New EU rules give consumers the *right to challenge* AI credit decisions

A bank's AI declines your loan application. You ask why. The answer matters, because you want to know whether to fix something and try again, or whether the decision was wrong.

From 2 December 2027, EU rules give you that right. Article 86 of the AI Act says that when a high-risk AI system makes a decision with legal or similarly significant effects, the person affected can ask for a clear explanation of the AI's role and the decision's main elements. ^[1] Credit decisions about individuals are explicitly high-risk under Annex III. ^[2]

It's less a new idea and more a sharper tool. GDPR Article 22 already says people have the right not to be subject to decisions based solely on automated processing, including profiling, when those decisions have legal or similarly significant effects. ^[4] Exceptions apply for contracts, legal requirements and explicit consent, and in those cases the person must at least be able to ask for human intervention and challenge the decision. The AI Act builds on that foundation and adds detail for high-risk systems.

What lenders must do

The explanation must be clear and meaningful. ^[1] That means more than "the algorithm said no". The person needs to understand what the AI looked at, what mattered and why the outcome went the way it did.

Article 12 requires high-risk AI systems to log events automatically over their lifetime, so decisions can be traced and explained later. ^[3] The logs are what make the explanation possible months after the decision was made. They record what the system did, which version ran and what data went in.

A lender also has to allow for human oversight. Article 14 says users of high-risk AI must be able to interpret the system's output and decide whether to act on it. ^[5] When someone exercises their right under Article 86, a human reviews the case.

When it applies

The high-risk requirements for Annex III systems, including credit scoring of individuals, apply from 2 December 2027. ^[2] That gives lenders just over a year to get their AI systems in order: documentation, logging, human oversight and a process for handling requests.

Credit decisions about companies are not listed as high-risk, so Article 86 does not apply to them. The right is for individuals.

GDPR Article 22 already applies, so purely automated decisions with significant effects are restricted now. ^[4] The AI Act adds the obligation to explain, and it draws the line more clearly for high-risk uses.

The logging question

Article 12 says what to log. It doesn't say how to protect the logs. ^[3]

Six months after a decision, when someone asks for an explanation, the lender needs to show what the AI did. The explanation rests on the logs. If the logs themselves can be questioned—because someone with access could have edited them—the explanation is harder to defend.

A log kept by the people who could change it is a bit like a diary: useful, but only as trustworthy as the writer. When a decision is challenged, both sides want something more solid.

A digital witness for each decision

Here, the thing to seal is each credit decision as it's written to the log: the applicant reference, the model version, the score, the reason codes and the reviewer if there was one. Sealing takes a fingerprint of the record, not the record itself, so the decision data never leaves your systems.

The fingerprint is sealed on WitniumChain, where any later change would show. When someone asks for an explanation months later, you calculate the fingerprint again from your log. If it matches the sealed one, the record is exactly what was written on the day. Change a single character and it won't match.

Anyone you share the record with—an ombudsman, a supervisor or the applicant's representative—can check it the same way. They don't have to trust that you kept it safe; they can see for themselves that it hasn't changed.

What it doesn't do: it doesn't show that the decision was fair, lawful or based on the right data. It shows that the record is unchanged. The fairness of the decision is a separate question, and the one Article 86 is really about.

You can seal records as they are written, with the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free.

How it would work

1. Your credit system writes the decision and calls the API with a fingerprint of the record.
2. The API returns a witness ID, which you store alongside the decision.
3. When someone asks for an explanation, you retrieve the record, calculate the fingerprint again and check it against the sealed one.

What this means for you

If you use AI to decide on loans, ask yourself:

• Can we explain, in plain language, what our AI looked at and why it reached its decision?
• Do our logs record enough to support that explanation six months later?
• Could we show that the log record hasn't been edited since the decision was made?
• Who handles requests under Article 86, and do they have access to the logs and the model documentation?
• If someone challenges a decision under GDPR Article 22, can a human review it with full context?

The rules come into force in December 2027, but the questions are worth asking now. Systems take time to change, and so do processes.

What to watch

2 December 2027: high-risk requirements for Annex III systems, including logging, human oversight and the right to explanation, apply across the EU. ^[2]