INSIGHTS, AI GOVERNANCE
A model shaped the decision. Regulation B still wants the principal reason.
Regulation B requires a specific statement of the principal reasons for adverse action. Section 1002.9 says nothing about AI, which is why it bites when a model shapes the decision.
AI reached the loan workflow through vendors already there.
Little of it was bought as AI. It arrived inside origination, verification and servicing platforms under existing contracts, with no purchase order.
Lead scoring draws the attention; the requirement attaches wherever the chain ends in a notice to a borrower. The chain marks those links, and the one with an AI rule of its own, the AVM rule.
So the first question is not whether a model is fair. It is which of your links ends in a sentence somebody has to write and defend.
Naming the system does not satisfy Regulation B.
ECOA and Regulation B adverse action, 12 CFR 1002.9
A creditor taking adverse action must give a statement of reasons that is specific and indicates the principal reasons for the decision. A general reference to an internal standard or a credit scoring system does not satisfy it. Notification is due within 30 days after a completed application.
Creditors, meaning those who regularly extend, renew or continue credit, or participate in the decision. No general size exemption for consumer credit. Business credit has separate timing and content rules at 12 CFR 1002.9(a)(3), scaled by the applicant's revenue.
Two words do the work: specific and principal. Naming the tool, the policy or the score describes the process, not the decision. Somebody has to get from the model's output to words about this applicant, and show how.
The Bureau's Circulars 2022-03 and 2023-03 on algorithmic notices, withdrawn on 12 May 2025 at 90 FR 20084, play no part here. The duty described here sits in 12 CFR 1002.9 and its official commentary, which were not withdrawn and which the 2026 final rule did not amend.
A consumer report brings a second notice, and pricing a third.
For a lender running a model on a consumer report, Regulation B is half the position.
| Regime | What starts it | What the notice carries | Who it reaches |
|---|---|---|---|
| Regulation B, 1002.9 | Adverse action | Specific principal reasons, within 30 days | Every creditor; business credit under 1002.9(a)(3) |
| FCRA 615(a) | A consumer report used in the decision | Agency details, that it did not decide, rights, any score | Any user of a consumer report, whatever its size or charter |
| Risk based pricing | Materially less favorable terms, using a consumer report | A separate notice, unless a 1022.74 exception applies | Consumer credit; not business purpose credit |
FCRA section 615(a) adverse action notice, 15 U.S.C. 1681m(a)
Where a decision is based in whole or in part on information in a consumer report, section 615(a) requires its own adverse action notice, carrying
- the consumer reporting agency's name, address and telephone number,
- a statement that the agency did not make the decision and cannot give the reasons for it,
- notice of the consumer's right to a free copy of the report within 60 days and to dispute it, and,
- where a credit score was used, the numerical score, its range, the key factors that adversely affected it and its date and source, under 15 U.S.C. 1681m(a)(2).
That is nearly the opposite of what Regulation B asks. One document may carry both notices, and the Regulation B sample forms do, but each statute's content has to be present.
Any user of a consumer report, whatever its size or charter.
Read 15 U.S.C. 1681m at the Office of the Law Revision Counsel
Risk based pricing rule, 12 CFR Part 1022 Subpart H
A separate notice is required where a person uses a consumer report and then grants consumer credit on material terms materially less favorable than the most favorable terms available to a substantial proportion of its consumers. The exceptions at 12 CFR 1022.74 remove or replace the notice in named circumstances, including where an adverse action notice has been given.
Where the model prices rather than decides, nobody has been declined and the file looks clean, and a notice may still be owed. A lender relying on an exception should be able to name which.
Consumer credit only; not credit extended primarily for a business purpose.
Neither is a fair lending rule, so the 2026 change left both alone.
One rule moved one statute, and not this provision.
CFPB Regulation B final rule, effective 21 July 2026
The rule effective 21 July 2026 states that disparate impact claims are not cognizable under ECOA.
| Changed, under ECOA only | Not changed |
|---|---|
| Disparate impact claims under ECOA | 12 CFR 1002.9 and its official commentary |
| The discouragement prohibition, narrowed | The duty to explain how a decision was reached |
| Special purpose credit programs of for profit organizations, conditioned | The FCRA and risk based pricing notices |
| Other sections of Regulation B and its commentary | The Fair Housing Act and other law |
Creditors subject to Regulation B, with no size threshold. It reaches ECOA and nothing else. Rules of this kind attract litigation, so the position should be confirmed rather than assumed, and counsel will ask which exposures moved.
Fair Housing Act, 42 U.S.C. 3605
It applies to residential mortgage lending independently of ECOA.
Entities whose business includes residential real estate related transactions, which section 3605(b) defines to include making or purchasing loans secured by residential real estate. The test is the business, not its size. Current doctrine under the Act is a question for counsel.
Under $30 billion in total assets, the level above which the agencies state the guidance is most relevant, or with a generative system at any size, a bank cannot route this question to its model risk framework, and an insurer hears it from its state department on the market conduct track.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Eight documents, and the eighth produces the sentence.
- The inventory entry, with owner and tier.
- The approval record, with basis and conditions.
- The inputs and their provenance.
- What the vendor does with input data, in its own writing.
- The monitoring plan and its last output.
- The override and exception log.
- The human review definition and disagreement rate.
- The mapping from model output to reason codes.
The eighth is where most programs are thin, and where the requirement lands: a mapping never tested against real declined files is a diagram. A vendor that cannot explain its output raises a question for AI Vendor and Third Party Review.
The fourth and fifth already sit in your security program's vendor file. All eight must be dated, findable, owned and refreshed by a named event, as on Security Assessment; Examination and Evidence Readiness assembles them.
What this article claims, and what it leaves to others.
We build governance, documentation, evidence and human review structure, not model validation or statistical fairness testing. Counsel and the compliance officer own the legal reading for your state, including whether any given step in your chain produces adverse action, and which exception is relied on.
We publish no engagement histories. Judge the work by what is here: dated obligations, with whom each reaches, and the artifacts.
A lender with an AI assisted model has a harder question than in 2023, because the obligation never moved. Your next step: pull twenty recent declines from a link a model already touches, read the reason given on each, and decide whether it describes the applicant or the process. If the process, the gap is the mapping, which can be built. Where no inventory exists, the AI Governance Assessment comes first.
Sources
- 12 CFR 1002.9, Notifications, Regulation B, eCFR.
- 15 U.S.C. 1681m, Requirements on users of consumer reports, Office of the Law Revision Counsel.
- 12 CFR Part 1022 Subpart H, Duties of users regarding risk based pricing, eCFR.
- CFPB, Withdrawal of Guidance, 90 FR 20084, 12 May 2025, document 2025-08286, Federal Register.
- Federal Reserve SR 26-2, revised model risk management guidance, Federal Reserve.
- 12 CFR Part 1002, Regulation B, as amended by the final rule effective 21 July 2026, eCFR.
- NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adoption map, NAIC.
Each checked 23 September 2026.
Where a model touches lending, the record is the argument.
Bring the workflow as it runs, including the parts nobody approved.