How to Explain AI Decisions to Customers, Examiners, Boards

Current as of October 30, 2026. This guide draws on Regulation B and its official interpretations, the adverse action provisions of the Fair Credit Reporting Act, the EU AI Act as amended by Regulation (EU) 2026/1744, the GDPR, New York's Insurance Circular Letter No. 7 (2024), Colorado's Regulation 10-1-1, the US interagency model risk guidance SR 26-2, OSFI Guideline E-23, the PRA's SS1/23 and EIOPA's 2025 opinion on AI governance, as published on that date. Which of them apply depends on the firm and the decision; it is not legal advice.

Customers, examiners and boards each ask why a model decided something, and the texts reviewed expect different answers. EIOPA's opinion puts it directly: "The explanations should also be adapted to the needs of different recipient stakeholders." A customer needs reasons for one decision; an examiner, how the model works and its limits; a board, what it is for and where it fails.

Unless a step quotes a text, it is a recommendation, labeled (interpretation). Explanation techniques are interpretation unless a text names them.

On scope: Regulation B is binding and covers consumer and business credit, with modified notice rules for business credit (section 1002.9(a)(3)); the duties in 15 U.S.C. 1681m apply when adverse action rests in whole or in part on a consumer report. The AI Act and the GDPR are binding EU regulations; a Commission proposal to amend the GDPR, COM(2025) 837, was awaiting committee decision in the European Parliament on October 30, 2026. This guide reviewed the EU GDPR, not the UK version. New York's circular letter sets the Department of Financial Services' expectations for insurers authorized in the state using AI systems or external consumer data in underwriting and pricing. Colorado's regulation, amended effective October 15, 2025, binds individual life, private passenger auto and health benefit plan insurers using external consumer data and models that use it. SR 26-2 (April 17, 2026), from the Federal Reserve, OCC and FDIC, supersedes SR 11-7 and SR 21-8; it is non-binding, stating that non-compliance "will not result in supervisory criticism", though its footnote 1 says "supervisory action may result for any violations of law or unsafe or unsound practices stemming from insufficient management of model risk." It is most relevant to banking organizations above an asset threshold it sets, and excludes generative and agentic AI. OSFI's E-23 takes effect May 1, 2027 for Canada's federally regulated financial institutions. The PRA's SS1/23 covers UK banks, building societies and PRA-designated investment firms with internal model approval for regulatory capital, not insurers. EIOPA's opinion sets no new requirements, is addressed to national supervisors and does not cover AI systems that are high-risk under the AI Act.

Step 1: Keep one decision record that all three explanations draw from

For each automated decision, log the model version, inputs, explanation output and reasons given, so all three explanations describe the same model (interpretation).

OSFI, from May 1, 2027, lists among model development standards "explainability requirements, which may vary based on the model's purpose, level of autonomy, regulatory requirements, or the potential impact on customers and stakeholders." Set the requirement for each audience before the model is built (interpretation).

Step 2: For US credit customers, give specific principal reasons, and the score disclosure

The commentary to Regulation B says the reasons "must relate to and accurately describe the factors actually considered or scored by a creditor". Where adverse action rests in whole or in part on a consumer report, 15 U.S.C. 1681m(a) separately requires disclosure of any credit score used and its key factors, capped at four (five if inquiries is one), which the commentary says do not satisfy the Regulation B reason requirement.

Give a short list of reasons a person can act on, not a chart of feature weights (interpretation). Deriving them from a machine learning model is covered in our guide to adverse action reasons for machine learning credit models.

Step 3: For EU customers, map the GDPR and AI Act explanation rights together

For decisions based solely on automated processing with legal or similarly significant effects, made under GDPR Article 22's contract or explicit-consent exceptions, Article 22(3) requires "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision." Articles 13(2)(f), 14(2)(g) and 15(1)(h) cover "the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject."

Article 86 of the AI Act covers decisions a deployer takes on the basis of output from an Annex III high-risk system, which includes creditworthiness evaluation of natural persons (fraud detection excluded) and life and health insurance risk assessment and pricing. A person subject to such a decision, with legal or similarly significant effects they consider adverse to their health, safety or fundamental rights, may obtain "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken," unless Union or national law provides an exception (Article 86(2)). From December 2, 2027, Article 26(11) also requires deployers of Annex III systems that make or assist decisions about natural persons to inform them.

