Europe's automated loan decision is getting a human-review route before the AI rulebook

A loan refusal can arrive in seconds. A screen says no, the process ends and the applicant may never see whether a human considered the file. In the European Union, that black-box moment is about to acquire a second route.

From 20 November 2026, national measures implementing the EU's revised Consumer Credit Directive must apply. When a covered creditworthiness assessment uses automated processing of personal data, the consumer must be able to request human intervention from the creditor.

That phrase is more specific than a general right to speak to customer service. Article 18 sets out three parts. The consumer can request a clear and comprehensible explanation of the assessment, including the logic and risks in the automated processing and its significance and effects on the decision. The consumer can express their own point of view. They can also request a review of both the creditworthiness assessment and the decision on granting credit.

None of that creates a right to borrow. A human review can uphold a refusal. The directive does not say that a lender must reveal source code, ignore affordability or approve a borderline application. It creates a route for explanation and reconsideration where an automated assessment has helped decide whether the obligations are likely to be repaid.

The wording matters because the directive does not reserve this protection for systems marketed as artificial intelligence. It applies when the creditworthiness assessment involves automated processing of personal data. A conventional scoring model or rules engine can therefore matter even if nobody puts an AI label on it.

The assessment itself is also constrained. The directive says creditors should use relevant and accurate information about income, expenses and other financial and economic circumstances, proportionate to the nature, duration, value and risk of the credit. It excludes special-category personal data from that assessment and says social networks must not be treated as an external information source.

Credit history can be part of the picture, but Article 18 says the assessment must not rest exclusively on it. If a database leads to rejection, Article 19 adds a free notice about the result, the database consulted and the categories of data considered.

A rejected application has its own notice rule. The creditor must inform the consumer without delay. Where relevant, it must say that the assessment was based on automated processing, explain the right to human assessment and describe the procedure for contesting the decision. The practical object to look for is therefore not a generic promise of responsible AI, but a named route back into the lender's decision process.

The revised directive has a broader scope than the framework it replaces. The European Commission highlights credit below the former EUR 200 floor and deferred-payment schemes commonly abbreviated as BNPL. That makes the human-review provision relevant beyond a traditional unsecured bank loan.

There are boundaries. The directive generally excludes credit secured by a mortgage, credit used to acquire land or a building and agreements above EUR 100,000. Certain interest-free deferred payments supplied directly by a retailer or service provider can also sit outside the scope when the detailed conditions are met. National law supplies the working implementation, regulator and complaint route, so a product label alone cannot settle whether a particular agreement is covered.

This is why the November date should not be flattened into "all loan algorithms become appealable". The protection attaches to covered consumer credit, automated personal-data processing and the national measures that implement the directive. It is broad enough to matter, but not universal.

The current wave of AI Act announcements can make the timetable look simpler than it is. On 2 August 2026, new AI transparency rules began to apply and the European Commission's AI Office and national authorities gained enforcement powers for provisions already in force. Those changes include disclosure around chatbots and synthetic content. They do not mean every high-risk AI duty began on that day.

The AI Act lists systems used to evaluate a person's creditworthiness or establish a credit score as high-risk, except systems used to detect financial fraud. The Commission's current enforcement timetable says the rules for Annex III high-risk systems apply from 2 December 2027.

The two regimes therefore meet at automated lending, but from different directions. The Consumer Credit Directive governs the creditor-consumer relationship and creates an explanation, response and review route from November 2026. The AI Act imposes system-level duties on providers and deployers of qualifying high-risk AI, on its own later timetable. An automated credit process can engage the first rule without necessarily being an AI system. A credit-scoring AI can eventually engage both.

That distinction is the useful part of the calendar. "AI rules are here" is too broad, while "AI credit rules are delayed" misses the nearer consumer-credit right. For a person facing an automated refusal, the first concrete change is not a label on the model. It is the ability to ask what shaped the assessment, put their account of the facts into the process and have the decision reviewed by the creditor.

A second route is not a guaranteed exit. It is still a meaningful change to a screen that once looked final.