Short answer. A bank must give the applicant the specific principal reasons for a credit denial, not a score or a probability. The right to contest a solely automated decision is live today through GDPR Article 22, and the EU AI Act adds a right to a clear explanation for high-risk credit scoring from 2 December 2027. The reliable pattern has 3 parts: rank the top 3 to 5 factors that moved the decision, translate each into one plain sentence, and route the customer to a named human who can review it.
A credit decision that a customer cannot understand is a decision a bank cannot defend. When an AI model declines an application, the output is usually a score between 0 and 1 or a risk band. That number is the start of the work, not the answer the customer receives. Someone has to build the layer that converts the model output into reasons a person can read, check, and challenge.
In practice, three artifacts sit behind every automated credit decision:
Ableneo’s work across 34 production AI projects in 2025 shows the same pattern in every regulated build: the model is rarely the blocker. The explanation and governance layer around it is where projects stall or ship.
Credit scoring is named in Annex III of the EU AI Act as a high-risk use of AI. High-risk systems carry transparency and human-oversight duties, and after the Digital Omnibus (Regulation (EU) 2026/1744) the obligations for Annex III stand-alone systems apply from 2 December 2027. Banks that lend in the EU have that deadline to make every automated credit decision explainable and contestable by design.
The pressure is not only future-dated. GDPR Article 22 already gives an individual the right not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect, together with the right to obtain human intervention and to contest the outcome. A credit denial meets that bar. The explanation and appeal path is a live obligation today, and the EU AI Act raises the standard of proof a bank must show from December 2027.
A probability score is not a reason. The customer must receive the specific factors that drove the decision, in plain language.
A valid reason is specific, accurate, and tied to the applicant’s own data. A probability score is not a reason. Neither is a generic line like “you did not meet our credit criteria”. Regulators expect the principal factors that actually drove the decision for this person: a short credit history, a high level of existing debt relative to income, or recent missed payments. The reason has to reflect what the model used, not a plausible-sounding statement written after the fact. When the stated reason and the model’s real drivers do not match, the bank carries a compliance gap and a legal risk, because the customer can contest a decision the bank cannot substantiate.
Two regimes stack. GDPR Article 22 gives the right to human intervention and to contest a solely automated decision, and it is enforceable now. The EU AI Act treats credit scoring as high-risk and, through Article 13, requires high-risk systems to be transparent enough for a deployer to interpret and use the output correctly, with Article 86 adding a right for an affected person to obtain a clear explanation of an individual decision. For Annex III credit scoring, those obligations apply from 2 December 2027. A bank that designs for both at once builds one explanation and appeal path that satisfies the live GDPR duty and the coming EU AI Act standard, instead of retrofitting twice.
The technical step is feature attribution. Methods such as SHAP values, or the regression coefficients for simpler models, rank how much each input pushed the decision. The bank takes the top 3 to 5 factors for the individual case and maps each to a pre-written, plain-language statement reviewed by legal and compliance. The customer receives sentences, not scores. Two controls keep this honest: the reason codes are generated from the same model run that made the decision, and a sample of explanations is checked against outcomes so the stated reasons stay faithful as the model is retrained. Explanations written independently of the model, or after the decision, fail both the accuracy test and the audit test.
Give the customer a clear route and a real person. The appeal path has three parts: a plain notice that AI was used and that the applicant can request a review, a named human role with the authority and evidence to re-examine the case, and a logged outcome that records who reviewed it, what they saw, and what they decided. The human reviewer needs the reason codes, the input data, and the model version, so the review is a genuine second look rather than a rubber stamp. GDPR lets the customer ask for human intervention today, so a bank that automates lending needs this path in place before the first complaint, not after it.
Start with the reason-code layer and the decision record for the highest-volume automated product, usually consumer lending or credit cards. These two artifacts do most of the regulatory work: they make every decision explainable and reproducible. Add the human appeal path next, then extend the same pattern to other products. Building explanation into the system from the first release costs far less than adding it to a model already in production, where the bank has to reconstruct decisions it never recorded.
Ableneo builds AI as accountable systems, not black boxes. Across 34 production AI projects delivered in 2025, roughly 4 of 5 reached production, and the difference between the builds that shipped and the ones that stalled was almost always the governance and explanation layer, not the model. For a bank, that means treating the reason-code map, the decision record, and the human appeal path as part of the build from day one, designed with legal and compliance in the room. Ableneo’s AI Adoption work in financial services pairs the model with the controls a regulator and a customer can both read.
Key takeaways
Planning AI in a regulated business? Ableneo takes systems from classification to governed production.