A credit refusal is the textbook case for GDPR Article 22: a decision with legal or similarly significant effect on a person. If an AI agent scores the application and a reviewer just follows the score, the decision may still be solely automated. Credit reviewers must be trained to test the agent's reasoning, use their override authority and record why.
What does Article 22 require for credit?
Article 22 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Credit decisions can be made that way only under an exception: necessity for a contract, authorisation by law with safeguards, or explicit consent. Under the contract and consent routes, the lender must offer at least human intervention, a chance for the applicant to express their view, and a way to contest.
In the EU, an automatically produced credit score can itself count as the decision where a lender relies on it heavily to decide. That matters for agents. It means a lender cannot escape Article 22 by placing a person at the end of a process who in practice always follows the agent. The question is whether the person's role changes outcomes.
Credit scoring and creditworthiness assessment of individuals are also listed as high-risk in Annex III of the EU AI Act. That brings Article 14 human oversight into play for lenders using such systems: oversight by people who understand the system's capacities and limits, can interpret its output and can decide not to use it. Article 22 and Article 14 point the same way. Both require competent people with real authority.
Who does it apply to?
Banks, consumer lenders, card issuers, buy-now-pay-later providers, motor and asset finance firms, and mortgage lenders deciding on individuals. Reviewers in scope:
- Credit analysts and underwriters who review agent-scored applications.
- Referral teams handling cases the agent holds for a person.
- Credit risk staff who set the policy rules and bounds the agent works within.
- Appeals and complaints teams handling contests of refusals.
What does meaningful review look like in a credit team?
The agent's role should be clear by capability. At depth 1 it gathers bureau data, bank transaction data and the application. At depth 2 it drafts an assessment with reasons. It may approve simple applications within policy at depth 3, if the lender has certified it to. Refusals, limit reductions and cases outside policy are held for a named analyst. Releasing funds is depth 4 and stays with a person under the lender's limits.
Meaningful review of a held case has four parts:
- The analyst sees what the agent saw. Not just the score, but the inputs and the reasons. An analyst who sees only "decline, score 412" cannot review anything.
- The analyst knows what the agent did not see. A recent job change, a one-off large expense, a thin credit file for someone new to the country. These are where agents go wrong.
- The analyst weighs the evidence. Bank transaction data from the account provider is signed. Income typed into an application is declared. A payslip uploaded as an image is external until checked. The reasons must rest on the right class.
- The analyst can decide differently, and does. Override authority must be written into the role, and the record must show it used.
The how-to version is in how to train the credit team to review AI agent decisions, with day-to-day method in how credit analysts review an AI agent's decisions.
What must credit reviewers be trained to do?
- Read the agent's reasons and test each against the source data.
- Recognise when a reason is a proxy for a characteristic the lender must not use.
- Identify thin-file and non-standard applicants who models tend to misjudge.
- Use override authority, document the reason, and stand behind it.
- Handle an applicant's point of view on contest as new evidence, not as noise.
- Explain a refusal in terms the applicant can act on.
- Resist automation bias, especially late in a shift with a full queue.
How do you meet it and leave evidence?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| No solely automated refusals without an exception and safeguards | Refusals and adverse changes held for a named analyst | Hold and release log naming the analyst |
| Reliance on the score is not mere confirmation | Analysts see inputs and reasons, not only scores | Case views; access logs |
| Competent oversight under Article 14 | Analysts trained and assessed on the specific credit agent | Assessment results per analyst |
| Real authority | Override rights in role definitions | Override records with reasons |
| Right to contest | Contests re-decided by a trained analyst | Contest log with outcomes |
| Fair processing | Outcomes compared across groups by credit risk | Fairness reports with owner sign-off |
| Assessment of risk | Article 35 impact assessment covering the agent and review | Approved DPIA |
What will a supervisor or auditor ask?
- Which credit decisions does the agent take without a person?
- For a sample of refusals, what did the analyst review, and how long did it take?
- How often do analysts disagree with the agent, and in which direction?
- How do analysts handle thin-file applicants?
- Show us the training and assessment record of the analyst on this case.
- How do contested refusals turn out?
What does Article 22 not cover?
It does not set credit policy or affordability standards; consumer credit law and conduct rules do. It does not require a person to decide approvals that have no adverse effect, though lenders should still sample them. It does not govern the quality of the model itself, which falls under model risk expectations and, for high-risk systems, the EU AI Act. In the UK, the same questions arise under UK GDPR. Compare the duty in collections, where the lender is already exposed, and payments, where time is short. The test itself is in what meaningful human review is, and the guide to AI literacy and certification covers training across roles.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy trains credit reviewers on the real product, with module tests set in lending and the learner's own role. Analysts who review held decisions take the Operator track, which ends in Certified Pryme Operator, valid for 12 months. Credit risk staff who lead regulated, multi-agent deployments can go on to the Architect track. A lender can adopt a practice of granting release rights at each depth only to analysts with a current certificate.
Questions people ask
Does a second analyst check make the review meaningful?
Only if each analyst can see the evidence and change the outcome. Two people confirming a score without looking adds nothing.
Can the agent approve applications on its own?
It can approve within policy at depth 3 if certified on the lender's own cases. Approvals have less adverse effect, but they still need sampling for errors and fairness.
What reasons should we give a refused applicant?
Reasons drawn from the evidence the analyst relied on, written so the applicant understands what drove the outcome and what they could provide to change it.