AI in Credit Decisioning: Govern It Before the Rules

If a model is scoring your borrowers and drafting the credit memo while your written lending policy still describes a loan officer reading a file by hand, you have a governance gap, and it is exactly the kind regulators and new state laws are starting to probe. The answer is not to pull the model out. It is to put real controls around it: a human who can override an adverse decision, documentation an outsider could follow, and a report on the model that actually reaches the board.

Nobody decides to create this gap. The model arrives as a vendor feature or a pilot that worked, the team leans on it because it is faster, and updating the policy is the boring task that never gets scheduled. Here is what the current rules already require, what is coming, and the order I would build the governance in.

AI in credit decisioning is outrunning your lending policy

The pattern worth naming is simple: AI changes how the decision gets made, but the policy, the document your examiner and your auditor read, still describes the old process. When the two drift apart you cannot show anyone how a given loan was actually approved or declined, and that is the first question that comes up when a borrower complains or a regulator asks.

Colorado has put down a marker. A new Colorado law takes effect January 1, 2027, and covers automated decisions about individuals, including lending. The law tells deployers to use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination, and it covers providing a consumer with an opportunity to appeal, via human review if technically feasible, an adverse decision. Colorado is one state. Treat it as a preview, because a human-review-on-request standard is hard to meet if your process never built one in.

Take the P&L check: 10 questions, about 3 minutes, and see how much AI could move your P&L.

What automated credit decisions already owe the borrower

Even with no new state law, a lender that uses AI to decline credit is already bound by federal rules. The Consumer Financial Protection Bureau has said plainly that there is no special exemption for artificial intelligence. You still owe the applicant the specific, accurate principal reasons for the decision, and "the algorithm is complicated" is not a defense. In the Bureau's words, this requirement remains even if those companies use complex algorithms and black-box credit models that make it difficult to identify those reasons.

In practice that means your reason codes have to describe what the model actually scored, not a stock checklist. A generic code that does not reflect the real driver of the decision will not satisfy the rule, and a borrower who gets a vague reason is a borrower more likely to complain. Fíjate that this is the easiest part to get wrong, because the reason codes often come straight from the vendor and nobody checks them against what the model weighed.

AI credit models still fall under model risk discipline

A credit score is a model, and a model has a rulebook of its own. The Federal Reserve and the Federal Deposit Insurance Corporation have revised their model risk management guidance, and it is worth knowing where it bites. The guidance is expected to be most relevant to banking organizations with over $30 billion in total assets. If you sit below that line it is not squarely aimed at you, and the agencies are explicit that non-compliance with this guidance alone will not result in supervisory criticism against a banking organization.

So this is not a hard rule for most lenders. The discipline behind it is still good sense, though: a model that decides who gets credit needs a named owner, a test before it goes live, and someone watching it for drift once it is running. You would not let a new underwriter approve loans with no review; do not let a model do it either.

The governance to put around AI in credit decisioning

You do not need a committee and six months. You need a handful of controls you can show on one page. Here is the order I would build them in:

Human override on every adverse decision. Any decline, or a worse offer than the borrower asked for, that the model drove should be reviewable by a named person who can reverse it and who writes down why. This is what Colorado's appeal standard will want, and it is plain sense (nobody wants to be the one who signed off on a decline they cannot explain).
Put the model into the lending policy. If the policy describes a person reading a file and the reality is a score plus a memo the model drafted, rewrite the policy to match. Name the model, say where it sits in the decision, say who can override it, and say what happens the day it is down.
Documentation an outsider could follow. Keep a plain record of what the model uses, how it was tested, and the reason codes it maps to. The test is whether someone who has never seen your shop can read it and understand how a decision was reached.
Reason codes that are true. Check a sample of real adverse-action notices against what the model actually weighed. Fix any that are vague or wrong before a regulator or a borrower finds them.
Board reporting. Put the model on a regular report to the board or the top credit committee: approval and decline rates, override rates, overrides that got reversed, and any sign the model is drifting. If it moves the book, it belongs where the book is governed.

AI in underwriting touches real money (approval rates, loss rates, the cost to decision a file, etc.), so it belongs in your P&L conversation, not only in a compliance binder. Govern it as something that moves numbers, because it does.

Frequently asked questions

Do we have to tell a borrower that AI made the decision?

Under federal adverse-action rules you already have to give the specific, accurate principal reasons for a denial, whatever technology produced it. The CFPB has said there is no special exemption for artificial intelligence, and that this requirement remains even if those companies use complex algorithms and black-box credit models that make it difficult to identify those reasons. Build a process that can produce a true reason for every decline, because a complaint or an exam will test it.

Does the revised model risk guidance apply to a small lender?

The revised model risk management guidance from the Federal Reserve and the FDIC is expected to be most relevant to banking organizations with over $30 billion in total assets, and the agencies say non-compliance with this guidance alone will not result in supervisory criticism against a banking organization. If you are smaller, it is not squarely aimed at you. The discipline still is: a credit model needs an owner, a test before launch, and monitoring for drift, whatever your size.

What does Colorado's AI law require for lending decisions?

A new Colorado law takes effect January 1, 2027, and covers automated decisions about individuals, including lending. It tells deployers to use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination, and it covers providing a consumer with an opportunity to appeal, via human review if technically feasible, an adverse decision. Even if you do not lend in Colorado, a human-review path is a sensible thing to build now.

Sources

Consumer Financial Protection Bureau, 2023-09-19 (consumerfinance.gov)
Federal Deposit Insurance Corporation, 2026 (fdic.gov)
Board of Governors of the Federal Reserve System, 2026 (federalreserve.gov)
Colorado General Assembly, 2024 (leg.colorado.gov)
PYMNTS, 2026-10-28 (pymnts.com)