The Hollow Explanation: How AI Rejections Satisfy the Law but Not You #
The contract was worth ten euros a month. Hold on to that detail, because everything else about the case is enormous: years of litigation in Austria, a reference to the Court of Justice of the European Union, an Advocate General's opinion, and a judgment that now shapes how every bank, insurer, landlord platform and hiring tool in the bloc ought to talk to the people it turns away. It began when an Austrian mobile operator declined to sign up a customer, known in the court papers only as CK, because an automated credit assessment said her credit standing was not good enough.
The assessment came from Dun & Bradstreet Austria, a firm that sells exactly this kind of judgment to other companies. CK wanted to know how it had been reached. An Austrian court later found, by final decision, that the firm had not given her the “meaningful information about the logic involved” that the General Data Protection Regulation (GDPR) requires, and had not adequately explained why it could not.
So the question travelled to Luxembourg. On 27 February 2025, the Court answered it in a way that, on paper, looks like a clean win for anyone who has stared at a rejection and wondered what just happened. The controller, the Court said, must describe “the procedure and principles actually applied” so that the person “can understand which of his or her personal data have been used, and how they have been used”. Dumping the algorithm on the table does not count. Neither does narrating every computational step.
Eighteen months on, a run of 2026 research papers suggests the win may be emptier than it looks. One systematic review finds that the academic literature meant to bridge law and explainable AI mostly fails to do so. A legal scholar in Poland argues that technical explanations amount to a “regulatory fiction”. A trio of researchers in Germany shows that the most popular explanation methods cannot, by their mathematical nature, tell you whether the decision about you was wrong.
Put together, the picture is uncomfortable. Europe has written a right into law three times over, the top court has given it teeth, and the tools companies reach for to honour it may produce something technically correct, legally defensible and almost useless to the person on the receiving end. This is the hollow explanation. The question is who is supposed to fill it.
A Ten-Euro Contract Reaches Luxembourg #
Case C-203/22, CK v Dun & Bradstreet Austria, was referred by the Administrative Court of Vienna. By then, whether Dun & Bradstreet had broken the law was settled. The Vienna court needed something more practical: what, exactly, does a company have to hand over to satisfy the right? And what happens when it claims the answer is a trade secret? Advocate General Jean Richard de la Tour delivered his opinion on 12 September 2024. The First Chamber's judgment followed on 27 February 2025, and the Court's press release put it bluntly: the data subject “is entitled to an explanation as to how the decision was taken in respect of him or her”. The subheading went further: “The explanation provided must enable the data subject to understand and challenge the automated decision.” That word, challenge, matters. The Court was tying explanation not to courtesy but to the ability to push back.
A systematic review by Benjamin Fresz, Elena Dubovitskaya and Marco F. Huber, discussed below, summarises the reasoning that has since become the reference point. Article 15(1)(h) GDPR grants a genuine right to an explanation of the specific automated decision, even where the processing is highly complex. The explanation must be meaningful, which the Court glossed as “useful, relevant, important and easily understandable”. Under Article 12(1) GDPR, it must be concise, transparent, intelligible and easily accessible, in clear and plain language. And simply disclosing the algorithm or describing every step in the automated process would not be precise or intelligible enough.
The Court did offer one concrete hint. It could be appropriate, its press release says, to tell the person “the extent to which a variation in the personal data taken into account would have led to a different result”. Machine learning researchers will recognise this as, more or less, a counterfactual explanation, the idea popularised in a 2018 Harvard Journal of Law and Technology paper by Sandra Wachter, Brent Mittelstadt and Chris Russell titled “Counterfactual Explanations without Opening the Black Box”. If your income had been this much higher, the system would have said yes.
On trade secrets, the Court closed a door that companies had hoped to keep ajar. Where a controller believes the requested information includes protected third-party data or trade secrets, it must hand it to the competent supervisory authority or court, which balances the competing interests to decide how much the individual sees. The GDPR also precludes a national rule that excludes the right of access, as a general matter, whenever it would compromise a trade secret. “It's proprietary” is not an answer. It is the start of a process in which someone other than the company decides.
