Your rights when AI determines your credit score

AI-driven credit scoring is one of the most consequential AI applications affecting individuals globally. Whether you are applying for a mortgage, credit card, personal loan, or business finance, AI increasingly determines the outcome. Your rights vary significantly by jurisdiction, but the trend across all major markets is toward greater transparency, explanation rights, and regulatory scrutiny of AI credit decisions.

United States

The Equal Credit Opportunity Act (ECOA) and Fair Credit Reporting Act (FCRA) apply to AI credit scoring with the same force as to traditional scoring. The CFPB has been active on AI credit: adverse action notices are required when credit is denied or terms are worsened, and these must provide specific reasons, not just "the algorithm decided." The CFPB's position is that lenders cannot use AI as a black box to avoid adverse action notice requirements.

Disparate impact liability under ECOA applies regardless of intent. If AI credit models produce systematically worse outcomes for protected classes, the lender is liable. The Mobley v Workday class action (preliminary nationwide collective May 2025) and Eightfold AI case (January 2026) demonstrate active litigation. FCRA gives you the right to access your credit report, dispute inaccuracies, and be told when your credit file was used in a decision.

What you can do: Request your free annual credit reports from annualcreditreport.com. If denied credit, you must receive an adverse action notice with specific reasons. File disputes with credit bureaus for inaccuracies. Complain to the CFPB at consumerfinance.gov.

European Union and UK

GDPR Article 22 provides the right not to be subject to decisions based solely on automated processing that produce legal or significant effects, including credit decisions. You have the right to obtain meaningful information about the logic involved, to express your point of view, and to contest the decision. The CJEU's Dun & Bradstreet ruling (C-203/22, 27 February 2025) strengthened explanation rights: a complex algorithmic description alone does not constitute adequate explanation.

In the UK, the DUAA 2025 (Section 80, in force 5 February 2026) replaced Article 22 with Articles 22A-D. The new framework is more permissive for standard automated decisions but preserves stronger protections where special category data is involved. The ICO's updated ADM guidance (consultation 31 March - 29 May 2026) will clarify the practical position for UK credit scoring.

What you can do: Request information about the logic involved in automated credit decisions. Contest the decision and request human review. Subject Access Request to see what data the lender holds. Complain to your national data protection authority (ICO in UK, CNIL in France, BfDI in Germany).

Australia

The Privacy Act's ADM transparency obligation (effective 10 December 2026) will require organisations to disclose when automated decision-making substantially affects individuals, including credit decisions. Currently, the Privacy Act's Australian Privacy Principles (APPs 5, 6, 12, 13) provide rights to access and correct personal information used in credit decisions. The Credit Reporting Code provides additional protections for credit reporting information. ASIC (Australian Securities and Investments Commission) and OAIC (Office of the Australian Information Commissioner) both have jurisdiction over AI credit scoring practices.

What you can do: Request access to your credit file from credit reporting bodies (Equifax, illion, Experian). Dispute inaccuracies. From 10 December 2026, request disclosure of automated decision-making involvement. Complain to OAIC or AFCA.

Singapore

The PDPA's consent and purpose limitation obligations apply to AI credit scoring. The PDPC's March 2024 Advisory Guidelines on AI Recommendation and Decision Systems clarify how PDPA applies to AI-driven decisions including credit. MAS (Monetary Authority of Singapore)'s FEAT Principles (Fairness, Ethics, Accountability, Transparency) apply to financial services AI. Penalties up to S$1 million or 10% of turnover.

India

The DPDP Act 2023 and DPDP Rules 2025 (notified 13 November 2025) apply to AI credit decisions. RBI's FREE-AI Framework addresses AI in financial services. The Data Protection Board of India (operational from 13 November 2025) accepts complaints. Penalties up to ₹250 crores.

What to look for in any jurisdiction

Regardless of where you are, if AI was involved in a credit decision that went against you: ask for the specific reasons (most jurisdictions require this); ask whether AI or automated processing was used; request access to the data used in the decision; check the data for accuracy and dispute errors; ask about appeal or review mechanisms; contact the relevant regulator or ombudsman if the lender doesn't respond adequately.

Primary sources: CFPB · ICO · OAIC · PDPC Singapore

Related reading