AI credit scoring rules compared: Regulation B, SR 11-7, the EU AI Act and Colorado SB 24-205

Four sets of rules apply to AI used in credit scoring, and only one of them reaches every U.S. creditor: Regulation B, which requires a creditor that takes adverse action on a scoring system's output to give "specific" reasons drawn from "those factors actually scored in the system."¹ The other three are narrower: the banking agencies' SR 26-2, which replaced SR 11-7 on 2026-04-17 and treats non-generative AI as a model; the EU AI Act, whose high-risk rules for scoring natural persons apply from 2 December 2027; and Colorado's SB26-189, signed 2026-05-14, which repealed and reenacted the state's 2024 AI law before its requirements took effect.⁶⁹¹³

The status of each document changed in the eighteen months to November 2026, and lenders' 10-Ks have not all caught up. This page sets out what each says, as of 2026-11-12, and counts how often fiscal 2025 lender 10-Ks name them. It describes the documents; it does not decide which of them reaches any particular lender or model.

The question and the four documents

The plan for this page named SR 11-7, the Federal Reserve's 2011 model risk letter, as the second document. It no longer stands. SR 26-2, issued by the Fed with the FDIC and the OCC, "supersedes and replaces SR letter 11-7, Guidance on Model Risk Management (issued April 4, 2011)."⁶ The comparison below uses the replacement, and the site's SR 11-7 explainer covers the change section by section.

The four documents differ in kind before they differ in content. Regulation B is a federal regulation with a statute behind it, the Equal Credit Opportunity Act. SR 26-2 is supervisory guidance that says of itself it "does not set forth enforceable standards or prescriptive requirements."⁷ The EU AI Act is a regulation of the European Union. Colorado's law is a state statute enforced by the state attorney general.¹³

Regulation B: specific reasons for adverse action

Regulation B's duty starts with an event. A creditor must notify an applicant of action taken within 30 days after receiving a completed application, and within 30 days after taking adverse action on an existing account.¹ A notice of adverse action must be in writing and must contain either "A statement of specific reasons for the action taken" or a disclosure of the applicant's right to one.¹

The reasons are where a scoring model meets the rule. Section 1002.9(b)(2) says the statement "must be specific and indicate the principal reason(s) for the adverse action," and rules out two answers a model's owner might reach for: "Statements that the adverse action was based on the creditor's internal standards or policies or that the applicant, joint applicant, or similar party failed to achieve a qualifying score on the creditor's credit scoring system are insufficient."¹

The Official Interpretations go further for scoring systems. Comment 9(b)(2)-2 says the reasons "must relate to and accurately describe the factors actually considered or scored by a creditor."¹ Comment 9(b)(2)-4 says that when a denial rests on a credit scoring system, "the reasons disclosed must relate only to those factors actually scored in the system," that no principal reason may be left out, and that the creditor must disclose the actual reason "even if the relationship of that factor to predicting creditworthiness may not be clear to the applicant."¹ Comment 9(b)(2)-5 leaves the method open: "The regulation does not require that any one method be used for selecting reasons," and it describes two methods based on comparing an applicant's score on each factor with average scores.¹ Comment 9(b)(2)-1 adds that "disclosure of more than four reasons is not likely to be helpful to the applicant."¹

Regulation B also has a validation clause, older than any of the AI documents. Section 1002.2(p) defines a credit scoring system as one that "evaluates an applicant's creditworthiness mechanically," and to count as an empirically derived, demonstrably and statistically sound system it must be "Developed and validated using accepted statistical principles and methodology" and "Periodically revalidated by the use of appropriate statistical principles and methodology and adjusted as necessary to maintain predictive ability."¹ The status has a practical edge: in a system that meets the definition, section 1002.6(b)(2) allows a creditor to use an applicant's age as a predictive variable, "provided that the age of an elderly applicant is not assigned a negative factor or value."¹

Two changes in 2025 and 2026 moved the ground around these sections. On 2025-05-12 the CFPB withdrew a long list of guidance documents, saying that "The withdrawals are applicable as of May 12, 2025."³ The list includes Circular 2022-03, on credit decisions based on complex algorithms, and Circular 2023-03, on the proper use of the sample adverse action forms.³ The 2022 circular had said that the notice requirements "apply equally to all credit decisions, regardless of the technology used to make them," and that ECOA and Regulation B "do not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons for adverse actions."⁴ Its page on consumerfinance.gov still carries that text with no withdrawal notice; the 2023 circular's page is marked "Archived content".⁴⁵ The regulation and its commentary, which the 2022 circular quoted, were not withdrawn and read as before.¹