Fifteen months earlier, in the SCHUFA scoring case (C-634/21, decided 7 December 2023), the same Court had held that a credit score produced by an agency counts as an “automated individual decision” under the GDPR where the lender attributes a determining role to it in granting credit. Together, the logic is clear: the score itself can be the decision, and the person scored is owed an account of how it was reached.
One Right, Written Three Times #
European law now contains the right to an explanation in at least three places. Each works slightly differently, and the overlaps matter.
The oldest is Article 15(1)(h) GDPR. It gives a data subject the right to know of “the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject”. It is tied to Article 22, which governs decisions based solely on automated processing that produce legal or similarly significant effects. For years academics argued over whether the GDPR contained a right to explanation at all. After 2025, that argument is largely over.
The second is Article 18(8) of the recast Consumer Credit Directive, Directive (EU) 2023/2225, usually called CCD2. Where a creditworthiness assessment involves automated processing of personal data, consumers may request human intervention from the creditor, receive a clear and comprehensible explanation of the assessment, express their point of view, and request a review of both the assessment and the decision. Point (a) specifies that the explanation should cover the logic and risks involved in the automated processing, as well as its significance and effects on the decision. Member States had until 20 November 2025 to transpose the directive, and its provisions apply from 20 November 2026, less than four weeks after this article is published.
Łukasz Górski, whose paper is discussed below, notes a useful feature. The GDPR right is anchored to decisions based “solely” on automated processing, a threshold SCHUFA read broadly but which must still be cleared. For CCD2, it is enough that automated processing is “involved”.
The third is Article 86 of the AI Act. Any affected person subject to a decision taken by a deployer “on the basis of the output from a high-risk AI system listed in Annex III”, which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, may obtain “clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken”. Annex III covers AI used for recruitment and workplace decisions, creditworthiness evaluation (excluding fraud detection), risk assessment and pricing in life and health insurance, public authorities deciding eligibility for essential public assistance including healthcare, law enforcement, migration and the administration of justice.
Two caveats temper that list. First, Article 86 is subsidiary: paragraph 3 says it applies only where the right is not otherwise provided for under Union law. Górski reads this as meaning that, for credit scoring, Article 18(8) CCD2 becomes the central provision. Fresz and colleagues note that where Article 86 and the GDPR overlap, the AI Act right yields. Second, the timetable has shifted. The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, deferred the core obligations for Annex III high-risk systems from 2 August 2026 to 2 December 2027, and those for AI embedded in regulated products to 2 August 2028. Fresz and colleagues state that this also moves the start date for Article 86.
There is also a gap. Tenant screening is not named in Annex III. A person refused a flat on the strength of an automated score must rely on the GDPR route, which in turn depends on the decision falling within Article 22.
A Literature That Misreads Its Own Law #
You might expect the research meant to implement the law to have caught up. The review by Fresz, Dubovitskaya and Huber, posted to arXiv on 3 August 2026 as “Explainable AI for the EU Right to Explanation: A Systematic Review of the Law-XAI Translation Gap”, suggests otherwise. The authors are based at the Fraunhofer Institute for Manufacturing Engineering and Automation IPA, the University of Giessen and the University of Stuttgart, and screening was done by one technical and one legal reviewer.
After deduplication, 2,643 records remained. Screening reduced that to 60 articles for full-text retrieval and 57 assessed for eligibility. Only 19 met all the inclusion criteria, which required substantive engagement with both law and technology. The authors describe this low number as “itself a significant finding”.
Then it gets awkward. The abstract states plainly: “Most misidentify the GDPR legal basis.” After Dun & Bradstreet, the correct anchor is Article 15(1)(h). Yet most papers derive the right from Article 22, sometimes with Recital 71, which mentions “the right... to obtain an explanation” but is not binding. One paper relies on Recital 71 alone. Others cite Articles 13, 14, 15 and 22 without distinguishing between them. Two describe the legal basis as unclear. Only five ground the right correctly.