Write one explanation answering both laws: the model's role, what a person reviewed, the main reasons and how to contest (interpretation).

Step 4: For insurance customers, disclose the data and its source

New York's letter says an insurer's notice should disclose whether it uses AI systems in underwriting or pricing, whether it uses external vendor data about the person, and the right to request the specific data behind the decision. After an adverse decision, the reasons "should include details about all information upon which the insurer based any declination, limitation, rate differential, or other adverse underwriting decision, including the source of the specific information upon which the insurer based its adverse underwriting or pricing decision." It also bars relying on a vendor's proprietary processes to justify unspecific reasons.

Colorado requires documented complaint and inquiry protocols giving the consumer "information necessary to take meaningful action in the event of an adverse decision made based on the use of ECDIS, and the algorithms and predictive models that use ECDIS." For insurance AI outside the AI Act's high-risk categories, EIOPA's opinion says that, on the customer's request, the influence of the AI system on a decision with a material impact on them "should be clarified using simple, clear and non-technical language to allow them to make informed decisions."

Step 5: For examiners, document conceptual soundness and how explainability was assessed

SR 26-2 says validating conceptual soundness "involves assessing and documenting model design (including key modeling choices, assumptions, qualitative judgments, and data selection), construction, and developmental testing", and that for some models "other assessments—such as interpretability measures or benchmarking to other models—may be more practical" than evaluating theoretical construction. The PRA asks that development documentation be detailed enough that "an independent third party with the relevant expertise would be able to understand how the model operates, to identify the key model assumptions and limitations, and to replicate any parameter estimation and model results."

OSFI's review activities, from May 1, 2027, include "evaluating the level of explainability for the model workings as per the intended use of the model, including AI/ML models". EIOPA says insurers "should be able to provide to competent authorities and auditors a global and comprehensive explanation about the functioning of the AI system." New York expects comprehensive documentation of all AI systems, which may include how each operates, available to the Department on request; Colorado requires a documented model inventory.

Give examiners the global view and sampled local explanations tied to real decisions and the customer reasons each produced (interpretation).

Step 6: State what the explanation method cannot show, and test it

EIOPA's opinion says local and global model-agnostic explanatory tools may be used to explain complex AI systems, "but the assumptions and limitations of these tools should be duly documented and addressed." Its footnote describes the two examples as tools that "focus on providing local explanations, meaning they aim to explain how specific data points or regions within the input data impact the output of an AI system."

Record the reference population and how correlated inputs are grouped, and check that rankings are stable for similar applicants and that changing a top-ranked input moves the score as implied (interpretation).

Step 7: For the board, explain purpose, limits, boundaries and fallback

The PRA expects the board "to provide challenge to the outputs of the most material models" and to understand their capabilities and limitations, the operating boundaries within which performance is expected to be acceptable, the potential impact of poor performance and the mitigants if performance deteriorates. It defines explainability as "the degree to which the workings of a model can be understood in nontechnical terms." OSFI, from May 1, 2027, makes senior management responsible for "ensuring appropriate communication and reporting of model risk to the board of directors."

For insurers, New York expects reporting that includes "all timely and relevant facts for a board or other governing body to understand the material activities and risks associated with the insurer's use of ECDIS and AIS." Colorado requires board or board committee oversight of the governance framework, and EIOPA's opinion says members of the administrative, management or supervisory body need sufficient knowledge of AI use and its risks.

SR 26-2's text describes no board or senior management role; it places responsibility on "each banking organization", so a US bank's board reporting rests on its own governance framework (interpretation).

Give the board one page per material model: what it decides, override rates, where it performs worst, and what complaints and outcome testing show (interpretation).

Checklist

Items restate the recommendations above (interpretation).

• Each automated decision logs model version, inputs, explanation output and reasons given
• Explainability requirements are set per audience before development
• US credit notices give specific principal reasons and, where a credit score was used, the score disclosure
• EU customer explanations cover the model's role, human review, main reasons and how to contest
• Insurance notices name the data and its source, without hiding behind vendor confidentiality
• Examiner files hold conceptual soundness evidence, a global explanation and sampled local ones
• The explanation method's assumptions and limits are written down and tested
• Board reports cover purpose, limits, operating boundaries, overrides and fallback

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.