outcomes are controlled. | Responsibility is diffused across model risk, compliance, data and product teams until no one owns the end-to-end decision. |
The table shows why contractual indemnities are not the same as regulatory accountability. A bank may obtain compensation from a vendor after a defective model causes losses, but that contract does not erase the bank's duty to oversee the activity. Conversely, a vendor that materially participates in the credit decision may not be able to avoid direct obligations merely by describing itself as a technology supplier. The facts of the workflow matter.
A human in the loop can still be a rubber stamp
As regulators demand human intervention, institutions face a subtle temptation: insert a person at the end of the workflow and declare the system non-automated. That can be governance theatre if the reviewer sees only the model's recommendation, lacks access to the underlying data, has no practical authority to override it or is measured almost entirely on speed.
Meaningful review requires more than a click. The reviewer needs enough information to identify the relevant drivers, a route to correct bad data, authority to change or escalate the outcome, and a record of what happened. Inference from the emerging European framework is straightforward: if the point of human intervention is to let a consumer challenge an automated assessment, the human must be capable of changing something that matters. A human who cannot alter the decision is a control in name rather than substance.
There is also a statistical warning sign. If a supposedly meaningful review process handles large volumes but almost never changes an automated outcome, that does not by itself prove the process is defective. It should, however, prompt questions about reviewer independence, information quality, incentives and thresholds. Override rates are not a compliance target, but they can be a useful diagnostic when read alongside complaint themes, error rates and data corrections.
The hardest problem is not explainability. It is decision provenance
The debate over explainable AI often focuses on whether a complex model can produce a reason code. That is only part of the challenge. A bank needs to reconstruct the decision that was actually made, not a generic approximation of how the model usually behaves. That means preserving decision provenance: the model version, input data, feature transformations, thresholds, policy rules, external scores, reason-code logic and any manual intervention that existed at the time of the application.
This becomes especially difficult when a lending journey combines several models. A fraud model may block an application before the credit model runs. A cash-flow model may generate attributes that feed a second score. A policy engine may override the model because of a minimum income rule. A third-party score may be refreshed between application and review. If the institution cannot identify which component actually caused the adverse action, the consumer-facing explanation can drift away from the production reality.
For this reason, explanation should be designed as part of the decision architecture rather than bolted onto it after launch. Each production decision needs an auditable path from source data to feature to model or rule to outcome to notice. That path is also what internal audit, compliance, model risk and customer-service teams need when they investigate a complaint. The same infrastructure therefore serves legal defensibility, operational resilience and customer trust.
Britain is taking a principles-based route
The UK illustrates a different regulatory philosophy. The Information Commissioner's Office says the data-protection provisions of the Data (Use and Access) Act 2025 are now in force. The Act broadens the lawful bases available for significant automated decisions while retaining safeguards. In financial services, the FCA said in June 2026 that it intends to rely on existing frameworks including the Consumer Duty, the Senior Managers and Certification Regime, and governance and control expectations rather than create a separate AI rulebook.
That approach reinforces a broader point: accountability does not depend on a regulator writing the word 'AI' into every rule. Existing duties around consumer outcomes, senior management, data protection, creditworthiness and outsourcing can attach to an automated system because the system is part of the regulated firm's activity. Technology changes the evidence and control problem; it does not automatically change who is answerable for the business outcome.
The innovation counterargument: opacity can be the price of better prediction
Lenders and model developers have a legitimate counterargument. More complex models can capture interactions that simpler scorecards miss, and alternative data can potentially help evaluate applicants with thin conventional credit files. Forcing every decision into a small set of easy-to-explain variables could reduce predictive power, slow approvals or discourage experimentation. A rule that effectively mandates simple models could therefore protect explainability at the expense of access or price competition.
But the choice is not necessarily between a transparent bad model and an opaque good one. The regulatory question is whether an institution can make a consequential decision and still produce faithful reasons, detect errors, handle disputes and demonstrate control. The 2025 Dun & Bradstreet judgment is instructive because it rejects two extremes at once: a controller cannot satisfy transparency merely by providing a complex formula, yet meaningful information does not require dumping the entire algorithm on the consumer. The target is intelligibility about the specific result.
Trade-secret protection raises a similar tension. Vendors may reasonably resist disclosing proprietary model details to customers or competitors. Banks, however, cannot manage what they are contractually prevented from understanding. A workable middle ground is tiered transparency: consumers receive clear, decision-specific reasons; the lender receives enough technical documentation, testing access and audit rights to govern the system; regulators and independent reviewers can obtain deeper evidence when legally entitled. Opacity cannot be the business model for accountability.
What defensible AI lending looks like
For banks, the core design principle is reason fidelity: the reason given to the applicant should be generated from the same production evidence that drove the adverse action, not from a separate explanatory model that merely resembles it. That requires testing reason-code logic before launch and after material model changes, including edge cases where multiple rules and models interact. It also requires retaining enough historical data to reproduce a challenged decision months later.