This is not pedantry. Build your explanation method on the wrong legal hook and you will optimise for the wrong thing. Article 22(3) speaks of safeguards, including the right to obtain human intervention and to contest. Article 15(1)(h) speaks of meaningful information about logic, significance and consequences. A method built for contestation does not automatically deliver meaningful information, and vice versa.
Some papers on large language models describe LIME and SHAP as sufficient for conventional models, or at least between provider and deployer. The review's framework directly contradicts this. Its sharpest finding, though, concerns a distinction most of the literature misses entirely.
Form Is Not the Same as Content #
Article 12(1) GDPR is about how information is delivered: concisely, transparently, intelligibly, accessibly, in plain language. Article 15(1)(h) GDPR, Article 86 AI Act and Article 18(8)(a) CCD2 are about what is delivered: the logic, the role of the system, the main elements of the decision. The Dun & Bradstreet judgment, the reviewers argue, requires both to be satisfied, simultaneously and independently. The research literature routinely blurs them.
Take a credit decision. Form calls for plain-language text, perhaps with statistical visuals. Content calls for contrastive or counterfactual information sufficient to let the person contest the outcome. Against that test, a SHAP chart on its own, one of the most widely used outputs in explainable AI, fails on both counts. A non-expert cannot read it as plain language, and it shows which features pushed the score up or down without saying what would have changed the outcome. Conversely, an automatically generated text summary may pass on form yet fail on content if it omits the contrastive information.
This is not hypothetical. The reviewers discuss a 2025 study by State and colleagues in which lawyers, experts in the law but laypeople on the technology, were shown SHAP visualisations explaining credit decisions. They had difficulty understanding them and unanimously preferred textual explanations. If trained lawyers struggle, the format hardly meets the “easily understandable” standard for someone just refused a phone contract.
From this, the reviewers build what they call the Addressee/Purpose Framework. Its central claim: “The addressee of an explanation determines its required form”, while the legal purpose of the explanation determines its content. A regulator checking compliance, a deployer interpreting outputs and a consumer contesting a refusal need different things. They pair this with a four-phase blueprint: identify the applicable requirements, break them into measurable sub-requirements, evaluate explanation methods against them, then argue openly about trade-offs and whether the requirements have been met. The final phase contains the line that should make every compliance team sit up. “Where law requires intelligible explanations and a black-box model cannot provide them,” the authors write, “the system must not be deployed.”
Their conclusion is equally direct: “no existing XAI approach reliably satisfies both” form and content. Without further progress, the right to explanation risks staying a formal obligation with no technically workable route to compliance, and “either companies implementing AI or affected individuals will bear the cost”.
The Regulatory Fiction #
Where Fresz and colleagues diagnose a gap in the research, Łukasz Górski goes after the concept itself. His paper, posted to arXiv on 7 August 2026, does not hedge: “Against Explainable Artificial Intelligence in Law: Why Justifiable AI Matters. A Credit Scoring Example”. Górski is affiliated with the Interdisciplinary Centre for Mathematical and Computational Modelling at the University of Warsaw and Nicolaus Copernicus University in Toruń, and draws on doctrinal analysis, comparative perspectives and practical experience of building explainable systems.
Consumers, he argues, are often given too little or too much. Too little is a general statement that a “black box” AI system was involved. Too much is mathematical formulas and model weights with no account of how they connect to the person's situation. Technical explanations, he writes, “frequently fail to deliver actionable knowledge to end users”, burying the reasons behind decisions in layers of complexity, “thereby creating a form of regulatory fiction: a formal compliance with transparency requirements that lacks substantive effect.”
A regulatory fiction is not a lie. Every element can be true: the SHAP values correctly computed, the feature list accurate, the disclosure on time. Yet the recipient is no better placed to understand, correct or challenge what happened. The paperwork is complete; the purpose has gone missing.
Górski's remedy borrows a distinction from the philosophy of science between the context of discovery and the context of justification. Explainability looks inward at how a system arrived at its output. Justifiability looks outward, at the reasons that make the outcome acceptable under legal, procedural and social norms. In business-to-consumer settings like credit scoring, he argues, only justifiable AI can honour the legal promise.
