Credit decision audit

50 decisions. 10 working days. A signed answer for each one.

Most risk teams can explain their model. Fewer can show, for one specific decision, which clause of their own credit policy it rests on. From 20 November 2026, CCD2 lets any customer ask.

Book a 20-min call Email the founder

Why now

01
CCD2 from 20 November 2026
Consumers get the right to a meaningful explanation of automated credit decisions and to request human review. The directive now covers buy-now-pay-later and loans under €200.
02
GDPR Article 22
The CJEU’s SCHUFA ruling (C-634/21) treats automated credit scoring that drives a decision as an automated decision, with the duties that follow.
03
Supervisors are already checking
Recent supervisory decisions in the Nordics and Baltics have turned on whether required creditworthiness checks actually ran before a loan was signed.

What you send

50 recent automated decisions: approvals, declines and limits, with the stated reasons and the fields used.
Your credit policy, and any decision rules or thresholds it relies on.
Anonymised extracts are fine. No names or account numbers needed. Nothing connects to your live systems.

What we check

Every stated reason is matched to the clause of your policy it claims to rest on.
Numeric rules (thresholds, minimums, required checks) are checked with plain code against the decision’s own data, not by an AI’s opinion.
Where a reason can’t be matched or confirmed, we say “can’t tell” rather than guess.
Your own expert marks agree or disagree on each finding before the report is final.

What you get

A signed report covering all 50 decisions, each marked supported, unsupported or can’t tell, with the clause and the data it rests on.
A list of the decisions most likely to fail an explanation or review request.
A record you can replay: same inputs, same verdict.

Illustrative example, not customer data

#17 · €4,500 personal loan · declined
Supported
Income below affordability threshold → traced to policy §3.2
#31 · €1,200 · approved
Unsupported
One required creditworthiness indicator not recorded → flagged for review

Timeline

01
Day 0
Kick-off call and data handover
02
Days 1–8
Trace and check
03
Day 9
Your expert reviews findings
04
Day 10
Signed report and walkthrough call

Price

Fixed fee from €5,000 for 50 decisions.

Credited in full against a monitoring subscription if you continue.

DATA HANDLING

How your data is handled

Anonymised extracts by default.
Processed with model providers that offer EU processing and no data retention.
Kept in an isolated, encrypted workspace for your audit only, and deleted after the report is delivered, on the schedule set in your data processing agreement.
We sign a data processing agreement before any data is shared.

FAQ

Frequently asked questions

No. You send a file extract. Nothing connects to your production systems.

No. Model validation asks whether the model is accurate. This audit asks whether each decision’s stated reason is supported by your own policy, which is what an explanation request will test.

Reason codes are fine. We map each code to the policy clause it stands for.

If it’s useful, we can check new decisions on a monthly subscription, so explanation and review requests can be answered as they arrive. The audit fee is credited against it.

No. The report is evidence for your compliance and risk teams. It isn’t legal advice.

Ready to see which of your decisions hold up?

Book a 20-min call Email the founder

Please wait...

What we check

Every stated reason is matched to the clause of your policy it claims to rest on.

Numeric rules (thresholds, minimums, required checks) are checked with plain code against the decision’s own data, not by an AI’s opinion.

Where a reason can’t be matched or confirmed, we say “can’t tell” rather than guess.

Your own expert marks agree or disagree on each finding before the report is final.

What you get

A signed report covering all 50 decisions, each marked supported, unsupported or can’t tell, with the clause and the data it rests on.

A list of the decisions most likely to fail an explanation or review request.

A record you can replay: same inputs, same verdict.

Illustrative example, not customer data

#17 · €4,500 personal loan · declined
Supported
Income below affordability threshold → traced to policy §3.2
#31 · €1,200 · approved
Unsupported
One required creditworthiness indicator not recorded → flagged for review

How your data is handled

Anonymised extracts by default.

Processed with model providers that offer EU processing and no data retention.

Kept in an isolated, encrypted workspace for your audit only, and deleted after the report is delivered, on the schedule set in your data processing agreement.

We sign a data processing agreement before any data is shared.

Frequently asked questions

No. You send a file extract. Nothing connects to your production systems.

No. Model validation asks whether the model is accurate. This audit asks whether each decision’s stated reason is supported by your own policy, which is what an explanation request will test.

Reason codes are fine. We map each code to the policy clause it stands for.

If it’s useful, we can check new decisions on a monthly subscription, so explanation and review requests can be answered as they arrive. The audit fee is credited against it.

No. The report is evidence for your compliance and risk teams. It isn’t legal advice.

50 decisions. 10 working days. A signed answer for each one.

Why now

CCD2 from 20 November 2026

GDPR Article 22

Supervisors are already checking

What you send

What we check

What you get

Timeline

Day 0

Days 1–8

Day 9

Day 10

Price

How your data is handled

Frequently asked questions

Do you need access to our systems?

Is this a model validation?

What if our reasons are codes, not sentences?

What happens after the audit?

Are you a law firm?

Ready to see which of your decisions hold up?

50 decisions. 10 working days. A signed answer for each one.

Why now

CCD2 from 20 November 2026

GDPR Article 22

Supervisors are already checking

What you send

What we check

What you get

Timeline

Day 0

Days 1–8

Day 9

Day 10

Price

How your data is handled

Frequently asked questions

Do you need access to our systems?

Is this a model validation?

What if our reasons are codes, not sentences?

What happens after the audit?

Are you a law firm?

Ready to see which of your decisions hold up?