From the original research pack. This draft has not received a complete claim-by-claim review. Fees, product terms, statistics and legal status may have changed. Its preparation date is not a publication date. Use the linked original sources.

When you apply for a loan or credit card, there's a good chance a statistical model — increasingly, a machine-learning model — helps decide the answer and the price. Lenders say these tools can approve more people at lower risk. Critics worry they can bake in bias and produce decisions no one can explain. U.S. law already has something to say about both.

Last updated September 17, 2026.

Key takeaways

  • U.S. lenders using AI remain bound by the Equal Credit Opportunity Act (ECOA) and the Fair Credit Reporting Act (FCRA), which prohibit discrimination and require explaining denials [1][2].
  • Lenders must give applicants specific principal reasons for adverse actions; the CFPB said in a 2022 circular that complex algorithms are no excuse for vague reasons, though it listed that circular as withdrawn in May 2025; the underlying legal requirement still applies [1][9].
  • The federal approach changed sharply: a CFPB final rule effective July 21, 2026, states that ECOA does not provide for disparate-impact liability [15][16]. Intentional discrimination remains illegal, and states have continued to act — Massachusetts settled with a student lender over AI underwriting in 2025 [5].
  • The EU AI Act classifies AI used to assess individuals' creditworthiness as high-risk; after a 2026 amendment, those obligations apply from December 2, 2027 [6][13].
  • Consumers keep key rights: to a reason for denial, a free copy of the credit report used, and to dispute errors [2].

How lenders use AI

Underwriting is the process of deciding whether to lend and on what terms. Traditional underwriting relies on credit scores, income, and debt ratios, typically combined in relatively simple statistical models.

AI and machine learning (ML) models differ in two ways:

  1. More variables. They can weigh hundreds or thousands of data points and find complex, non-linear interactions.
  2. More data types. Some lenders use alternative data — information outside traditional credit files, such as bank account cash flow, rent and utility payments, or employment and education details.

Uses include approval decisions, pricing (interest rate), credit-line setting, fraud detection, and collections.

Related field note

The promise

Proponents argue AI can score "credit invisible" consumers (people with no or thin credit files) using cash-flow data, and predict risk more accurately, which could expand access. In a June 2025 update, the CFPB estimated that 2.7% of U.S. adults were credit invisible in 2020 [7].

The risks

  • Proxy discrimination: Even without using race or sex, a model can rely on variables correlated with protected characteristics (for example, ZIP code or certain educational institutions).
  • Biased training data: Models learn from historical lending outcomes shaped by past discrimination.
  • Opacity: Complex "black box" models make it harder to explain individual decisions.
  • Data errors: More data sources mean more ways for inaccurate information to affect decisions.

The U.S. legal framework

Equal Credit Opportunity Act and Regulation B

ECOA prohibits creditors from discriminating against applicants on the basis of race, color, religion, national origin, sex, marital status, age (provided the applicant can legally contract), receipt of public assistance income, or exercise of rights under consumer credit laws [1].

Courts and regulators have historically recognized two theories of discrimination:

Theory What it means AI example
Disparate treatment Treating applicants differently because of a protected characteristic A model explicitly using age in a prohibited way
Disparate impact A neutral practice that disproportionately harms a protected group without sufficient business justification, or when a less discriminatory alternative exists A model feature that screens out a protected group more than necessary to predict risk

Disparate impact is the theory most relevant to AI, because unfair outcomes often arise from correlations rather than intent. In 2026 the CFPB formally rejected it as a basis for liability under ECOA (see below), though that position may be challenged and other laws still matter.

Adverse action notices: the explainability requirement

When a creditor denies credit or offers worse terms, Regulation B requires a notice stating the specific principal reasons — or disclosing the right to request them [1]. The FCRA separately requires notice when a decision is based on a consumer report, including the right to a free copy of that report and to dispute inaccuracies [2].

The CFPB addressed AI directly:

  • Circular 2022-03 stated creditors can't use complex algorithms as a reason to avoid providing specific, accurate reasons for adverse action [3].
  • Circular 2023-03 stated creditors can't simply pick the closest item from a sample checklist if it doesn't reflect the actual reason — for example, if a model relied on behavioral spending data [8].

In May 2025, the CFPB withdrew 67 guidance documents [9]. The CFPB's withdrawn-guidance page lists both Circular 2022-03 and Circular 2023-03 as withdrawn on May 12, 2025 [9], even though the Circular 2022-03 page itself still displayed no withdrawal notice as of September 17, 2026 [3]. Either way, the underlying statutory and Regulation B requirement to give specific reasons remains law.

For lenders, this pushes toward explainable AI techniques — methods that identify which inputs most influenced a particular decision — or toward simpler, more interpretable models.

