AI Governance and Compliance Controls for CFPB Small Business Lending Rule 1071

What Rule 1071 Requires and Where AI Enters the Workflow

CFPB's Small Business Lending Rule amends Regulation B to require covered financial institutions to collect and report data on small business credit applications, including loan amount, action taken, pricing information, census tract, gross annual revenue, and applicant demographic information such as race, ethnicity, and sex of principal owners. The rule builds on a statutory baseline of data points set by Dodd-Frank Section 1071 and adds further data points defined by CFPB. Coverage applies to financial institutions originating a minimum threshold volume of small business loans, with compliance dates tiered by loan volume.

AI systems increasingly sit inside this workflow before any credit decision is made. Document extraction tools pull applicant financial data from submitted forms. Intake systems classify or route applications. Underwriting support tools summarize applicant records or draft credit memos. Each of these touches data fields that Rule 1071 requires the institution to collect, retain, and report accurately, even when the AI tool is not making the final credit decision itself.

The Firewall Provision and AI Permissioning

Rule 1071 includes a firewall provision restricting employees or officers involved in credit decisions from accessing applicant-reported protected demographic data, except under specified exceptions. This provision was written for human roles, but the same logic applies to any AI system or agent that reads applicant records. An AI tool used for underwriting support that also has access to demographic fields recreates the access problem the firewall is designed to prevent, regardless of whether a human ever views the data directly.

This creates a concrete permissioning requirement. Institutions need a way to define, at the field level, which AI agents or tools may read demographic data and which may not, and to enforce that separation consistently across intake, underwriting, and reporting stages of the loan lifecycle.

Algorithmic Decisioning and Audit Trail Obligations

CFPB guidance on adverse action notices states that using a complex or automated underwriting model does not exempt a creditor from ECOA and Regulation B requirements to provide specific and accurate reasons for adverse action. A model's complexity or lack of transparency is not a defense during examination. Any AI or machine learning component contributing to a credit decision must be capable of producing traceable, decision-specific outputs rather than an opaque score alone.

This has direct implications for recordkeeping. Rule 1071 requires retention of collected data in a form usable for CFPB examination, and that obligation extends to data an AI system has generated, extracted, or modified. An audit trail that shows only the final reported value, without a record of which system produced it, which model version was involved, and what data the tool accessed at each stage, is unlikely to satisfy an examiner's request to reconstruct the decision path.