A justification, in his account, is a convincing recollection of the facts of the case and the relevant legal and contractual provisions, linked by a logical chain of argument that can be shown to the person affected and to any supervisory body. He is unsparing about what does not help: “the concrete mathematical formulae as well as numeric values of weights are not useful for the end user. The same goes for simply saying that an AI system was involved.”
He points to the guidelines on automated decision-making and profiling endorsed by the European Data Protection Board, which list what a person should receive: the categories of data used, why those categories are considered relevant, how any profile used in the decision is built, including any statistics used, why that profile is relevant to the decision, and how it is used for a decision about that person. That is a procedural account. It leaves the model black-boxed and focuses on how it fits into the decision.
Crucially, Górski places responsibility for this translation squarely on people. Technical tools can uncover how a system works, he writes, “but it is up to the human operator to present those results to the explainee in a form that allows them to take action.” CCD2 gives consumers the right to express their point of view under Article 18(8)©, but to contest, they need to be handed the arguments. “We contend that technical explanations alone constitute regulatory fiction: they fail to empower consumers.”
Errors Somewhere Nearby #
The third paper pushes the critique into the mathematics. Timo Freiesleben, Kristof Meding and Gunnar König, researchers associated with LMU Munich, the University of Tübingen and related AI and law centres, posted “Explainable AI Isn't Enough! Rethinking Algorithmic Contestability” to arXiv on 15 May 2026.
Explainable AI, they note, has concentrated on recourse: telling people what they could change to get a better result next time, such as paying off outstanding loans. Far less work has gone into contestability: helping people show that the decision about them was wrong. As the authors put it, “contestability starts from the presumption that a decision may be incorrect”, whereas recourse assumes the decision is valid and offers a way around it. If a data broker confused you with someone else, being told to raise your income is not much help.
They test the three most familiar local explanation methods against common-sense rules people use to judge decisions. Continuity: if someone very similar to me got the loan, so should I. Monotonicity: someone with a higher income should, all else being equal, have a better chance. Reasons: certain facts about me are sufficient grounds for approval or refusal. Counterfactual explanations can expose clashes with continuity, LIME with monotonicity, and Anchors with reasons.
The trouble is what such a clash proves. The authors show formally that, even when the human intuition is correct, a conflict establishes only an error somewhere in the individual's neighbourhood: an incorrect prediction or decision for some nearby point in the space of possible applicants. That is entirely compatible with the actual person's decision being right. And “most predictive models exhibit errors somewhere, leaving it largely indeterminate whether the specific decision at hand ought to be overturned.” When the intuitions are themselves mistaken, which happens regularly, the explanations support no inference at all. Nor is every jump a mistake: a 17-year-old and an 18-year-old applicant differ legally, so a sharp change at that boundary can be perfectly justified.
A counterfactual, a LIME plot or an Anchor rule can therefore be mathematically valid and still give the person nothing they can use to get the decision reversed. What would? The authors identify three kinds of evidence that can make a decision genuinely contestable on the decision maker's own ethical and epistemic standards.
The first is predictive multiplicity. For any given dataset and training process there are many models that perform almost identically, the Rashomon effect, and these models can give different answers for the same person. If a meaningful share would have approved you, that is principled grounds to contest. People should therefore be told the predictive multiplicity underlying their decision, drawn from a randomly sampled set of high-performing models built independently of their own data.
The second is incorrect feature values. Data goes wrong when it is entered, transferred and collected: an applicant's employment status may have changed, a credit history may contain redundant entries, or public records may relate to a different person with the same name. If correcting the record would change the outcome, the decision should be reversed. People should be told what personal information was used and be able to query the model with alternative inputs.
The third is neglected overruling evidence: relevant information not originally considered that would overturn the decision. Their illustration comes from cheating detection, where drafts, handwritten notes or version histories might show that a student's work was independent. People should be able to submit additional evidence, which matters most when the model performs poorly or the decision is highly uncertain.
