Layer 1: GDPR - Already Applicable Today - No Grace Period

Art 15(1)(h) + Art 13(2)(f), 14(2)(g) + Art 22

• Art 15(1)(h): Right to obtain meaningful information about logic involved, significance and envisaged consequences.
• Art 22: Prohibition of decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects.
• Art 22(3): If exception applies - necessary for contract - safeguards: right to obtain human intervention, to express point of view, to contest decision.

Case Law 1: CJEU C-634/21 SCHUFA Holding AG - 7 Dec 2023 - Foundation

SCHUFA German credit reference agency generates automated credit scores using complex statistical procedures, secret algorithm, supplies to lenders. OQ denied loan.

CJEU Grand Chamber - Threefold test for Art 22:

1. Decision must exist
2. Based solely on automated processing including profiling
3. Produces legal effects or similarly significantly affects

Held: Automated credit scoring constitutes automated individual decision-making under Art 22, even when scores inform rather than directly determine outcomes, if score ascribed decisive role.

Organizations cannot hide behind algorithm complexity or claim trade secret protections prevent disclosure. Must provide meaningful information about logic.

Case Law 2: CJEU C-203/22 Dun & Bradstreet Austria - D&B Decision - 27 Feb 2025 - How Much Explanation?

Facts: D&B must provide personal data used to build features entering computation of score - feature engineering disclosure.

CJEU: Where data subjects request access about automated decision that controller considers protected by trade secret, must provide:

• (i) Personal data used to build features
• (ii) Feature engineering disclosure - how data aggregated into features
• (iii) Main logic - weight of features, not source code
• (iv) Counterfactual - what would change outcome

D&B must provide meaningful information about logic involved as required by Art 15(1)(h). If insufficient, court orders disclosure even if trade secret.

Spain direct: ASNEF-EQUIFAX, Experian, CIRBE Banco de España must now provide this. AEPD 2024 fined Spanish bank €2M for black-box scoring without explanation.

Layer 2: Consumer Credit Directive II - Directive EU 2023/2225 - CCD II - Must be applied from 20 Nov 2026

Replaces 2008/48/EC. First binding legal framework that also applies to digital deferred payment models such as BNPL. Must be transposed by 20 Nov 2025, applied from 20 Nov 2026.

Art 18 - Creditworthiness Assessment + Recital 49:

Recital 49 emphasises automated credit-scoring systems must not discriminate on protected grounds and must allow consumer to request human review.

Where assessments involve automated processing of personal data, including profiling, consumers will have right and shall be informed of such right to request and obtain human intervention from creditor. This includes right to request and obtain clear and comprehensible explanation of creditworthiness assessment.

New obligations for Spanish banks - Art 18 CCD II:

1. Pre-contractual: Must inform consumer that automated processing used.
2. Explainability safeguards: Automated decision-making must include explainability safeguards - clear and comprehensible general information about credit agreements made available at all times on paper or durable medium chosen by consumer.
3. Human review: Right to human review, right to contest.
4. Non-discrimination: Must not discriminate on protected grounds - gender, ethnicity - and must allow human review.

EDPS Opinion 26 Aug on Commission proposal: Fair access to credit through consumer and data protection - proposal aims to modernise rules to address digitalisation, increased use online sales channels. EDPS required stronger explainability.

Spain transposition: Anteproyecto Ley Contratos Crédito al Consumo 2025 includes Art 18 verbatim - banks must provide explanation within 7 days of request.

Layer 3: EU AI Act - Regulation EU 2024/1689 - High-Risk Credit Scoring

Classification: Assessing creditworthiness of natural person is Annex III high-risk use, as is risk pricing in life and health insurance.

Tension: This thesis develops Explainable Inclusive Credit Scoring Framework that integrates ... Article 13 of AI Act specifically mandates high-risk AI systems shall be designed and developed in such a way as to ensure operation is sufficiently transparent.

Two Key Articles:

Art 13 - Transparency and Provision of Information:

High-risk AI systems shall be designed to ensure operation is sufficiently transparent to enable deployers to interpret system output. Must be accompanied by instructions including capabilities, limitations, human oversight.

Art 86 - Right to Explanation of Individual Decision-Making - THE NEW RIGHT:

Article 86 gives affected person right to clear and meaningful explanation of role of AI system in decision-making procedure and main elements of decision, where decision produces legal or similarly significant effects.

