Banking Law and Fairness in AI Credit Systems — Spain

Introduction

Artificial intelligence is increasingly relevant to banking because lenders can use automated systems to assess creditworthiness, identify default risk, detect fraud and determine whether customers qualify for particular credit products. In Spain, however, AI-based credit decisions must comply with a combination of EU banking law, data-protection law, consumer-credit rules, anti-discrimination principles and the EU Artificial Intelligence Act.

Fairness in AI credit systems means more than mathematical accuracy. A credit model should not produce unlawful discrimination, use irrelevant or excessive personal information, conceal important reasons for adverse decisions, or leave consumers unable to challenge significant automated outcomes.

Spain's framework is particularly influenced by the General Data Protection Regulation (GDPR). Article 22 regulates decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals. The Court of Justice of the European Union (CJEU) has confirmed that credit scoring can fall within this provision when the score plays a determining role in a lender's decision.

The EU AI Act adds another layer. AI systems used to evaluate the creditworthiness of natural persons or establish their credit score are generally treated as high-risk AI systems, subject to the exceptions contained in the legislation.

Legal and Regulatory Framework

Spanish banks operate within both Spanish and European Union law. Important parts of the framework include:

1. GDPR and Spanish Data-Protection Law

Regulation (EU) 2016/679 applies directly in Spain and is supplemented nationally by Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights.

AI credit scoring commonly involves profiling because information concerning income, payment history, existing debt and other characteristics may be processed to predict whether a customer will repay a loan.

GDPR principles particularly relevant to AI lending include:

lawfulness, fairness and transparency;

purpose limitation;

data minimisation;

accuracy;

storage limitation;

security and confidentiality;

accountability;

restrictions on solely automated significant decisions.

These principles mean that the fact that an algorithm can process particular information does not automatically make that processing lawful.

AI Act and Credit Scoring

The EU Artificial Intelligence Act significantly changes the regulatory environment.

AI systems intended to evaluate the creditworthiness of natural persons or establish their credit scores generally fall within the AI Act's high-risk framework. This reflects the potentially serious consequences of credit decisions for individuals' access to essential financial opportunities.

High-risk classification brings requirements relating to risk management, data governance, documentation, record keeping, transparency, human oversight, accuracy, robustness and cybersecurity.

For Spanish banks, therefore, fairness must increasingly be built into the entire AI lifecycle rather than considered only after a customer complains.

A lender should understand where training data originated, whether relevant groups are adequately represented, how model performance is monitored and whether errors could systematically disadvantage particular categories of customers.

Fairness and Discrimination

One of the greatest legal concerns is algorithmic discrimination.

An AI system might not explicitly use a protected characteristic but could rely on another variable that acts as a proxy for it. Geographic, behavioural, socioeconomic or other variables may sometimes produce indirect discriminatory effects.

Consequently, fairness testing should examine outcomes rather than simply asking whether the algorithm explicitly contains protected characteristics.

Banks should periodically evaluate whether comparable applicants are receiving materially different outcomes and investigate the reasons for those differences.

However, statistical differences do not automatically establish unlawful discrimination. Differences can sometimes result from legitimate risk factors. The legal issue is whether the distinction has a lawful and objectively defensible basis under the applicable legal framework.

Data Quality and Bias

An AI credit system is heavily dependent on its underlying data.

Incorrect or outdated information can result in an inaccurate credit score. Historical datasets can also reproduce existing inequalities when past lending patterns are incorporated into future models without sufficient examination.

Article 5 GDPR requires personal data to be accurate and, where necessary, kept up to date.

For credit systems, this can require procedures through which customers can challenge inaccurate information. Banks should also monitor data quality throughout the model's operation rather than checking data only during initial development.

Transparency and Explainability

AI credit systems can be difficult for customers to understand.

A simple statement that "the computer rejected your application" does not provide meaningful transparency where automated processing is legally relevant.

The CJEU has strengthened this aspect of European law. In Dun & Bradstreet Austria, C-203/22, the Court addressed what constitutes meaningful information concerning the logic involved in automated creditworthiness profiling. The case concerned access to information enabling a person to understand and challenge the automated assessment.