Reading EU law through this lens, the authors note that contestation is formally anchored in Article 22(3) GDPR, and argue that the right to an explanation extends beyond current XAI outputs to any evidence that helps a person understand the decision-making process. Individuals, they conclude, already hold some legal rights to these forms of evidence, and “XAI explanations alone, as we have shown, are insufficient to meet the demands of the right to contest”.
What a Useful Rejection Would Actually Contain #
Strip away the formalism and the three papers converge on a practical picture of a meaningful explanation for someone refused a loan, a job or a contract. None presents a template, and the law prescribes none. But read alongside the judgment and CCD2, the components are clear.
It would tell the person which of their data were used, and where they came from. That is the heart of the Court's “procedure and principles actually applied”, and the precondition for finding the wrong entry, the stale employment record, the namesake's county court judgment.
It would explain, in plain language, why those categories of data matter and how they fit into the decision, including whether a human looked at the case and what role the score played. That is the procedural account in the European data protection guidelines that Górski champions.
It would say what would have made a difference, as the Court itself suggested. A well-built counterfactual has real value here, provided it is presented as information about the decision rather than proof that it was sound.
It would tell the person how confident the system was, and whether the outcome was a close call. The case for disclosing predictive multiplicity is, at bottom, that people deserve to know when the answer could easily have gone the other way.
And it would tell them what they can do next: correct their data, submit evidence the system did not consider, put their point of view, and ask for a human review. Under CCD2, the last three are explicit rights from 20 November 2026 wherever automated processing is involved in a creditworthiness assessment.
Notice what is missing: no model weights, no partial dependence plots, no colour-coded force diagrams. Those have a place. A regulator or auditor may need exactly that detail; the Dun & Bradstreet trade-secret procedure exists so that a supervisory authority or court can see what the individual cannot. But they are not what a person needs at the moment the door closes.
The American Detour #
Across the Atlantic, a different legal tradition reached a similar conclusion and then stepped back from it. US lenders must tell applicants the principal reasons for adverse credit decisions under the Equal Credit Opportunity Act and its implementing Regulation B. On 26 May 2022 the Consumer Financial Protection Bureau's Circular 2022-03 stated that the law does “not permit creditors to use complex algorithms when doing so means they cannot provide the specific and accurate reasons” that the statute demands. Complexity was not a defence. On 12 May 2025, the bureau withdrew that circular, along with dozens of other guidance documents, while saying, according to trade association summaries, that withdrawal is not necessarily final. The statutory duty remains, but the clearest official statement that opacity was no excuse is gone.
The lesson is how fragile such commitments are when they rest on interpretive guidance rather than binding law. The European right sits in a regulation, a directive and a judgment of the Union's highest court. That is a sturdier foundation. Whether it becomes a meaningful one depends on what is built on it.
Where the Gap Should Close #
So if the technical methods designed to satisfy the legal standard produce explanations that are mathematically valid but practically unintelligible, where does responsibility for closing that gap rest?
The legal texts give a clear first answer. Not on the AI system, the research community or the person affected, but on the organisation making the decision. Article 15(1)(h) GDPR binds the controller. Article 18(8) CCD2 binds the creditor. Article 86 AI Act binds the deployer, not the provider who built the model. Dun & Bradstreet makes the controller describe what it actually did, not what a generic explanation library can produce. Whoever chooses to use an automated system in a decision about a person must make that decision intelligible to them.
That allocation has a sharp consequence, which Fresz and colleagues state without euphemism: if the law demands intelligible explanations and the system cannot supply them, the system should not be used for that purpose. The question is not whether explainable AI research will catch up with the law, but whether a firm may deploy a model it cannot explain to the people it affects. On their reading, it may not.
Górski adds a second layer. Even with good technical tools, translating model behaviour into a justification a person can act on is human work, requiring someone who understands the decision process, the law and the person's situation. That is precisely the cost automation was supposed to remove. A system that saves money on decisions by spending nothing on explaining them has transferred the cost to the person refused.
