How Banks and Insurers Tell Customers a High-Risk AI System Helped Decide

What the obligations actually require

In US credit decisions, ECOA, implemented by Regulation B, requires a creditor to tell an applicant the principal reasons for adverse action, or to disclose the right to request them. CFPB Circular 2022-03 states that this applies equally to all credit decisions regardless of technology. A creditor using complex algorithms, including AI or machine learning, in any aspect of a decision must still disclose the specific principal reasons, and no factor that was a principal reason may be left out. Circular 2023-03 extends the same point to complex or black-box models and describes the notice as a way to prevent and identify discrimination by requiring creditors to explain their decisions.

The FCRA adds a second disclosure. Regulation B commentary, quoted in Circular 2022-03, says the FCRA requires a creditor to disclose when its decision rests in whole or in part on information from a source other than the applicant or its own files.

Under the EU AI Act, the Commission states that where a high-risk AI system is designed to make or assist in making decisions about natural persons, the deployer must inform the affected person. This applies where the system's output was used to take a decision that produces legal effects. The Regulation also gives an affected person the right to obtain from the deployer clear and meaningful explanations of the AI system's role in the decision-making procedure and the main elements of the decision. That right covers decisions based on the output of an Annex III high-risk system (excluding point 2 of Annex III) that produce legal effects or similarly significantly affect the person adversely in terms of health, safety or fundamental rights. The recitals add that information to individuals should include the intended purpose and the type of decisions the system makes, and that deployers should tell people about the right to an explanation.

Two disclosure models side by side

The regimes differ in trigger and in content. A single process may need to produce both outputs for the same decision. Status as of November 2026.

• ECOA / Regulation B: Trigger: adverse action on credit. Content: specific principal reasons, or notice of the right to request them. Timing cited in CFPB supervision reporting: 30 days after a completed application, or 30 days after adverse action on an incomplete one.
• FCRA (as referenced in Reg B commentary): Trigger: a decision based in whole or in part on information from a source other than the applicant or the creditor's own files. Content: disclosure that outside information was used.
• EU AI Act deployer duties: Trigger: a decision using the output of a high-risk system, with legal effects or similarly significant adverse effects. Content: the AI system's role, the main elements of the decision, intended purpose, decision type and the right to an explanation.

Treat the decision event as the trigger

Legal text is written around the decision. Operations have to be built around the event that creates it. Both regimes turn on whether an AI system's output was used in a decision about a person, so the first control is a reliable answer to that question. Many institutions can describe their AI systems in an inventory but cannot show, for a given customer interaction, whether a system was involved, what it was permitted to do and what it produced.

The sources do not prescribe a mechanism, so the following is a design inference. Each decision should carry a signal that names the AI system, the decision and the output used. It should also carry the principal reasons generated for any adverse action, and an indicator when outside information contributed. Without that record, the notice team is left to reconstruct events after the fact, which is where inconsistent disclosure tends to start.

There is also a content constraint. The CFPB states that ECOA and Regulation B do not permit creditors to use technology for which they cannot provide accurate reasons for adverse actions. A model that cannot yield accurate, specific reasons for each decision is a notice problem before it is a model risk problem, and the test belongs in design review rather than in complaint handling.

What an examiner will want to see

The CFPB's 2024 fair lending report reflects supervisory work on automated systems and models, sometimes marketed as AI/ML, in credit card originations. Its adverse action findings under 12 CFR 1002.9 included failure to give notice within 30 days of a completed application and failure to provide sufficient information in a notification, including the specific reasons for the action. Those two findings map directly to evidence: proof of timing, and proof of content.

An examiner will reasonably ask for a chain that connects the decision to the AI system involved, the trigger evaluation, the notice text, any human review and the delivery time. The sources do not set retention periods, so the institution has to define them and apply them consistently. Model risk management teams will also expect that chain to sit alongside validation and monitoring records, so the disclosure record and the model record can be reconciled rather than maintained in separate silos.

Because the notice also serves fair lending oversight, the reasons it states are relevant beyond consumer disclosure. Monitoring notice content and timing as controls, not only as correspondence, gives risk functions an earlier view of weak spots.

Where runtime enforcement supports the process

Trussed enforces policy in the execution path, so decisions about individual AI interactions and tool calls are enforced at runtime, not reviewed after the fact. Policy can allow, redact or block an interaction, or escalate it for human approval. In a disclosure process, that gives the notice trigger and the human escalation step a defined point of control. An interaction that falls in a covered decision type can be routed for approval, and the enforcement decision is recorded as it happens.

That enforcement produces continuous, audit-ready evidence, mapped to NAIC, NYDFS, the EU AI Act and NIST. Insurance is the regulated financial sector where Trussed is deepest, and the platform has run in continuous production in a regulated enterprise for more than 18 months. The scope is bounded. Reason generation sits with the institution's models, and notice drafting and delivery remain in its own correspondence systems. What the execution path adds is a record of what the AI was allowed to do and what happened, which the notice process can reference.