The Model Declined Them. Now Write Down Why, Specifically.
Fairness testing is where AI decisioning gets its attention. The adverse action notice is where it gets cited. A denial letter is a written, dated, applicant-held admission of what your model did — and it is generated thousands of times before anyone audits anything.
Why the Notice Is the Sharper Exposure
A disparate impact claim requires statistics, an expert, and usually discovery to establish. A defective adverse action notice requires the notice. It is a document you wrote, dated, and handed to the person complaining about it, and evaluating it does not depend on modelling anything.
That asymmetry is why the notice is the practical entry point for both regulators and plaintiffs' counsel, and why it is worth fixing before the fairness programme is finished. It is also, unlike bias remediation, a bounded engineering problem with a definite end state.
Four Ways an AI-Generated Notice Fails
A Pipeline That Produces Reasons, Not Scores
Reason generation is a stage in the decision path, not a reporting job that runs later. Building it as an afterthought is what produces notices that cannot be reproduced when questioned. The stages that matter:
Every decision records the exact model artefact that produced it, along with the feature values as they were at scoring time. Without this, a retrain silently destroys your ability to explain any prior decision, and retrains are frequent.
Attribution for this applicant against a documented baseline, computed in the same request rather than reconstructed later. Record the baseline choice — it determines the ranking, and a baseline nobody chose is a baseline nobody can defend.
A reviewed table translating each feature into a sentence an applicant can act on. This is the step where legal review adds the most value and where engineering teams most often improvise, because the feature names read like reasons to the people who built them.
Take the top contributors by attribution magnitude, deduplicate features that express the same underlying fact, and stop at the small number the regulation contemplates. Listing everything is its own failure — a notice with twelve reasons has communicated none.
The rendered text, not the ingredients. Reconstructing a letter from templates and data a year later produces something plausible rather than something true, and the difference matters when the applicant has kept their copy.
The Test You Can Run This Week
Pull a sample of recent denials — fifty is enough — and tabulate the reasons sent. Two signals show up immediately and neither requires a model expert to interpret.
- Concentration. If a handful of reason strings cover nearly the whole sample, the notices are describing the model rather than the applicants. Genuine local attribution produces a long tail because applicants differ.
- Actionability. Read each reason as the applicant. If it does not identify something about their own file, it has not met the purpose the requirement exists to serve, whatever box it was printed in.
Then take five of those denials and try to regenerate the reasons from stored artefacts. If you cannot — because the model was retrained, or the inputs were not kept — that is the finding, and it is a more urgent one than anything the distribution shows.
Frequently Asked Questions
What is an adverse action notice actually required to say?
Under Regulation B, which implements ECOA, a creditor taking adverse action must give the applicant either a statement of the specific principal reasons for that action or a disclosure of the right to request them. The operative words are specific and principal: the reasons must be the ones that actually drove this decision for this applicant, not a list of everything the model considers. FCRA adds a parallel obligation when a consumer report contributed, including identifying the reporting agency and the applicant's rights around the file.
Is 'our model is too complex to explain' a valid answer?
No, and regulators have said so directly rather than leaving it to inference. The CFPB's guidance on this point has been that creditors cannot use complex algorithms as an excuse for failing to provide specific reasons, and that adopting a model whose outputs cannot be explained does not shrink the obligation attached to using it. The obligation is on the decision-maker, not the vendor, so choosing an unexplainable tool is itself the compliance decision.
Can we just use the standard reason codes on the sample form?
The sample forms in the regulation's appendix are safe harbours for format, not for accuracy. Selecting a checkbox that does not describe what actually drove the model's output does not become compliant because the checkbox was printed by a regulator. Where the true driver of a score has no corresponding checkbox — a thin file, a behavioural signal, a derived ratio — the correct move is to write the reason out, not to select the nearest available box.
Does this apply outside of lending?
Yes, in several parallel regimes. FCRA adverse action duties attach in employment when a consumer report is used, including a pre-adverse-action step giving the applicant a chance to dispute. Tenant screening and insurance carry their own notice obligations, and state insurance regulators have been increasingly explicit about automated tools. The common structure is the same everywhere: a person was declined, something automated contributed, and they are owed a reason they can act on.
Do SHAP values give us compliant reason codes?
They give you a defensible starting point, not a finished notice. Attribution methods identify which features moved a particular prediction, which is exactly the input the requirement needs. Two gaps remain. The output is at feature level, and features like a windowed utilisation ratio are not consumer-readable, so a mapping to plain language is still required. And attributions are computed against a baseline, so the choice of baseline determines the answer — a choice worth documenting rather than accepting as a library default.
What if a vendor's score is only one input into a human decision?
That helps with the automated-decision framing and does not remove the notice duty. If the score materially contributed to the denial, it is among the principal reasons and belongs in the statement. The pattern regulators find least persuasive is a nominal human reviewer who approves the model's output at a rate near a hundred percent, which invites the argument that the review was procedural cover rather than a decision.
How long do we have to send the notice?
Regulation B generally requires notification within thirty days of receiving a completed application, with different timing rules for incomplete applications, counteroffers and existing accounts. The operational risk with automated decisioning is the opposite of lateness — instant declines can go out before any reason-generation step has run, which produces a fast notice with a generic reason. Speed does not cure content.
What should we keep as evidence?
For each adverse action, retain the model version, the feature values as scored, the attribution output, the mapped reasons and the notice text actually sent. The failure mode is a retrained model: the score is preserved but the model that produced it is gone, so nobody can reconstruct the reasons if the notice is challenged a year later. Versioned models and stored inputs are what makes the reason reproducible, and reproducibility is the whole defence.
Start With Fifty Letters
Before commissioning explainability work, read fifty notices you already sent. The concentration of reason strings tells you whether your pipeline is producing local explanations or restating the model, and that answer determines whether this is a mapping-table problem or an architecture problem.
Both are fixable. They are not fixable with the same budget, and guessing which one you have is how remediation programmes get scoped wrong.