When the AI system refuses credit: the AI Act and the right to an explanation in automated financial decisions
Credit scoring as a high-risk AI system
In practice, the refusal of a credit application is not communicated in dramatic terms. The applicant is not told that a statistical model has placed them in a risk band, that certain variables decisively influenced the outcome, or that their financial profile was compared against the history of persons deemed similar. More often than not, they receive a neutral formula: “insufficient score”, “ineligible risk profile”, “internal lending criteria not met”.
This neutrality of language is, however, no longer sufficient. With Regulamentul 2024/1689 privind inteligența artificială (Regulation 2024/1689 on artificial intelligence) (hereinafter the “AI Act” or the “Regulation”), automated financial decision-making enters a new stage of legal scrutiny. The AI Act permits the use of artificial intelligence in lending on condition that the system is governed, supervised and, in certain situations, explained to the person affected.
The Regulation classifies as high-risk AI systems those intended to evaluate the creditworthiness of natural persons or to establish their credit score, with the exception of systems used to detect financial fraud. This classification follows expressly from Anexa III pct. 5 lit. b) (Annex III, point 5(b)), under the heading of access to essential private services.
The European legislator’s choice is hardly surprising. In practice, access to credit may determine whether a person buys a home, refinances their debts or sustains their professional activity. A system that influences such a decision cannot therefore be treated as a mere technical tool.
Provider, deployer and human oversight: who is in fact accountable
The AI Act distinguishes between the provider of the AI system (provider) and the party using that system under its own authority (deployer). In the financial sector, the deployer will ordinarily be the financial institution that uses the system in its own assessment process and takes the decision affecting the client, while the provider may be a separate entity offering that service, or an entity within the banking group.
Article 86 of the AI Act places the right to an explanation on the deployer: the person affected is entitled to obtain clear and meaningful explanations of the role of the AI system in the decision-making procedure and of the main elements of the decision taken. A bank will not be able to answer convincingly that “the model belongs to the provider” or that “the algorithm is proprietary”. If the institution uses the system in its own lending decision, it must be able to explain, in terms that are useful to the person affected, how that system weighed in the outcome.
This duty to explain rests on a distinct procedural requirement: human oversight. Article 14 requires deployers to assign oversight to persons with the necessary competence, training and authority to avoid blind reliance on the output, automation bias, and to be able to disregard, override or halt the use of the output where the circumstances so require.
The mere presence of a human in the decision-making chain does not, however, amount to human intervention in the legal sense. If, for instance, the employee merely rubber-stamps the score, without genuine competence and without the ability to alter the outcome, the oversight is purely formal. In lending, the human decision-maker must be able to verify the accuracy of the data, identify atypical situations and justify upholding or changing the outcome.
Deployers must also use the system in accordance with the instructions for use, ensure that the input data under their control is relevant and sufficiently representative, monitor the operation of the system, and keep the logs generated by the system for at least six months, where those logs are under their control.
The right to an explanation: minimum practical content
Article 86 does not establish a general right to disclosure of the algorithm, the source code or the full mathematical weightings (indeed, an opaque technical formula may be just as useless to the person affected as an unreasoned refusal). The requirement is a different one: the person affected must receive a clear and useful explanation.
In practice, a useful explanation in lending matters should include:
a. whether an AI system was used and at which stage of the lending process it intervened; b. whether the system’s output was advisory, decisive or disqualifying; c. the main categories of data taken into account and the factors that materially influenced the outcome; d. whether there was effective human intervention and within what limits; e. what data the applicant may correct and what the review procedure is.
Formulations such as “the decision was taken in accordance with internal policies”, “the score does not allow approval” or “the model indicates high risk” communicate the outcome, but not the reasoning behind it. Yet the right to an explanation concerns precisely that reasoning. A properly constructed explanation enables the person to understand, to challenge, to correct the data and to request a genuine review.
Prior governance and the fundamental rights impact assessment
The duty to explain cannot be treated as an after-the-fact communications exercise. It presupposes prior governance of the system. For high-risk systems, the AI Act imposes requirements as to data quality, transparency, documentation and monitoring in use.
Article 10 requires that the data sets used for training, validation and testing be subject to appropriate governance practices, including examination of possible biases, measures to prevent and mitigate them, and assessment of the relevance, representativeness and quality of the data.
Article 13 requires high-risk AI systems to be sufficiently transparent to enable the deployer to interpret the output and use it appropriately. The instructions for use must set out the system's purpose, its level of accuracy, its limitations, the known risks, the characteristics relevant to explaining the output and the information needed to interpret that output.
For AI systems intended to assess creditworthiness or establish a credit score, the AI Act further requires deployers to carry out a fundamental rights impact assessment before use. That assessment must describe the processes in which the system will be used, the duration and frequency of use, the categories of persons affected, the specific risks, the human oversight measures and the governance and complaints mechanisms.
The assessment is not a bureaucratic annex. For a financial institution facing litigation or an inspection, that document may become the cornerstone of its defence. If carried out properly, it shows that the risks were understood and addressed proportionately. If carried out as a mere formality, it demonstrates precisely the opposite: the risks were known but not managed.
