1. The Three Legal Sources of Explainability

A. GDPR - Right to Explanation - Since 2018, but clarified 2023-2025

• Art. 15(1)(h) GDPR: Data subject right to obtain meaningful information about logic involved, significance and envisaged consequences
• Art. 22 GDPR: Right not to be subject to decision based solely on automated processing, including profiling, which produces legal effects
• Recital 71: Right to explanation

What explanation means under GDPR? Not source code. According to CJEU, it is:

procedure and principles applied in practice to establish solvency profile, and main factors, not algorithm

B. EU AI Act - Fully Enforced 2 August 2026 for High-Risk Banking Systems

• Art. 9: Risk Management System
• Art. 10: Data Governance - training data must be relevant, representative, error-free
• Art. 13: Transparency - system must be designed to enable deployers to interpret output and use it appropriately. Must provide instructions for use that include logic, key parameters
• Art. 14: Human Oversight - human must be able to understand capabilities and limitations, and override
• Art. 50: Right to explanation to affected person for high-risk decisions
• Art. 86: Right to obtain clear and meaningful explanation of role of AI system and main elements of decision

Penalties: Up to €35 million or 7% global annual turnover for non-compliance with transparency provisions

For banks, this means: Documentation, traceability, and auditability. A fraud or credit decision that cannot be traced back to a reason is a decision you cannot defend.

C. Banking Regulation - EBA and Banco de España

• EBA Guidelines on Loan Origination and Monitoring (EBA/GL/2020/06): Credit decision process must be understandable, auditable
• Banco de España Circular 2/2016 + ECB TRIM: Internal models (IRB) must be explainable. SR 11-7 equivalent: Model documentation standards
• US Regulation B + ECOA: Lenders must give specific reasons for adverse credit decisions - adverse action notices. Example compliant: "Rejected due to: recent late payments > 1; and installment/income ratio > 40%"

2. What Level of Explanation is Required? The XAI Stack

Regulators now require 4 levels, per 2026 audit standard:

1. Global Explainability: How does model behave overall? Which variables drive decisions?
2. Local Explainability: Why this specific client was rejected? SHAP/LIME values
3. Counterfactual Explainability: What would need to change to get approved? Required by AI Act Art. 86
4. Process Explainability: Data lineage, model version, human override log

Example: European bank fined €47 million in 2026 after AI loan approval model rejected 23% more applications from specific demographic groups than human underwriters - and could not explain why

3. Landmark Case Law - The SCHUFA Doctrine

This is the most important case law for banking AI in EU.

Case 1 - SCHUFA Holding AG - The Foundation

CJEU C-634/21 - OQ v Land Hessen, SCHUFA Holding AG - 7 Dec 2023 - ECLI:EU:C:2023:957

Facts: German credit bureau SCHUFA automatically calculates credit score (probability value). Bank uses score to grant/refuse loan. Customer requests information.

CJEU Holding:

Where a credit score is transferred to third party (e.g. bank) and third party relies heavily on it to establish, implement or terminate contractual relationship (e.g. granting loan), then processing used to produce that credit score constitutes automated decision-making for purposes of Article 22 GDPR

Automated credit scoring constitutes automated individual decision-making

Consequence: Credit scoring itself is Art. 22 decision, even if done by third party. Bank cannot hide behind bureau. Both bureau and bank are joint controllers and must provide explanation.

Right under Art. 15(1)(h): Must receive meaningful information about logic involved.

Case 2 - Dun & Bradstreet Austria - The Secret Protection Balance

CJEU C-203/22 - Dun & Bradstreet Austria - 27 Feb 2025 - ECLI:EU:C:2025:123

Facts: Data subject requests Art. 15 information, bureau refuses citing trade secret protection of algorithm.

CJEU:

• Credit scoring company must not disclose its algorithm, but must explain procedure and principles applied in practice to establish solvency profile
• Where data subject is subject of automated individual decision (Art. 22), he has right to obtain relevant information on underlying logic
• If controller considers information protected by trade secret, must disclose trade secret to competent court or supervisory authority for assessment, and provide summary to data subject

This creates genuine right to explanation, not just access to personal data. Controller must explain main evaluation criteria and their weighting in understandable form.

Case 3 - SCHUFA Reforms 2026 - Impact

After C-634/21 and C-203/22, German legislator reformed SCHUFA scoring:

• Must explain main factors in plain language
• Must provide counterfactual: what factors most influenced negative score
• Both credit reference agency and financial institution relying on score must comply

Spanish DPA (AEPD) applies same doctrine: Banks using Equifax, Experian, Asnef scores must provide explanation - they are data controllers under Art. 22.

4. How Spanish Courts Apply Explainability in Banking

Audiencia Nacional - Credit Scoring Cases 2024: Following SCHUFA, Spanish banks using AI scoring from external fintech must provide internal audit trail. Failure = breach of transparency, nullity of loan rejection? Still debated, but AEPD fines €2M+.

Banco de España Supervision Report 2025: Conduct supervision includes checking if AI models for credit scoring have explainability layer and human override. Models without LIME/SHAP not approved for IRB.

5. Checklist to Comply in Spain - What Bank Must Do Today

For any high-risk AI system (credit, insurance, biometric ID):

Before deployment:

• Conformity assessment + EU database registration
• Technical documentation per Art. 11 AI Act: data sets, design choices, accuracy metrics
• Bias testing - demographic parity

At decision time:

• Provide Art. 13 transparency information: capabilities, limitations
• Human oversight - trained person can override
• Log all decisions with input data, model version, explanation

After decision (if adverse):

• GDPR Art. 15 + 22 + AI Act Art. 86: Provide within 15 days:
  1. That AI was used
  2. Main parameters and their relative importance (e.g., income 40%, payment history 35%, debt ratio 25%)
  3. Counterfactual: "If your income was €X higher or delinquencies 0, score would pass threshold"
  4. Right to human review and contest

Template compliant explanation per Spanish AEPD:

Your loan application was evaluated by automated system version 2.3. Key factors: installment/income ratio 52% (threshold 40%) contributed -30 points, 2 late payments in last 12 months contributed -20 points. Decision threshold 650, your score 600. To achieve approval, you would need installment/income <40% and 0 late payments. You may request human review within 30 days.

Failure to provide this = violation of Art. 22 GDPR (fine up to 4% turnover) + AI Act Art. 13/86 (fine up to 7% turnover) + potential nullity of contract under Spanish consumer law for lack of transparency per STS 241/2013 doctrine.