The second change is a rule. The CFPB's final rule of 2026-04-22, effective 2026-07-21, "amends provisions related to disparate impact, discouragement of applicants or prospective applicants, and special purpose credit programs under Regulation B."² Section 1002.6(a) now says that the Act does not provide that the "effects test" applies for determining whether there is discrimination in violation of the Act.¹ The rule's summary says the amendments "facilitate compliance with ECOA by clarifying the obligations imposed by the statute."²

SR 26-2, which replaced SR 11-7: model definition, validation and governance

SR 26-2 applies to a model, defined as "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates."⁷ Simple spreadsheet arithmetic and deterministic rules with no such theory are excluded.⁷ Its footnote 3 draws the AI line: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance."⁷ The same footnote says its principles "apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."⁷ A machine learning credit scorecard is a model by that text; a generative model that drafts a credit memo is not covered.

What it asks of a covered model is a model risk program, not a list of credit rules. Validation has three components in the text: conceptual soundness, outcomes analysis and ongoing monitoring.⁷ Sound practice includes a model inventory with "sufficient information to understand model risks", and section VII says vendor and third-party products "can present unique challenges for validation."⁷ The guidance is tailored by size: the letter says it is "most relevant to banking organizations with over $30 billion in total assets regulated by the Federal Reserve."⁶ And it is not enforceable on its own terms, since "non-compliance with this guidance will not result in supervisory criticism against a banking organization."⁷

EU AI Act Annex III: credit scoring of natural persons as high-risk

The EU AI Act names credit scoring directly. Annex III point 5(b) lists as high-risk "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud."⁸ The Commission's own example for the category is "credit scoring denying citizens opportunity to obtain a loan."¹⁰

The test is the intended use and the subject. A system that scores companies is not scoring natural persons; a fraud model is carved out by name.⁸ For systems inside point 5(b), the Commission lists the obligations: "Starting on 2 December 2027, high-risk AI systems will be subject to strict obligations before they can be put on the market," including risk assessment and mitigation, high-quality datasets "to minimise risks of discriminatory outcomes", logging, documentation, information to the deployer, human oversight and robustness.¹⁰

The date is the one that moved. Article 113, as amended by the Digital Omnibus on AI, now says the high-risk chapters apply from "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III."⁹ The Service Desk text is the consolidated version as at 27 July 2026.⁹ The Commission says that from 2 August 2026 the AI Office and Member State authorities are responsible for implementing, supervising and enforcing the Act.¹⁰ The site's explainer on the EU AI Act and finance covers the deployer duties in Article 26, including the provision for financial institutions.

Colorado: SB 24-205, its delay and its replacement

Colorado's 2024 law never took effect in its original form. SB 24-205 was signed on 2024-05-17.¹¹ Its summary says that from 2026-02-01 a deployer of a high-risk system must use reasonable care against algorithmic discrimination, with a presumption of reasonable care for a deployer that implements a risk management policy and program, completes impact assessments, notifies consumers and offers an appeal "via human review if technically feasible."¹¹ It had a provision for banks: an examined bank or credit union "is in full compliance with the act" if its prudential regulator's published guidance on high-risk systems meets criteria in the act.¹¹

In a special session the legislature passed SB25B-004, signed 2025-08-28, which "extends the effective date of the requirements of Senate Bill 24-205 to June 30, 2026."¹² Then on 2026-05-14, 47 days before that date, the governor signed SB26-189, session law chapter 131, effective the same day.¹³ Its summary says: "The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions."¹³

The new act's trigger is broader in its words and narrower in its duties. A covered technology is one used to "materially influence" a consequential decision, and a consequential decision is "a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits."¹³ Developers must give deployers technical documentation, including instructions for "appropriate use and human review", starting 2027-01-01.¹³ Deployers must give notice at the point of interaction and "a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer."¹³ Consumers may request "meaningful human review and reconsideration" after an adverse outcome.¹³ The attorney general enforces it as a deceptive trade practice and, before 2030-01-01, must give 60 days' notice and a chance to cure.¹³

On lenders, the summary says only that "Specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations."¹³ The act's text is on the General Assembly's site as a PDF download, which its robots file closes to automated readers, so this page has not read which entities the exemption names.