The judgment is particularly relevant to Spanish lenders because GDPR interpretation by the CJEU applies throughout the European Union.

Human Oversight

Human involvement can be an important safeguard, but it must be meaningful.

A bank should not simply place a human employee at the end of an automated process if that employee routinely accepts the algorithm's recommendation without genuine examination.

Where applicable, an effective review mechanism should allow the reviewer to understand relevant information, examine the customer's circumstances, identify potential errors and change the outcome where justified.

This reduces the danger of automation bias, where employees assume an algorithm must be correct simply because it is technologically sophisticated.

Data Minimisation

AI development sometimes encourages organizations to collect as much information as possible because additional variables may improve predictions.

GDPR takes a different approach.

Personal information must be adequate, relevant and limited to what is necessary for the relevant purpose. Therefore, Spanish banks need a lawful justification for the personal data used in credit models.

The CJEU's decision in Schrems v Meta Platforms Ireland, C-446/21 reinforced the significance of purpose limitation and data minimisation under Article 5 GDPR. Although it did not concern banking credit scoring, these GDPR principles apply directly to personal-data processing underlying AI lending systems.

Case Laws

Because Spain is an EU Member State, CJEU judgments interpreting the GDPR are directly important to Spanish banking and AI-credit compliance. The following cases provide particularly relevant principles.

1. SCHUFA Holding (Scoring), C-634/21 — 2023

This is the most important European case for automated credit scoring.

SCHUFA generated probability scores predicting individuals' ability to meet payment obligations. Those scores were supplied to businesses making contractual decisions.

The CJEU held that automated establishment of such a probability value can constitute automated individual decision-making within Article 22 GDPR where a third party draws strongly on that score when deciding whether to establish, implement or terminate a contractual relationship.

Principle: A lender cannot necessarily escape Article 22 merely because the credit score and final lending decision technically occur in separate organizations.

For Spanish banking, the practical significance is considerable where banks rely heavily on externally generated scores.

2. Dun & Bradstreet Austria, C-203/22 — 2025

This case developed the transparency requirements surrounding automated creditworthiness assessment.

The dispute concerned the information that must be provided about automated profiling under Article 15(1)(h) GDPR.

The CJEU addressed the requirement to provide meaningful information about the logic involved and the ability of the individual to understand and verify the automated process.

Principle: Transparency requires information that genuinely helps the individual understand the automated assessment; simply presenting incomprehensible technical material does not necessarily satisfy the objective of the GDPR.

This principle is directly relevant when Spanish banks explain AI-generated credit outcomes.

3. Österreichische Datenschutzbehörde and CRIF, C-487/21 — 2023

This case concerned the GDPR right to obtain a copy of personal data undergoing processing.

The CJEU held that the right to obtain a copy means providing a faithful and intelligible reproduction of the personal data concerned. Extracts from documents or databases may have to be supplied where necessary for the individual to exercise GDPR rights effectively.

Principle: Access rights must be practically useful rather than merely formal.

For AI credit systems, consumers may need sufficiently understandable information about personal data used in the assessment to identify inaccuracies and challenge them.

4. Österreichische Post, C-154/21 — 2023

This case concerned information about recipients of personal data.

The CJEU concluded that, where personal data have been or will be disclosed, the individual generally has the right to obtain information about the actual identity of recipients, where they can be identified, rather than merely receiving broad categories of recipients. Certain limitations remain where identification is impossible or the request is manifestly unfounded or excessive.

Principle: Individuals should have meaningful visibility over the circulation of their personal information.

In banking, this can matter where data involved in credit assessment are shared with credit-information providers, processors or other relevant entities.

5. Österreichische Post, C-300/21 — 2023

This judgment concerned compensation for non-material damage resulting from unlawful processing.

The CJEU held that infringement of the GDPR alone does not automatically create a right to compensation. There must be damage and a causal relationship between the infringement and that damage. However, the GDPR does not impose a minimum seriousness threshold for non-material damage.

Principle: Unlawful AI processing can potentially create civil liability where the required infringement, damage and causal connection are established.

A Spanish consumer adversely affected by unlawful data processing associated with an AI lending system could therefore potentially invoke Article 82 GDPR where these requirements are satisfied.