Vendor contracts need to support that architecture. Audit rights, change notifications, access to model documentation, data lineage, incident reporting, performance monitoring and subcontractor transparency are not procurement boilerplate when the vendor touches credit decisions. The Federal Reserve's third-party guidance specifically emphasises the bank's need for timely, accurate and comprehensive information, rights to audit and remediation, and ongoing monitoring. If a vendor will not provide the information needed to comply, the vendor may be commercially convenient but operationally unusable for a regulated credit decision.
For fintechs, the key question is role clarity. A company that presents itself as a neutral software layer should examine whether, in practice, it is setting terms, determining eligibility or otherwise participating in the credit decision. That can change the legal analysis. Fintechs also have an incentive to make governance a product feature: versioned model cards, reproducible decisions, configurable reason codes, audit logs and structured complaint feedback can become differentiators when bank partners are choosing systems they can defend to supervisors.
For regulators, the challenge is to supervise the chain without assuming that every model is a monolith. A harmful outcome may originate in source data, feature engineering, policy rules, a vendor update, human override or the combination of several components. Supervision that asks only for a model validation report can miss the decision system around the model. The more useful question is whether an institution can trace a real consumer outcome end to end and show who owned each control.
For investors, automated underwriting should be treated as a governance and contingent-liability issue, not merely a productivity story. A lender that approves faster but cannot explain denials, reconstruct decisions or control vendor changes may be accumulating legal, remediation and reputational risk off balance sheet. Conversely, strong decision provenance can be evidence that a firm's AI advantage is operationally durable rather than dependent on fragile black-box infrastructure.
Conclusion: the algorithm is not the accountable party
When an AI system rejects a loan, responsibility rarely belongs to one actor alone. The lender remains accountable for the regulated lending activity it chooses to automate. A fintech may acquire its own obligations if it materially participates in the credit decision. A credit bureau or data provider can be answerable for the data it supplies. Senior management is responsible for governance, and a human reviewer is only meaningful if the reviewer can understand, challenge and change the outcome.
The emerging global standard is therefore less about giving algorithms legal personality than about preventing institutions from hiding behind them. US law focuses heavily on accurate, specific adverse-action reasons and third-party oversight. European law increasingly connects explanation and review rights to upstream scoring as well as downstream decisions. The UK is using existing outcome and accountability frameworks rather than a bespoke AI code. Different routes are converging on the same principle: if a machine can say no, a responsible institution must still be able to say why - and stand behind the answer.
References
1. Consumer Financial Protection Bureau - 12 CFR Part 1002, Equal Credit Opportunity Act (Regulation B) - Current regulation; most recently amended 21 July 2026.
2. Consumer Financial Protection Bureau - Section 1002.9 Notifications - Current adverse-action notification rule and official interpretation.
3. Consumer Financial Protection Bureau - Section 1002.2 Definitions - Current definition and interpretation of creditor.
4. Consumer Financial Protection Bureau - Withdrawn Guidance - Lists AI-related Circular 2022-03 as withdrawn 12 May 2025; page also catalogues other withdrawals.
5. Federal Register - Equal Credit Opportunity Act (Regulation B), 91 FR 21620 - Final rule effective 21 July 2026.
6. Federal Reserve - Interagency Guidance on Third-Party Relationships: Risk Management - Joint Federal Reserve, FDIC and OCC guidance.
7. Federal Trade Commission - Fair Credit Reporting Act - Statute page; revised March 2026.
8. Federal Trade Commission - Using Consumer Reports for Credit Decisions - Adverse-action and risk-based pricing notice guidance.
9. EUR-Lex - General Data Protection Regulation (EU) 2016/679 - Articles 15 and 22 and Recital 71.
10. Court of Justice of the European Union - SCHUFA Holding, Case C-634/21 - Judgment of 7 December 2023 on automated credit scoring and Article 22 GDPR.
11. Court of Justice of the European Union - Dun & Bradstreet Austria, Case C-203/22 - Judgment of 27 February 2025 on meaningful information about automated logic.
12. EUR-Lex - Directive (EU) 2023/2225 on Credit Agreements for Consumers - Article 18 automated-processing safeguards; measures apply from 20 November 2026.
13. EUR-Lex - Regulation (EU) 2024/1689, Artificial Intelligence Act - High-risk classification framework, including creditworthiness AI.
14. EUR-Lex - Regulation (EU) 2026/1744 - Amended AI Act application timetable; Annex III high-risk Chapter III requirements from 2 December 2027.
15. Information Commissioner's Office - Data Use and Access Act 2025: what it means for organisations - Updated 19 June 2026; data-protection provisions in force.
16. Financial Conduct Authority - AI in financial services: shaping our approach through industry engagement - 8 June 2026 statement on principles-based AI oversight.