1. The Regulatory Tension

A. Banking Regulation Side - Pro-Algorithm:

• CRR3 / Basel III - Banks must use Internal Ratings Based (IRB) models to calculate capital. Bank of Spain Circular 2/2016 and EBA Guidelines on IRB: Expert judgment can only adjust algorithmic output within 20% corridor, must be documented.
• Order ECM/599/2025 - First Spanish statutory basis for Automated Valuation Models (AVMs) for mortgages - AVM can replace human tasador for residential portfolios <€300k if model is validated and traceable.
• ECB Study Oct 2026 on Spain/France/Germany/Italy - 6.8 million firm-bank observations: Banks with strong industry expertise assigned default-risk estimates 11-16% lower than non-specialist algorithmic lenders. ECB concluded pure algorithm over-penalizes AI-exposed SMEs.

B. Fundamental Rights Side - Pro-Human:

• Spanish LOPDGDD Art 22 + GDPR Art 22: Right not to be subject to purely automated decisions including credit scoring, profiling. Right to obtain human intervention.
• Law 12/2021 Rider Law - Amended Art 64 Workers Statute: Companies must inform works council of parameters and logic of algorithms that affect working conditions - including credit risk scoring algorithms for bank employees.
• XXV Banking Sector Collective Agreement - One of first in Spain to address algorithmic management: Banks must guarantee human review of algorithmic decisions affecting promotions.

2. The Core Legal Test - When is Algorithm Prohibited?

CJEU Landmark - SCHUFA Holding AG Cases - C-634/21 and C-203/22 - 7 Dec 2023

This is the binding precedent for all Spanish banks.

Facts: SCHUFA (German credit bureau, model used by Spanish banks via Equifax/Experian) automatically calculated probability value of default from personal data. Bank (or landlord) automatically refused loan/lease if score low.

CJEU Held - Now EU Law in Spain:

1. Automated credit scoring IS automated decision-making under Art 22(1) GDPR - prohibited in principle, even if final decision formally taken by bank, if score is decisive.
2. Therefore prohibited unless: (a) explicit consent of data subject, OR (b) authorized by law with suitable safeguards, AND (c) data subject can express point of view and contest decision to a human.
3. Bank must provide "meaningful information about logic involved" - not source code, but factors, weights, and why score low.
4. Accuracy must be verifiable.

Direct Application in Spain:

AEPD vs CaixaBank S.A. - PS/00100/2019 - €6M fine 13 Jan 2021:

CaixaBank used algorithmic credit scoring for consumer loans without proper information. AEPD held violation of Art 22 LOPDGDD - clients not informed of existence of automated decision, no human review button, no explanation of logic. Fine €6M - largest at time.

Banco de España supervisory expectation after SCHUFA: All IRB models must have "human expert judgment override" documented - credit analyst can override algorithmic PD up/down with reasoned note.

3. Spanish Case Law - Expert Judgment Prevails Over Algorithm

Case 1: Algorithmic Discrimination in Banking Promotions

High Court of Justice of Galicia - Social Chamber - Judgment No. 02509/2023

Facts: Bank (Abanca/ BBVA group) used algorithm to design profiles for promotions - minimum compatibility and optimal compatibility levels. Algorithm scored candidates' qualities. Female employee over 50 with high seniority scored low on "optimal compatibility" due to algorithm weighting age, digital skills, mobility. Promotion denied.

Employee filed complaint for violation of fundamental rights.

Court Held:

• Company had algorithm that designed profiles on two levels.
• Algorithmic decision that produces discriminatory impact violates Art 14 Spanish Constitution and Art 4 Workers Statute.
• Modification of algorithmic decisions by human manager without transparent criteria is also discriminatory if human blindly follows algorithm.
• Employer must prove human expert reviewed algorithm output with bias control, and provided justification independent of algorithm.
• Appeal filed by employer rejected. Bank ordered to promote employee + €30k moral damages.

Doctrine: Expert judgment must not be rubber-stamp of algorithm. Must be independent, reasoned, and auditable.

Case 2: CNMV Study - Large Language Models and Stock Investing - Is Human Factor Required? - 2024

Spanish CNMV published research by Crisóstomo and Mykhalyuk:

• AI risks without human supervision - operational risks significant
• Uncontrolled AI use for credit scoring/investment advice breaches MiFID II suitability rules (Art 25)
• Human factor required to validate AI recommendation

CNMV now requires banks using robo-advisors to have human advisor review for complex products.

Case 3: Bank of Spain Research - ML vs Supervisory Cost - 2024-2025

Bank of Spain researchers propose framework for validating IRB ML models:

• ML delivers predictive gains up to 20% in default classification vs logistic regression
• But supervisory cost of validating ML model is 3x higher
• Therefore banks must keep expert judgment overlay to justify ML model to supervisor
• If model not reconstructible (cannot recover causal chain data->model->outcome), Bank of Spain can reject for regulatory capital purposes

Concept introduced: Reconstructibility - institutional capacity to recover causal chain linking data, models, outcomes to attributable human expert.

4. Banking Prudential Rules on Expert Judgment

Under EBA Guidelines on PD/LGD Estimation and ECB TRIM Guide:

Expert Judgment Allowed When:

1. Data scarcity - e.g., low default portfolio for large corporates in Spain - expert can adjust PD upwards by max 20%
2. Forward-looking information not in model - e.g., climate risk, geopolitical risk for Spanish exposure to Latin America
3. Model deficiencies identified

Requirements:

• Documented in writing, with name of expert
• Back-tested annually
• Cannot systematically override algorithm in one direction (bias test)
• Banco de España can penalize if expert judgment used to reduce capital artificially

Algorithm Alone Not Sufficient When:

• Borrower is Related Party (Bank of Spain Circular 4/2017) - requires human committee
• Restructured/forborne exposures - requires human assessment of viability, not just algorithmic days-past-due
• High-value AVM - Order ECM/599/2025 says AVM >€500k must be complemented by human tasador site visit

5. Practical Compliance Model for Spanish Banks Post-2024

To avoid AEPD €6M type fine + CNMV sanction + ECB capital add-on, Spanish banks now implement 3-layer model:

Layer 1 - Algorithm: IRB/ML model produces PD, score

Layer 2 - Human Expert Override: Credit risk analyst with at least 3 years experience can override with written rationale, citing specific forward-looking info not in model, subject to second pair of eyes

Layer 3 - Customer Rights: Under GDPR Art 22 + LOPDGDD Art 22 + AI Act Art 86 (High-Risk AI System - credit scoring is high-risk):

• Inform client: "Decision based on automated processing"
• Provide meaningful logic: main factors (e.g., debt-to-income 40%, payment history 30%)
• Provide button: "Request human review"
• Human must decide within 30 days, not just confirm algorithm

Failure to provide Layer 3 = automatic violation per SCHUFA.

Conclusion: In Spain, pure algorithm is illegal for credit decisions affecting consumers. Expert judgment is not optional ethical add-on - it is legal requirement under GDPR, banking collective agreement, and ECB supervisory expectations. Banks that cannot reconstruct how expert influenced algorithm face capital penalties from Banco de España and privacy fines from AEPD.