Model risk management

Banks' models are also subject to supervisory expectations on model risk management, notably the Federal Reserve and OCC's 2011 guidance (SR 11-7), which calls for validation, documentation, and ongoing monitoring [10].

Where U.S. policy stood in 2025–2026

  • Executive order on disparate impact. In April 2025, an executive order directed federal agencies to deprioritize enforcement of statutes and regulations to the extent they include disparate-impact liability (Executive Order 14281, signed April 23, 2025) [4].
  • CFPB Regulation B rule. The CFPB published a final rule on April 22, 2026, effective July 21, 2026, stating that "ECOA does not provide for disparate impact liability," narrowing the "discouragement" standard, and restricting for-profit lenders' use of race, color, national origin, or sex in special purpose credit programs [15][16]. Disparate treatment remains prohibited. Legal challenges are expected; check for litigation before relying on the rule.
  • State enforcement continued. In July 2025, the Massachusetts Attorney General announced a $2.5 million settlement with student lender Earnest Operations LLC, alleging its AI underwriting models produced unlawful disparate impacts, among other claims [5]. State fair-lending and consumer protection laws are not governed by the CFPB's reading of ECOA.
  • State AI laws. Colorado's 2024 AI Act (SB 24-205) would have required reasonable care to avoid algorithmic discrimination in high-risk AI, including lending. In May 2026, Colorado enacted SB 26-189, which replaces that framework with a narrower transparency-focused law on automated decision-making technology, effective January 1, 2027, dropping the duty of care and impact-assessment obligations while keeping rights such as meaningful human review of adverse automated decisions [12]. Separately, enforcement of the original act was paused under an agreement in a constitutional challenge brought by xAI, in which the U.S. Department of Justice intervened; the case was still pending as of July 2026, and the state indicated the pause also covers SB 26-189 [17].
  • Federal preemption debates. Proposals to limit state AI regulation have been debated at the federal level; check the current status before relying on any state AI law.

Private plaintiffs can still bring ECOA claims, and state fair-lending laws may be broader than federal ones.

The EU and UK

  • EU AI Act. AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score are listed as high-risk (with an exception for systems used to detect financial fraud) [6]. High-risk systems face requirements including risk management, data governance, human oversight, transparency, and registration. The high-risk obligations were originally scheduled to apply from August 2, 2026. The "AI Omnibus" amendment, proposed November 19, 2025, entered into force July 27, 2026, and moved the application date for these Annex III systems to December 2, 2027 [13]. It also allows processing of sensitive data specifically to detect and correct algorithmic bias [13].
  • EU GDPR. Article 22 gives individuals rights regarding decisions based solely on automated processing that significantly affect them, and the EU Court of Justice's December 7, 2023 SCHUFA ruling (Case C-634/21) found that automated credit scoring can fall within it when a third party draws strongly on the score to make its decision [14].
  • UK. The Financial Conduct Authority has said it does not plan to introduce extra regulations for AI and will instead rely on existing frameworks such as the Consumer Duty and the Senior Managers and Certification Regime [18].

What good practice looks like

Practice What it involves
Fair lending testing Measuring approval and pricing outcomes across groups before and after deployment
Less discriminatory alternatives search Testing whether a different model achieves similar accuracy with smaller disparities
Feature review Scrutinizing variables that may act as proxies for protected traits
Explainability Generating accurate, specific reasons for each adverse decision
Human oversight Clear escalation and override processes
Data accuracy Validating alternative data sources and handling disputes
Third-party diligence Understanding vendor models, not just buying scores

Related field note

What consumers can do

  1. Read the adverse action notice and note the reasons.
  2. Get your free credit report if the notice references one, and dispute errors with the credit bureau [2]. Related field note
  3. Ask the lender for specific reasons if they weren't provided.
  4. Know what data you've shared. If you connected a bank account, that cash-flow data may have been used. Related field note
  5. File a complaint with the CFPB, your state attorney general, or state financial regulator if you believe you were treated unfairly.

FAQ

Is it legal for lenders to use AI to decide on loans? Yes, but the same anti-discrimination and disclosure laws apply as for any other method [1][2].

Can a lender say "the algorithm decided" when denying me? No. Regulation B requires specific principal reasons for adverse action [1][3].

What is disparate impact? A practice that looks neutral but disproportionately harms a protected group without adequate justification. A CFPB rule effective July 21, 2026, says ECOA doesn't provide for disparate-impact liability; other federal laws and some state laws may treat it differently [15].

Does alternative data help people with no credit history? It can, particularly cash-flow data, but results vary by lender and model, and it introduces accuracy and privacy considerations.