Regulators carry part of the load too. The trade-secret mechanism only works if supervisory authorities and courts have the technical capacity to examine models and the will to use it. Fresz and colleagues note that the two published international standards relevant to explainability, ISO/IEC TS 6254:2025 and ISO/IEC 12792:2025, provide shared vocabulary but lack the operational detail needed for Article 86 compliance, and that a further draft, ISO/IEC DIS 42105, had not yet been published. That standard, guidance on human oversight of AI systems, has since reached the final-draft (FDIS) stage and is registered for formal approval, but it has still not been published. Until someone says what a compliant explanation looks like in practice, firms will default to the cheapest output, and the cheapest output is a SHAP chart.
Researchers are not off the hook either. Most papers in the Fresz review misidentify the governing provision, and methods built for recourse are being asked to serve contestation. Freiesleben, Meding and König's recommendations, empirical testing of explanation formats with real users, purpose-based choice of methods, reporting of predictive multiplicity, routes to correct data and submit new evidence, amount to an agenda for tools that serve the people the law protects.
Yet the most stubborn burden sits with the individual. The rights in all three instruments must be invoked. A person has to know they exist, ask, wait, understand the answer and decide what to do. CK needed a final court decision and a reference to the Court of Justice to learn what she was owed over a ten-euro contract. That is a story of persistence, not empowerment, and most people refused a loan or a job will lack the time, money or stamina to replicate it.
This is where the power imbalance shows itself. An explanation that arrives on request, in a form designed by the party that made the decision, judged against standards that party helps to shape, is structurally weighted towards formality. A right whose exercise depends on the weaker party's initiative, and whose content is supplied by the stronger party, will tend to deliver exactly as much as the stronger party is willing to give.
The Explanation Still Has to Be Written #
None of this makes the right to explanation a failure. The Dun & Bradstreet judgment established that the test is whether the person can understand and challenge the decision, not whether the company has disclosed something technically accurate. That is a standard about outcomes, not paperwork. Enforced as written, it makes the hollow explanation unlawful.
The 2026 papers show how far practice sits from that standard. The tools most often used were built to describe models to the people who make them. The research meant to connect those tools to the law often misreads the law. Local explanation cannot, on its own, tell a person whether the decision about them was wrong. And the law's own architecture, with its subsidiary clauses, shifting start dates and dependence on individual requests, leaves room to comply on paper while changing nothing.
Closing that gap does not require a scientific breakthrough. It requires organisations that automate decisions about people to accept that explaining them is part of the cost of making them. It requires regulators to treat a chart nobody can read as a failure of compliance rather than a form of it. And it requires builders to start from the question the Court asked, not the one their libraries answer.
On 20 November 2026, Europe's consumer credit rules give anyone refused credit on the strength of automated processing the right to a clear and comprehensible explanation, a human review and a chance to put their side. Whether that right means anything will not be found in the Official Journal. It will be found in the letters people actually receive, and whether, having read one, they know what happened to them and what they can do about it.
