AI IN REGULATED DECISIONS
When a model shapes a lending decision, someone still has to give the reason.
Whatever else moved in 2026, a creditor taking adverse action still owes a statement of reasons that is specific and indicates the principal reasons. A model nobody can interrogate cannot reliably produce one.
Three situations this engagement answers.
- A model scores, prices or routes applicants, and nobody can say how its output becomes the notice.
- A complaint, audit or examination asked for one decision's reason, and it had to be rebuilt.
- A vendor's underwriting or valuation model goes live soon, and compliance wants documentation first.
Where AI touches the chain, link by link.
| Link | Why it matters |
|---|---|
| Lead scoring and prequalification | Ranking and routing before an application. Whether a decline here is adverse action is your compliance officer's reading. |
| Identity and income verification | Can stop a file, no decision recorded |
| Document classification and extraction | A wrong field looks like a fact |
| Underwriting recommendation | Regulated decision: a denial produces a notice |
| Pricing and rate sheet application | Regulated decision: less favorable terms can produce a notice |
| Exception and override handling | Regulated decision: the file is judged on its basis |
| Servicing, including loss mitigation triage | Can change terms a borrower holds today |
| Collections prioritization | Shapes treatment with no recorded decision |
Eight items a review function asks for.
Internal audit, counterparties and supervisors ask for the same eight.
- The inventory entryWith its named owner and consequence tier.
- The approval recordIts basis and conditions.
- The inputs and their provenanceData categories, each traced to its source.
- What the vendor does with input dataIn its own writing, including whether anything trains on it.
- The monitoring plan and the last monitoring outputA plan with no output is a document, not a control.
- The override and exception logWhere a person departed from the model, and why.
- The human review definition and the disagreement rateTogether they show whether the review is real.
- The mapping from model output to reason codesWhat connects the system to the notice.
What Regulation B requires of the reason.
Two words in 12 CFR 1002.9 do the work: the statement of reasons must be specific and must indicate the principal reasons, so naming the tool, the policy or the score describes the process rather than the decision. A specific reason comes from a tested mapping between model output and the notice's words, held by a named person.
| Regime | What starts it | What the notice carries | Who it reaches |
|---|---|---|---|
| Regulation B, 1002.9 | Adverse action | Specific principal reasons, within 30 days | Every creditor; business credit under 1002.9(a)(3) |
| FCRA 615(a) | A consumer report used in the decision | Agency details, that it did not decide, rights, any score | Any user of a consumer report, whatever its size or charter |
| Risk based pricing | Materially less favorable terms, using a consumer report | A separate notice, unless a 1022.74 exception applies | Consumer credit; not business purpose credit |
One record has to serve all three. Whether a given step in your process produces adverse action, and which exception at 12 CFR 1022.74 you are relying on, is your compliance officer's reading and your counsel's, not this firm's.
The 2026 Regulation B rule narrowed one source of exposure under one statute, as the adverse action article sets out, and did not amend 12 CFR 1002.9. For a lender with an AI assisted model, the position is harder than in 2023, not easier: the reason duty stands, and the systems behind it are less interrogable each year.
Fair Housing Act, 42 U.S.C. 3605
A change under ECOA alone never settled the position.
- Reaches
- Anyone whose business includes residential real estate related transactions, including making or purchasing loans secured by residential real estate, independently of ECOA.
- Not
- A size test. Scope follows the business.
Two more rules that reach the chain.
Interagency AVM quality control rule, effective 1 October 2025
Six agencies, the OCC, Federal Reserve, FDIC, NCUA, CFPB and FHFA, require a mortgage originator or secondary market issuer that uses an automated valuation model to determine the collateral value of a mortgage secured by a consumer's principal dwelling to adopt policies, practices and control systems that ensure a high level of confidence in the estimates, protect against data manipulation, avoid conflicts of interest, require random sample testing and review, and comply with nondiscrimination law.
It reaches that use and no other; an AVM used by an appraiser in developing an appraisal, or used only to review a completed valuation, is outside it.
Mortgage originators and secondary market issuers, bank and nonbank alike, for that one use.
EU AI Act, Regulation (EU) 2024/1689
The high risk obligations that would reach credit scoring have been deferred to 2 December 2027 by Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026. Whether the Act reaches a US financial institution at all depends on its specific connection to the EU market, a question for counsel rather than an assumption.
Not a typical US community bank, credit union, domestic insurer or nonbank mortgage lender with no EU market presence and no EU output use.
A bank answers the adverse action question from the record the AI Governance Program builds, not a validation report; the model risk guidance is on Financial Services. An insurer runs the same chain in underwriting, rating and claims, and answers for it through market conduct examination. The GSE AI mandates reach it from the Seller/Servicer side.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Five steps, built for the links that produce a notice.
- Map the chain. With your compliance officer and platform owner: which links a model touches and which produce a notice. Fee and duration in writing.
- Name the regimes. Per link, its notices, the record that answers each, and its owner.
- Build the eight items. From your inventory or AI Use Register and the vendor's documentation.
- Test the mapping. On real files and notices you choose; where no specific reason emerges, the finding says what is missing.
- Hand over. Signed off, with review dates for the AI Governance Program or your calendar.
Where no inventory exists, the AI Governance Assessment comes first. We build governance, documentation, evidence and human review structure. Independent quantitative model validation, including statistical fairness testing, is a distinct discipline we do not perform. No deliverable from this firm is represented as proof that a decision process is compliant.
Before you sign.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Your date | Tell us the date. The first reply, within one business day, says whether we can meet it. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
| Is this model validation? | No. An existing validation report goes in the file, and we track whether it is current. |
| Is this a security assessment? | No. Its two vendor items sit inside your security program's oversight duty. |
The work begins where a model touches a decision.
Tell us which links a model touches, which end in a notice, and who owns the reason codes.
- Unit
- The links of your chain that produce a notice
- Fee
- In writing once a written scope is agreed, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.