The Loan Algorithm Has to Show Its Work

A system that decides whether you get a mortgage in Europe has a deadline to show how it reached the no. That deadline is 2 December 2027, when the AI Act's high-risk obligations bind, and credit scoring sits on that list. The conditions for getting a mortgage are the ones you already know, income, payment history, debt-to-income ratio, the value of the property, and from that date the bank has to be able to document how it weighed them. Article 11 and Annex IV require precise technical documentation; Article 49 forces the system to be registered in a European database; a firm out of compliance faces fines of up to 3% of worldwide turnover. The date has already moved once: the Digital Omnibus pushed it back sixteen months from 2 August 2026. Explainability is on its way from optional feature to licence to operate, and the sixteen months tell you which clause the industry fought hardest.

For years the standard answer to "why was I refused a mortgage?" was a polite version of "it's complicated." The model has thousands of parameters, the logic doesn't reduce to a sentence, the customer wouldn't understand. The black box was a business model, not a law of nature. It kept the decision out of reach of anyone who wanted to challenge it, and turned a limit on transparency into a convenient shield.

Look at what Annex IV actually asks and the trick shows itself. General description of the system, its purpose, its logic. The data used to train it and that data's limits. Accuracy metrics and the cases where the system fails in predictable ways. The human oversight measures in place. These are exactly the things a team that understands its own system has already written down somewhere. If you don't have them, that gap is a design choice: the system was never built to be inspected. The law doesn't ask you to simplify the neural network. It asks you to be able to open it.

It is an engineer's distinction, and it matters. A production system with no logs is one you can neither appeal nor debug: when something breaks you don't know where to look, and no one outside can hold you to a step you never recorded. Documentation is the decision's log. The black box was a business model because not keeping that log, or not showing it, paid better. Annex IV makes the log a condition of operating, and a decision you have to document becomes a decision someone can contest.

Here Europe adds the piece that closes the loop, and it is the half that arrives first. France's CNIL, in its May 2026 recommendation on credit, states that every applicant can request a human review of an automated refusal, and sets which data a bank may use to assess solvency: no social media, past payment incidents only where objective and contextualised, capped retention. That right rests on data-protection law and it holds today, without waiting for 2027. You can inspect only what was made inspectable; you can challenge only what leaves a trace. The right to human review is worth exactly as much as the documentation feeding it, and the documentation is the half Europe postponed.

The strongest objection deserves its due, because it is true. Documentation is not understanding. An Annex IV dossier can become compliance theatre: six hundred pages no inspector will read, written to pass the audit rather than to shed light. Adherence-transparency exists, and regulated sectors have known how to manufacture it for decades. But even theatre leaves a script. A badly documented system stays more contestable than one not documented at all, because the trace is there and someone can read it against whoever wrote it. The threshold is moving: opacity was the free default, and it is being given a price.

This is where it reaches whoever builds or buys decision systems, not only the banks. The practical rule is blunt: if you can't document it, you can't defend it, and by December 2027 you can't ship it in Europe. Documentability is becoming the right to operate. Whoever built their stack as a closed box, trusting that no one would ask to look inside, holds a technical debt with a legal deadline. Whoever kept it inspectable from the start finds they are already compliant, because they wrote those logs for themselves, not for Brussels.

The official framing reads all this as a burden: another filing, another form. The mechanism says the opposite. A machine that has to show its work is a machine a human can still contest, correct, overturn. The human keeps the verb, which is the part that counts: to ask, to challenge, to decide in the last instance. Documentation is not the machine's leash. It is the key that keeps it open.

The rest is a question of who answers. A decision with no log has no author to knock on: no one wrote it, no one defends it, and you are left with a no that has no sender. The AI Act will put a name at the bottom of the page, sixteen months later than it first promised.