References and Sources #
- Court of Justice of the European Union. Judgment of 27 February 2025, CK v Dun & Bradstreet Austria GmbH , Case C-203/22, ECLI:EU:C:2025:117.https://curia.europa.eu/juris/liste.jsf?num=C-203/22
- Court of Justice of the European Union, Communications Directorate. “Automated credit assessment: the data subject is entitled to an explanation as to how the decision was taken in respect of him or her.” Press Release No 22/25, Luxembourg, 27 February 2025. https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf
- Opinion of Advocate General Richard de la Tour, Case C-203/22, Dun & Bradstreet Austria , 12 September 2024, as reported by Digital Policy Alert.https://digitalpolicyalert.org/event/22518-issued-advocate-general-at-the-administrative-court-opinion-on-case-c-20322
- Court of Justice of the European Union, Communications Directorate. “The General Data Protection Regulation (GDPR) opposes two data processing practices by credit information agencies.” Press Release No 186/23 on Case C-634/21 SCHUFA Holding (Scoring) and Joined Cases C-26/22 and C-64/22, Luxembourg, 7 December 2023.https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-12/cp230186en.pdf
- Fresz, Benjamin; Dubovitskaya, Elena; Huber, Marco F. “Explainable AI for the EU Right to Explanation: A Systematic Review of the Law-XAI Translation Gap.” arXiv:2608.02699, 3 August 2026. https://arxiv.org/abs/2608.02699 (full text:https://arxiv.org/html/2608.02699 )
- Górski, Łukasz. “Against Explainable Artificial Intelligence in Law: Why Justifiable AI Matters. A Credit Scoring Example.” arXiv:2608.07452, 7 August 2026. https://arxiv.org/abs/2608.07452
- Freiesleben, Timo; Meding, Kristof; König, Gunnar. “Explainable AI Isn't Enough! Rethinking Algorithmic Contestability.” arXiv:2605.16041, 15 May 2026. https://arxiv.org/abs/2605.16041 (full text:https://arxiv.org/html/2605.16041 )
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), Article 15. Official Journal L 119, 4 May 2016. Consolidated text: https://gdpr-info.eu/art-15-gdpr/
- Directive (EU) 2023/2225 of the European Parliament and of the Council of 18 October 2023 on credit agreements for consumers and repealing Directive 2008/48/EC, Article 18. Official Journal L, 30 October 2023. https://eur-lex.europa.eu/eli/dir/2023/2225/oj/eng
- Schmiedinger, Michael. “Consumer Credit Directive II: consumer credit legislation for the digital age.” Schönherr, 1 February 2024. https://schoenherr.eu/content/consumer-credit-directive-ii-consumer-credit-legislation-for-the-digital-age
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act), Article 86 and Annex III. Official Journal L, 12 July 2024. Article 86: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-86 ; Annex III:https://artificialintelligenceact.eu/annex/3/
- NicFab Blog. “Digital Omnibus on AI: Regulation (EU) 2026/1744 Is Published in the Official Journal.” 24 July 2026. https://www.nicfab.eu/en/posts/digital-omnibus-ai-official-journal/
- Brabners. “Digital Omnibus on AI to delay EU AI Act: what businesses need to know.” https://www.brabners.com/insights/data-protection/digital-omnibus-on-ai-to-delay-eu-ai-act-what-businesses-need-to-know
- Wachter, Sandra; Mittelstadt, Brent; Russell, Chris. “Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR.” Harvard Journal of Law and Technology, 31(2), 841-887, 2018. arXiv:1711.00399. https://arxiv.org/abs/1711.00399
- European Data Protection Board. “Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01).” Endorsed by the EDPB. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/automated-decision-making-and-profiling_en
- Consumer Financial Protection Bureau. “Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms.” 26 May 2022. https://www.consumerfinance.gov/compliance/circulars/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms/
- Consumer Financial Protection Bureau. “Withdrawn Guidance.” Listing Circular 2022-03 as withdrawn on 12 May 2025. https://www.consumerfinance.gov/compliance/guidance/withdrawn-guidance/
- America's Credit Unions. “Withdrawn! Sixty-Seven Pieces of Guidance Withdrawn by the CFPB.” May 2025. https://www.americascreditunions.org/node/17866
- Arthur Cox. “How much information needs to be provided to data subjects about automated decisions?” https://www.arthurcox.com/knowledge/how-much-information-needs-to-be-provided-to-data-subjects-about-automated-decisions/
- Centre for Banking and Financial Law, University of Geneva (cdbf.ch). Commentary on CJEU Case C-203/22, Dun & Bradstreet Austria .https://cdbf.ch/en/1400/
- International Organization for Standardization. “ISO/IEC FDIS 42105: Information technology — Artificial intelligence — Guidance for human oversight of AI systems.” https://www.iso.org/standard/86902.html
Tim Green UK-based Systems Theorist & Independent Technology Writer
Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.
His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.
**ORCID:** [0009-0002-0156-9795](https://orcid.org/0009-0002-0156-9795)
**Email:** [tim@smarterarticles.co.uk](mailto:tim@smarterarticles.co.uk)
Listen to the free weekly [SmarterArticles Podcast](https://www.smarterarticles.fm)