The four regimes side by side

The documents ask three different things of the same model. Regulation B asks for an explanation an applicant can read, tied to the factors the model scored.¹ SR 26-2 asks for a program around the model: validation, monitoring, inventory, governance.⁷ The EU AI Act and Colorado's act ask for both, and add disclosure to the consumer and a route to human review.¹⁰¹³

Which regimes lenders name in their 10-Ks

EDGAR full-text search was run on 10-Ks filed 2025-07-01 to 2026-06-30, one phrase and one calendar month at a time, paged to the end.¹⁴ A hit counts when the filer's first SIC code on EDGAR is one of the five the plan names: 6021 and 6022 (national and state commercial banks), 6141 (personal credit institutions), 6153 (short-term business credit) and 6199 (finance services). The denominator is every lender 10-K the search found in the window, 398 filings: 265 from banks and 133 from the other codes.¹⁴ SIC 6199, finance services, is a mixed code, and not every filer under it lends.¹⁴

Regulation B or the Equal Credit Opportunity Act appears in 259 of the 398 filings (65.1%).¹⁴ The AI-specific laws are rare: the EU AI Act in 13 filings (3.3%) and the Colorado AI Act, by name, in 2.¹⁴ For comparison, 326 of the 398 (81.9%) use the phrase "artificial intelligence" somewhere.¹⁴ SR 11-7 or SR 26-2 appears in one: Westamerica Bancorporation's 10-K says its interest rate model "is periodically assessed using supervisory guidance issued by the Board of Governors of the Federal Reserve System, SR 11-7".¹⁶ That use is for an interest rate model, not a credit model. None names SR 26-2, and only 6 of the 398 were filed after it was issued.¹⁴

The Colorado count is by the act's name, and it undercounts the state. American Express's 10-K names "AI legislation in several U.S. states (e.g., in California, Colorado and Utah)"; Northern Trust's says Colorado and California "have passed or are continuing to propose laws and regulations that govern various facets and uses of AI, including consequential decisions"; neither names the act, so neither is in the 2.²⁰¹⁹ Of the two that do, ProCap Financial's 10-K, filed 2026-02-18, says the act "goes into effect in June 2026"; three months later SB26-189 replaced it.¹⁷¹³ Pagaya's 10-K, filed 2026-03-02, says the EU AI Act and the Colorado AI Act "impose strict requirements on "high-risk" AI systems."¹⁸

The split by filer type is the clearest pattern. Banks account for 223 of the 259 Regulation B mentions: 223 of the 265 bank 10-Ks in the window (84.2%) name it, against 36 of the 133 from the other codes.¹⁴ The EU AI Act runs the other way: 11 of its 13 mentions come from the non-bank codes, and both Colorado mentions do.¹⁴

A narrower search finds where the adverse action rule meets AI in the filings. The phrase "adverse action notice" or "adverse action notices" appears in 11 lender 10-Ks; each was read on sec.gov, and in 8 a sentence naming adverse action also names AI, a model or an algorithm, citing the CFPB in each case.¹⁴ Six of the 8 share one sentence. Associated Banc-Corp's version sits under an "Artificial Intelligence" heading:

The sentence is accurate about the regulation and dated about the guidance.¹⁵³¹ Unity Bancorp's 10-K puts it more cautiously, saying regulators "have provided guidance that creditors may be subject to adverse action notice requirements under the Equal Credit Opportunity Act even if they rely on algorithmic underwriting models."²⁵

What the Fed speakers said about AI in credit

The Federal Reserve's governors have spoken about AI in lending several times since 2024, and the site's Federal Reserve tracker lists each speech.

Governor Michelle W. Bowman, 2024-11-22: "Another often-discussed use case for AI in financial services is in expanding the availability of credit."²¹ In the same speech she said AI "can also pose model risks in the banking context, with associated data management and governance concerns," and that "its use must comply with current laws and regulations, including fair lending, cyber security, data privacy, third-party risk management, and copyright."²¹

Governor Michael S. Barr, 2025-04-04: "Gen AI has benefits for document analysis, which could be applied to improve credit underwriting."²²

Governor Barr again, 2025-11-11, noting that "in 1997, Governor Susan Phillips delivered a speech noting the use of AI in consumer loan underwriting."²³ He said that "Data-driven financial-sector-specific tasks, including credit decision support, fraud detection, and trading are using AI-specific tools," and: "We need to reduce the risk that AI reinforces biases in consumer lending."²³

The OCC, the third agency behind SR 26-2, has no speech on the subject in the site's regulation table. The GAO's 2025 report on AI in financial services gives the oversight picture from outside the agencies: regulators "primarily oversee AI using existing laws, regulations, guidance, and risk-based examinations," and "some regulators have issued AI-specific guidance, such as on AI use in lending."²⁴ It lists "potentially biased lending decisions" among the risks.²⁴ The report and its recommendation status are in the site's GAO tracker.

The counts on this page are recomputed from the saved search results by scripts/cfonews-ai/articles/credit-rules.mjs, which also reads the adverse action passages and prints each figure quoted above.