6. Schrems v Meta Platforms Ireland, C-446/21 — 2024

Although this case concerned a social-media platform rather than consumer lending, it has broader importance for AI credit models because it addresses fundamental GDPR restrictions on data processing.

The CJEU considered the principles of purpose limitation and data minimisation and the treatment of special-category information.

Principle: Organizations cannot assume that extensive personal-data processing is permissible simply because large datasets improve profiling.

For banks, this means that developing a more predictive AI model does not itself justify unlimited collection or indefinite processing of customer information.

7. Pankki S — C-579/21

This banking-related CJEU litigation concerned access to information about consultations of customer personal data by employees of a bank.

The Court concluded that a data subject has a right to information concerning the dates and purposes of consultations of personal data, although this does not automatically mean a right to obtain the identities of individual employees in every situation. The Court also made clear that the fact that the controller operates in the banking sector does not reduce the scope of GDPR access rights.

Principle: Banking confidentiality and institutional status do not remove customers' GDPR transparency rights.

For AI lending systems, banks therefore need adequate logging and governance capable of showing how personal information has been accessed and processed.

Right to Challenge AI Credit Decisions

Fairness requires procedural protection as well as technically fair algorithms.

A customer affected by an automated credit decision may, depending on the circumstances, have rights relating to information, correction of inaccurate data, objection, human intervention and contesting a decision.

This is particularly important because errors in credit scoring can create a cycle of exclusion. Incorrect data may generate a poor score, which may cause credit rejection, and that rejection may affect the consumer's future financial opportunities.

Effective correction and review mechanisms therefore form an essential part of fair AI lending.

Trade Secrets and Explainability

Banks and technology companies may argue that detailed information about credit algorithms constitutes commercially confidential information or a trade secret.

EU law recognizes legitimate trade-secret interests, but commercial confidentiality does not automatically eliminate GDPR rights.

The Dun & Bradstreet Austria judgment specifically examined the interaction between meaningful information about automated decision-making, trade secrets and third-party personal data.

Accordingly, Spanish lenders need mechanisms capable of protecting legitimate confidential information while still providing individuals with legally sufficient information to understand and challenge automated assessments.

Governance of AI Credit Systems

A Spanish bank deploying AI for credit assessment should treat fairness as an ongoing governance obligation.

Relevant controls include maintaining reliable training and testing data, documenting the model's purpose, monitoring performance, identifying discriminatory outcomes, protecting personal information, maintaining audit logs, providing appropriate human oversight and establishing mechanisms for complaints and corrections.

The bank must also consider third-party models. Purchasing an AI credit system from an external technology provider does not mean that the bank can disregard its own obligations as a lender, data controller, deployer or regulated financial institution.

Relationship Between Banking Law, GDPR and the AI Act

An important feature of Spain's framework is that these laws operate together.

The AI Act primarily regulates the design, governance and deployment risks of relevant AI systems.

The GDPR governs processing of personal information, profiling, transparency, access rights and automated individual decision-making.

Banking and consumer-credit rules govern the lender's relationship with customers, creditworthiness assessment, responsible lending and supervisory obligations.

Anti-discrimination rules add another layer by restricting unjustified discriminatory treatment.

Compliance with one regime therefore does not automatically establish compliance with all the others.

Conclusion

Fairness in AI credit systems is becoming a central issue in Spanish banking law. AI can improve the speed and consistency of credit assessment, but it can also amplify inaccurate data, historical bias and opaque decision-making.

Spanish banks must operate within the combined requirements of the GDPR, Spanish data-protection legislation, EU AI Act, banking regulation, consumer-credit rules and equality principles.

The European case law is increasingly specific. SCHUFA Holding (C-634/21) establishes the importance of Article 22 GDPR for credit scoring, while Dun & Bradstreet Austria (C-203/22) strengthens the requirement for meaningful information concerning automated creditworthiness assessments. Other CJEU judgments concerning access, data recipients, compensation, data minimisation and banking records provide additional safeguards.

The central legal principle is therefore that AI may assist credit decisions, but technological efficiency does not replace fairness, transparency, data accuracy, human accountability and the customer's ability to understand and challenge significant decisions.