Explaining automated decisions

The customer needs to know what happened and what to do next: confirm their identity, send a document, try again later or ask for a review. The analyst needs the facts the system saw and the drivers behind the score, to confirm or overturn the decision. The regulator or auditor needs to rebuild the decision exactly, with the data used, the model and rule versions, and the reviewer.

The three explanations differ in length and vocabulary, but they must agree, and they only stay in step when all three come from the same record.

Across jurisdictions, people affected by automated decisions are entitled to understand and challenge them. This summary was checked on 25 October 2026; your counsel should confirm what applies to you.

European Union, GDPR

Article 22 restricts decisions based solely on automated processing that significantly affect people, and where such decisions are allowed it requires at least human intervention and a way to contest. The EU Court of Justice has held that a credit score can itself be such a decision when lenders give it a determining role (SCHUFA, 2023), and that people must be told the procedure and principles actually applied, in a form they can understand (Dun & Bradstreet Austria, 2025).

European Union, AI Act

Annex III classes credit scoring of individuals as high-risk and leaves out systems used to detect financial fraud. Article 86 gives affected people a right to clear and meaningful explanations of the role of the system and the main elements of the decision. A 2026 amendment moved the Annex III obligations to 2 December 2027.

Brazil, LGPD

Article 20 gives people the right to request review of solely automated decisions that affect their interests, including credit profiles, and to receive clear information on the criteria and procedures used, subject to commercial secrecy.

United Arab Emirates

The 2021 joint guidelines of the Central Bank of the UAE, the SCA, the DFSA and the FSRA ask for explainable material AI models, a record of every model version, the ability to reverse erroneous decisions by hand, and clear explanations for customers who ask, without exposing intellectual property or source code.

Dubai International Financial Centre

Regulation 10, in force since September 2023, requires notice when personal data is processed by autonomous or semi-autonomous systems, and the ability to explain that processing in non-technical terms.

United States

SR 26-2, issued in April 2026, replaced SR 11-7. It expects effective challenge by independent reviewers, outcomes analysis and adequate documentation, and leaves generative and agentic AI outside its scope, so text written by a language model needs its own controls.

Write the record once, when the decision is made, and never overwrite it.

Inputs as seen

Every value the system used, as it stood then, including answers from outside services such as a credit bureau. Today's customer record is no substitute.

Versions

The model and rule set versions, with the lists and thresholds in force.

Score

The score and the band it fell into.

Reasons

Reason codes ranked by their effect on this decision, with the values behind them.

Action

Approve, decline, step up, hold or refer, with any limit attached.

Review

Who reviewed the case, when, and what they decided and why.

Message

The exact text the customer received, and its language.

Reason codes should describe what moved this score for this customer. Use an attribution method suited to the model and check that it is stable, so that two nearly identical cases receive the same reasons. Map the drivers to a short library of plain-language reasons approved by compliance, in each language you serve.

If a language model writes the customer letter or analyst note, generate it only from the recorded reasons and values, check it against them before sending, and store it with the record. A fluent explanation that does not reflect what the model used is worse than none, because it misinforms the customer and, later, the regulator.

A credit applicant can be told which factors weighed most and what would change the outcome; the EU Court of Justice noted that showing how different data would have led to a different result can make an explanation intelligible. A detailed fraud reason, by contrast, teaches a fraudster which signal to avoid.

Tell the customer enough to act: the payment is held for a security check, here is how to confirm it was you, and here is how long it takes. Keep the specific signals in the analyst view and the audit record. Data protection rules still apply to solely automated fraud decisions that significantly affect a customer, even where the AI Act does not.

Every automated decision with a significant effect should come with a clear way to ask for review, handled by people who see the full record and can overturn the decision. Overturned decisions are also your best feedback on where a model or rule is wrong.

Keep a simpler challenger model, such as a scorecard, beside the main one, and send cases where the two disagree sharply to a person. Document each model's known limits, such as customers with little history or products it was not trained on, so reviewers know them.

Generic reasons

"Did not meet our criteria" gives the customer nothing to act on and the analyst nothing to check.

Explanations written after the fact

Reasons rebuilt from today's data and model can differ from the ones that applied. Store them when the decision is made.

No version history

A firm that cannot say which model and rules were live on a given date cannot defend decisions made that day.

Review in name only

A reviewer who sees only the score and always confirms it is not the human review the rules intend.

Specific reasons

The share of adverse decisions that carry at least one specific, approved reason.

Time to reconstruct

How long it takes to rebuild, in full, a decision from six months ago. Test a random sample each quarter.

Complaints and appeals

Their rate per adverse decision, by product and channel.

Appeals overturned

The share of reviews that reverse the decision. A rising share points to a model or rule problem; a share near zero may mean reviews are not independent.

1. 1
   Can we rebuild any decision from last year, with the inputs and versions used at the time, within a working day?
2. 2
   Where do our reason codes come from, and who approved the customer wording for each one?
3. 3
   If a language model drafts customer letters, what checks each one against the recorded reasons?
4. 4
   What do we tell a customer whose payment was stopped for fraud, and does it reveal how our controls work?
5. 5
   Who reviews contested decisions, what do they see, and how often do they overturn them?

Choose one decision type, such as card declines or personal loan refusals, and try to reconstruct a random sample of last quarter's decisions from what you store today. The gaps you find set the order of work. Every decision made with Mantika Argus carries a reason in plain words that your team and your regulator can read.