Does the EU AI Act apply to U.S. lenders? It can apply to providers and deployers whose AI systems are used in the EU, regardless of where they're based [6]. Consult legal counsel for specifics.

Sources

  1. Consumer Financial Protection Bureau, "12 CFR Part 1002 (Regulation B)," including § 1002.9 Notifications, https://www.consumerfinance.gov/rules-policy/regulations/1002/9/, accessed 2026-09-17.
  2. Federal Trade Commission, "Fair Credit Reporting Act," https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act, accessed 2026-09-17.
  3. Consumer Financial Protection Bureau, "Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms," May 2022, https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/, accessed 2026-09-17.
  4. The White House, Executive Order 14281, "Restoring Equality of Opportunity and Meritocracy," April 23, 2025, https://www.whitehouse.gov/presidential-actions/2025/04/restoring-equality-of-opportunity-and-meritocracy/, accessed 2026-09-17.
  5. Massachusetts Attorney General's Office, settlement with Earnest Operations LLC, July 2025, https://www.mass.gov/orgs/office-of-the-attorney-general, accessed 2026-09-17; summarized in ABA Banking Journal, "Mass. AG reaches settlement with student loan firm for $2.5M over AI lending bias," https://bankingjournal.aba.com/2025/08/mass-ag-reaches-settlement-with-earnest-operations-for-2-5m-over-ai-lending-bias/.
  6. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Annex III, https://eur-lex.europa.eu/eli/reg/2024/1689/oj, accessed 2026-09-17.
  7. Consumer Financial Protection Bureau, "Technical correction and update to the CFPB's credit invisibles estimate," June 23, 2025, https://www.consumerfinance.gov/data-research/research-reports/technical-correction-and-update-to-the-cfpbs-credit-invisibles-estimate/, accessed 2026-09-17.
  8. Consumer Financial Protection Bureau, "Consumer Financial Protection Circular 2023-03: Adverse action notification requirements and the proper use of the CFPB's sample forms provided in Regulation B," September 19, 2023 (withdrawn May 12, 2025; archived), https://www.consumerfinance.gov/compliance/circulars/circular-2023-03-adverse-action-notification-requirements-and-the-proper-use-of-the-cfpbs-sample-forms-provided-in-regulation-b/, accessed 2026-09-17.
  9. Consumer Financial Protection Bureau, "Withdrawn Guidance," https://www.consumerfinance.gov/compliance/guidance/withdrawn-guidance/, accessed 2026-09-17.
  10. Board of Governors of the Federal Reserve System, "SR 11-7: Guidance on Model Risk Management," April 2011, https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm, accessed 2026-09-17.
  11. Consumer Financial Protection Bureau, "12 CFR Part 1002 (Regulation B)," https://www.consumerfinance.gov/rules-policy/regulations/1002/, accessed 2026-09-17.
  12. Hunton Andrews Kurth, "Colorado AI Act Amended and Effective Date Delayed," May 22, 2026, https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed, accessed 2026-09-17. See also Colorado General Assembly, https://leg.colorado.gov/bills/sb24-205.
  13. European Commission, "AI Omnibus enters into force," 2026, https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force, accessed 2026-09-17.
  14. Court of Justice of the European Union, Judgment in Case C-634/21, OQ v Land Hessen (SCHUFA Holding), December 7, 2023, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634, accessed 2026-09-17.
  15. Federal Register, "Equal Credit Opportunity Act (Regulation B)," final rule, April 22, 2026, https://www.federalregister.gov/documents/2026/04/22/2026-07804/equal-credit-opportunity-act-regulation-b, accessed 2026-09-17.
  16. Venable LLP, "CFPB Makes Significant Changes to Regulation B," May 2026, https://www.venable.com/insights/publications/2026/05/cfpb-makes-significant-changes-to-regulation-b, accessed 2026-09-17.
  17. Available Law, "Is the Colorado AI Act in Effect? The July 2026 Status Check for Businesses," July 2026, https://availablelaw.com/blog/colorado-ai-act-in-effect-2026, accessed 2026-09-17. (Secondary source.)
  18. Financial Conduct Authority, "AI and the FCA: our approach," September 8, 2025 (updated February 13, 2026), https://www.fca.org.uk/firms/innovation/ai-approach, accessed 2026-09-17.

This article is for educational purposes only and is not legal, financial, or compliance advice. Laws, regulatory guidance, and enforcement priorities change; verify the current status with official sources or qualified counsel.

KEEP THE THREAD GOINGRevoke an app’s access to your bank data →Build the dispute evidence file while fulfilling the order →Hosted checkout reduces PCI scope; it does not erase the merchant boundary →Return to the library →