GDPR, CJEU case law and Directive 2023/2225
The AI Act does not operate in a vacuum. Regulation 2016/679 (hereinafter the “GDPR”) already regulates decisions based solely on automated processing, including profiling, where they produce legal effects or significantly affect the data subject. Article 22 GDPR enshrines the right not to be subject to such a decision and requires, in the relevant cases, safeguards such as human intervention, the right to express one's point of view and the right to contest the decision.
Recent case law of the Court of Justice of the European Union has substantially clarified the applicable standard. In Case C-634/21, SCHUFA Holding (Scoring), judgment of 7 December 2023 (ECLI:EU:C:2023:957), the Court held that the automated establishment, by a credit information agency, of a probability value concerning a person's ability to meet payment obligations constitutes an automated decision within the meaning of Article 22 GDPR where the third party receiving the score draws on it in a determinative manner when entering into, performing or terminating a contractual relationship.
In Case C-203/22, Dun & Bradstreet Austria, judgment of 27 February 2025, the Court reinforced the standard of explanation. The dispute arose from an Austrian mobile telephony operator's refusal to conclude with a customer a contract worth approximately EUR 10 per month, a refusal based on an unfavourable score supplied by Dun & Bradstreet Austria. The factual context is therefore one of credit scoring used for an apparently trivial commercial contract, yet the legal consequences for the data subject and the principles laid down by the Court apply mutatis mutandis to cases of refusal by a bank.
The Court stated that the data subject may request meaningful information about the logic involved, and that the explanation must describe the procedure and the principles actually applied in using their personal data to arrive at a specific outcome. Neither the communication of a complex mathematical formula nor an exhaustive description of every technical step will suffice; the explanation must be relevant, concise, transparent, intelligible and easily accessible. Where the controller invokes trade secrets or the rights of third parties, the relevant information must be made available to the supervisory authority or to the court, which will strike the balance between the competing interests.
This standard is also helpful in interpreting the AI Act: the explanation must not be confused with the disclosure of a trade secret, but neither may it be stripped of substance by invoking one.
In the field of consumer credit, Directive 2023/2225 adds a further layer of protection. Where the creditworthiness assessment involves automated processing of personal data, the consumer must be able to request human intervention, a clear and comprehensible explanation of the assessment (including the logic and the risks involved), to express their point of view and to request a review of the assessment and of the decision on granting the credit.
The result is an overlap of regimes: (i) the GDPR protects the data subject in relation to data processing and automated decisions; (ii) Directive 2023/2225 adds sector-specific safeguards for consumer credit; (iii) the AI Act introduces governance and transparency obligations for high-risk AI systems. For financial institutions, the challenge is not to choose between these regimes, but to align them within a single, coherent and verifiable process.
Timetable for application, penalties and the right to lodge a complaint
Under the AI Act's original timetable, the rules for the high-risk AI systems listed in Annex III should apply from 2 August 2026. That timetable may be amended by the Digital Omnibus on AI package proposed by the Commission in November 2025. Both the European Parliament and the Council have supported postponing the application of certain rules, with fixed deadlines: 2 December 2027 for the standalone systems listed in Annex III and 2 August 2028 for systems embedded in products regulated on a sectoral basis. It should be stressed that negotiations are ongoing.
As regards penalties, the AI Act leaves it to the Member States to lay down the rules, but sets significant ceilings. Non-compliance with certain obligations of operators, other than the prohibited practices, may attract administrative fines of up to EUR 15,000,000 or up to 3% of total worldwide annual turnover, whichever is higher.
In addition, Article 85 of the AI Act grants any natural or legal person who has grounds to consider that the Regulation has been infringed the right to lodge a complaint with the market surveillance authority. Read together with the right to an explanation under Article 86, this mechanism is set to become a predictable route of challenge in practice. For the customer of a bank or of an IFN (non-banking financial institution) in Romania, this translates into a complaint to ASF or BNR, as the case may be, accompanied by the correspondence with the institution, the explanation of the refusal and, where applicable, evidence concerning the fundamental rights impact assessment.
Beyond the penalties, what is at stake is evidential, reputational and commercial. An institution unable to explain a credit refusal influenced by an AI system risks appearing to have delegated the decision to a black box.
The explanation as evidence that the decision was reasonable
The AI Act does not turn every credit refusal into litigation, nor does it require financial institutions to publish their algorithms. What it does change is the benchmark of what is normal. Whereas a lending decision could traditionally remain, for the most part, within the institution's internal risk policies, under the Regulation a decision influenced by a high-risk AI system must be capable of being explained externally (to the customer, to the sectoral supervisory authority, to the court).
For banks and IFNs, the operational objective is to build an intelligible decision file: accurate data, a documented model, genuine human oversight, available logs, a challenge procedure and explanations tailored to the person affected. Ultimately, using an AI system in a lending decision is not a bad thing in itself; it becomes one when no one within the institution that used the system can explain the decision it has taken.
Marius Stanciu, Partner, Buju Stanciu & Associates