What automation can decide and what it cannot establish
Automated systems can retrieve financial information, calculate debt-service ratios, score repayment risk and recommend approval or rejection. Some use deterministic rules, while others use statistical or machine-learning models. The creditor must identify which components determine creditworthiness, which only verify identity or detect fraud, and which directly make a legally relevant decision. A score predicting default does not necessarily evaluate affordability or the borrower's ability to meet the specific repayment schedule. Credit amount, instalment dates, existing obligations and reliable income should be connected to the calculation where required. Record the model's purpose, product scope, input definitions, output meaning and decision authority. A lending process can be fully digital while still needing documented policy exceptions and meaningful human oversight under the applicable regime.
CCD2 automated processing and consumer rights
Article 18(8) of Directive (EU) 2023/2225 provides for human intervention rights when the creditworthiness assessment involves automated processing of personal data. The consumer must be able to seek a comprehensible explanation concerning the assessment, its automated logic and effects, express their point of view, and request review of both the assessment and the credit-granting decision. Article 18(9) separately addresses rejected applications and relevant information duties. These requirements must be read with national implementing measures, which generally apply from 20 November 2026, and with any applicable GDPR duties. The Directive's transposition deadline in November 2025 is not the same as its general application date. A lender should evaluate present national law independently instead of assuming every CCD2 provision has already become operative.
UK responsible lending and decision governance
UK FCA CONC 5.2A requires a reasonable creditworthiness assessment for relevant lending decisions, including repayment and affordability risks. Using an automated model does not remove this obligation. The creditor should establish whether the data and estimation method are reasonable in the circumstances and whether known adverse information was considered appropriately. The firm must retain sufficient records and governance to show that the assessment was undertaken in accordance with applicable rules. UK GDPR automated decision-making protections may also be relevant depending on the specific process and legal conditions. Review the actual decision structure: an officer who simply rubber-stamps a recommendation may not provide meaningful intervention where it is required. A well-governed automated workflow should support lawful assessment, not obscure how decisions were reached.
US underwriting models and adverse action
US ECOA and Regulation B prohibit discrimination on specified bases and impose adverse-action notification requirements in covered circumstances. Regulation B section 1002.9 and its official interpretation require principal reasons that accurately reflect the factors actually considered or scored. A creditor cannot use a complex model as a reason to provide vague statements such as internal policy or insufficient qualifying score. The Fair Credit Reporting Act may impose additional duties when consumer report information is used. For defined covered residential mortgages, Regulation Z has specific ability-to-repay requirements. There is no universal US federal rule exactly matching every CCD2 creditworthiness obligation for all lending products. Models should therefore have product-specific legal mappings for input restrictions, explanation logic, recordkeeping and any state-law requirements.
Testing bias, model drift and data reliability
Model validation must address more than predictive accuracy. Examine data lineage, missing values, stale bureau records, irregular incomes, duplicate financial transactions and customer groups for whom training data is sparse. Test whether results change unexpectedly when legally irrelevant attributes are introduced or when a financial data provider changes its classification rules. Assess discrimination risks under the applicable law and avoid treating correlations as a defence for prohibited outcomes. Validate that the model considers the relevant proposed repayment obligations instead of a generic score unrelated to the product. Track overrides, approval distributions, hardship complaints and subsequent repayment outcomes for signs of drift. Changes to features, weights or third-party services should require documented approval and regression testing before release.
Audit evidence and fallback procedures
An assessment record should capture customer and agreement identifiers, permitted data inputs, source timestamps, model version, rules triggered, outputs, final decision and explanations delivered. Access controls and retention policies must reflect applicable privacy and consumer reporting obligations. Provide controlled handling for missing data, customer disputes, inaccurate reports and requests for human review where required. Reviewers need enough information and authority to reconsider the assessment instead of automatically reproducing the machine recommendation. Maintain incident procedures for inaccurate scores, misclassified expenditure and biased outcomes, including identifying affected agreements and appropriate remediation. Periodically test the full path from application to communication, because a correct model can still generate a legally deficient disclosure or decision notice.
Frequently asked questions
Does every automated decision require the same human review process?
No. The applicable right depends on the legal regime and the nature of the decision or processing.
Can a creditor rely on an old assessment for any credit limit increase?
Not automatically. Some significant increases require updated assessment and current data.
When do revised CCD2 national measures generally apply?
From 20 November 2026, subject to national commencement and transition.
Primary sources
Directive (EU) 2023/2225 Article 18 ↗FCA Handbook CONC 5.2A ↗CFPB Regulation B section 1002.9 ↗CFPB Regulation Z section 1026.43 ↗Read the source in its current version. National implementing measures and product-specific applicability may require additional research.