Article 86 gives person subject to decision taken on output of Annex III system right to clear and meaningful explanation, where decision produces legal effects.

Deadline Chaos - 2026 Digital Omnibus:

• AI Act entered force 1 Aug 2024 staggered timeline.
• Original: High-risk obligations - Annex III risk management, data governance, CE marking for systems in recruitment, credit scoring, biometrics - enforceable 2 Aug 2026.
• Regulation EU 2026/1744 - Digital Omnibus on AI - published Official Journal 24 July 2026 entered force 27 July 2026 - 3 days later: Stand-alone high-risk systems under Annex III - education, employment, credit, essential services, biometrics, law enforcement - move from 2 Aug 2026 to 2 Dec 2027 - 16-month deferral. High-risk AI embedded in regulated physical products Annex I to 2 Aug 2028.

BUT:

• Art 86 deadline still 2 Aug 2026. Under AI Act general timetable, Article 86 became applicable 2 Aug 2026. Regulation 2026/1744 neither amended Article 86 nor expressly deferred it. As at 26 Aug 2026, neither final Commission guidelines nor ruling from CJEU settled relationship.
• Organizations using AI in recruitment, creditworthiness assessment, access to services, administration of justice or other Annex III fields should already be explanation-ready.

Verified as of 25 Aug 2026 checklist for lenders:

Penalties: EU AI Act transparency provisions take effect Aug 2026, with penalties up to €35 million or 7% global annual turnover for non-compliant high-risk AI systems. For high-risk violations up to €15M or 3% turnover. From that date financial services firms operating high-risk AI face fines.

4. Holistic Right to Explanation - SSRN Paper 2024

The Right to Explanation of a Credit Score: A Holistic Approach under GDPR, AI Act, and Directive EU 2023/2225 on Credit Agreements for Consumers - outlines relevant legal landscape before analysing obligations to explain credit-related decisions under three frameworks.

Proposed Unified Standard for Spanish Banks by 2026:

Must provide within 7 days of request:

1. General Logic: That automated processing used, main categories of data - income, debt, payment history, external bureau.
2. Specific Logic: Personal data used to build features, weight - e.g., income 35%, debt-to-income 30%, past delinquency 25%, age of accounts 10%.
3. Counterfactual: What would need to change to obtain different outcome - e.g., if income +€600/month or debt -€5,000, would be approved. Required by D&B C-203/22 and AI Act Art 86.
4. Human Review: Contact of person who can review, procedure to contest.
5. Non-discrimination proof: That model tested for bias on protected grounds per Recital 49 CCD II + Art 10 AI Act.

Cannot refuse based on trade secret or complexity per D&B - must disclose to court/supervisor if needed.

5. Case Law Synthesis for Explainable Credit Scoring

Three Illustrative Disputes Surveyed in Liberty Lexicon Article Explainable AI as Legal Requirement: Dutch SyRI litigation, Wisconsin Supreme Court State v Loomis, Bologna Deliveroo

• SyRI - Rechtbank Den Haag 5 Feb 2020: Dutch welfare fraud detection black box declared violates Art 8 ECHR due to lack explainability. Establishes explainability crystallised into binding requirement.
• Loomis - 881 N.W.2d 749 2016: US allows COMPAS black box with warning - EU rejects.
• Deliveroo Frank Algorithm - Tribunale Bologna 31 Dec 2020: Rider assignment algorithm opaque - declared discriminatory - employer must explain logic.

For credit scoring: EU follows SyRI + SCHUFA + D&B: accuracy does not justify black box. Explainability mandatory.

Practical Compliance Template for Spanish Bank - Must be Ready Now

Since GDPR applies now + Art 86 applies 2 Aug 2026, Spanish bank must implement:

• Model inventory: Identify all models used for creditworthiness assessment - scorecards, ML.
• Explainability layer: For each model, generate SHAP waterfall local explanation - individual adverse action reasons - and global demographic parity.
• Human oversight: Designate human reviewer with authority to override.
• Log retention: Art 26 logs must be retained at least 6 months for automated pricing decisions.
• Consumer information: Update pre-contractual information per CCD II Art 18 to inform right to explanation.

If using external bureau - ASNEF - must also be able to explain bureau score logic per D&B feature engineering disclosure.