The AI Act gives you the right to challenge an automated credit decision

A receipt for your rejection

When a bank's algorithm declines your loan application, it's like getting a 'no' from a machine that won't say why. From December 2027, the AI Act changes that. If the decision was made by a high-risk AI system and it affects you legally or significantly, you can ask for an explanation of what the AI did and why it mattered ^[1].

The right is narrow but real. It covers decisions made with high-risk AI under Annex III of the AI Act, which includes systems used for credit scoring and assessing the creditworthiness of natural persons ^[3]. It doesn't cover every piece of software that touches a credit file, only the systems that count as high-risk. For those, Article 86 says the person affected gets a clear and meaningful explanation of the AI system's role and the principal elements of the decision ^[1].

GDPR Article 22 already gives you some protection: you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you ^[2]. There are exceptions, such as when the decision is necessary for a contract or you've given explicit consent, but even then you can ask for human involvement, express your view and contest the decision ^[2]. The AI Act's Article 86 adds a specific duty to explain, for high-risk systems.

What the lender has to do

High-risk AI systems must allow for automatic logging of events over their lifetime, under Article 12 ^[4]. That means the model's decisions, the data it used and the version it was running need to be recorded as they happen. The log is what lets the lender answer your question six months later: which model ran, what inputs it saw, what score it gave and who reviewed it.

The logging rule applies from 2 December 2027 for Annex III systems ^[5]. It says what to log, not how to protect the logs, but a log the lender can edit without anyone noticing is easy to challenge. When someone asks for an explanation, the first question is whether the record of what happened can be trusted.

What this means for you

If you're a credit provider using AI for scoring or automated decisions, here's what to think about now:

• Which of your systems count as high-risk under Annex III? Credit scoring of natural persons is explicitly listed ^[3].
• Are you logging decisions in a way that lets you explain them months later, with the model version, input references and output?
• Could you show an auditor or a regulator that the log hasn't been changed since the decision was made?
• Do you have a process for giving clear explanations when someone asks, and for letting them contest the decision?

If you're the person whose application was declined, you can ask for an explanation once the rule applies. GDPR's Article 22 rights are already in force ^[2].

Sealing the decision as it's made

This is where a digital witness fits. The thing to seal is each decision record as it's written to the log: the applicant reference, the model version, the input summary, the score and the name of the reviewer who saw it. Sealing takes a fingerprint of the record, not the data itself, so the decision never leaves your systems.

When someone asks for an explanation six months later, anyone you share the record with can check that it's exactly what was written on the day. Your system sends the fingerprint to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, you calculate the fingerprint again and compare it with the sealed one. The first 2,000 witnesses a month are free. Read the docs.

What it shows: that the record existed at that time and hasn't changed since it was sealed.

What it doesn't: it doesn't show that the decision was fair, lawful or correct, or that the log is complete. It gives you a record you can stand behind, not a defence.

How it would work

1. Each time the scoring model writes a decision, your system takes a fingerprint of the record and seals it.
2. The sealed fingerprint is stored with the decision, and the log continues as normal.
3. When the applicant asks for an explanation, you retrieve the record and show that the fingerprint still matches the sealed one.

What to watch

The high-risk requirements for Annex III systems, including the logging duty in Article 12, apply from 2 December 2027 ^[5]. Article 86, the right to an explanation, applies from the same date ^[1]. Fines for breaching the high-risk rules can reach €15 million or 3 per cent of global annual turnover, whichever is higher, with lower caps for small and medium-sized enterprises ^[6].

GDPR Article 22 has been in force since 25 May 2018 ^[2]. Breaches can be fined up to €20 million or 4 per cent of global annual turnover ^[2].