AI in credit decisioning: promise and guardrails
Artificial intelligence is increasingly part of how credit decisions get made, and lending is no exception. The promise is real: faster decisions, greater consistency, the ability to weigh more information than any human could review by hand. But so are the risks, and the right response to powerful technology in a high-stakes setting is not uncritical enthusiasm — it is a clear set of guardrails. This is commentary on the use of AI in credit decisioning, the safeguards that matter, and the specific protection UK data-protection law provides against being subjected to purely automated decisions. We describe our own approach as part of it.
The promise
Used well, automation and AI can genuinely improve lending. They can assess applications quickly, which matters enormously to a business that needs a decision in hours rather than days. They can apply criteria consistently, reducing the arbitrary variation that creeps into purely manual decisions. And they can draw on richer, more current data — such as the live transaction information made available through Open Banking, which we discuss in the rise of Open Banking in lending decisions — to form a more accurate picture of a business’s circumstances.
For the kind of small, fast lending we do, these capabilities are not luxuries. The economics of serving small tickets quickly depend on efficient assessment. Automation is part of what makes it possible to serve businesses that mainstream lenders find uneconomic to assess at all.
The risks that demand guardrails
The same power that makes AI useful makes it dangerous without discipline. Three risks stand out. First, opacity: a complex model can produce a decision that no one can readily explain, which is corrosive to fairness and trust. Second, bias: a model trained on historical data can absorb and reproduce patterns of disadvantage hidden in that data, disadvantaging applicants for reasons that have nothing to do with their actual creditworthiness. Third, error at scale: an automated process applies any flaw consistently, meaning a single mistaken rule can affect many applicants identically.
These are not reasons to avoid the technology, but they are reasons to constrain it. The question is never simply “is the model accurate?” but “is it explainable, is it fair, and is there a human who can catch what it gets wrong?”
The role of human review
The single most important guardrail, in our view, is meaningful human involvement. Automation can sift, score and speed up; it should not be the sole and final arbiter of a consequential decision with no human able to review it. A person should be able to understand the basis of a decision, question it, and override it where the circumstances warrant — particularly in finely balanced or unusual cases that a model handles poorly.
This is partly principle and partly law, as we explain below. But it is also simply good lending. Models are good at patterns and poor at context; humans are the reverse. Combining them — automation for speed and consistency, human judgement for nuance and oversight — works better than either alone, because each catches errors the other misses. We set out how decisions are made in how we lend and describe the technology we use on our technology page.
UK GDPR Article 22
There is a specific legal safeguard worth knowing about. Under UK data-protection law, Article 22 of the UK GDPR gives individuals a right not to be subject to a decision based solely on automated processing — including profiling — where that decision produces legal effects or similarly significant effects on them, except in certain defined circumstances and with appropriate safeguards. In plain terms, it limits the use of fully automated decisions in significant matters and supports the right to obtain human intervention. You can read more about UK data-protection rights via gov.uk.
It is worth being precise about scope. Article 22 protects individuals and their personal data. Our borrower is a company — a body corporate — not an individual, and our lending decision is about the company. But individuals are still involved: we run an identity check on the director, whose personal data is processed accordingly. We treat the principle behind Article 22 as a sound standard regardless, and we explain how we handle personal data on our privacy page.
Our position
We use automation to make decisions quickly and consistently, and we pair it with human oversight rather than removing people from the process. We think that is the only responsible way to use this technology in lending: capture the speed and consistency it offers, but keep a human able to understand, question and override. AI in credit decisioning holds real promise. It earns that promise only when it operates inside firm guardrails — explainability, fairness, and a person who remains accountable for the outcome.
