Assessment of creditworthiness by AI – obligation to provide explanations

In the judgment of 27 February 2025, case C-203/22, the Court of Justice of the EU addressed the issue of the automated assessment of creditworthiness using artificial intelligence (AI).

In this case, an Austrian mobile telephone operator refused to conclude a mobile telephone contract with a client which would require a monthly payment on the ground that she did not have sufficient financial creditworthiness. This assessment was substantiated on behalf of the operator by an external company using AI technology.

The client asked the company to explain the basis of the decision, however, was refused on the grounds of trade secrets. The case was referred to the Austrian court and concerned data protection regulations. The Austrian court referred preliminary questions related to the interpretation of EU law (GDPR) to the CJEU.

The Court decided that the data subject has a right to receive from the controller about “meaningful information about […] decision-making”. The entity using automated assessment of creditworthiness should explain in a concise, transparent, intelligible and easily accessible form, procedure and principles relating to use, by automated means, of personal data with a view to obtaining a specific result, such as a credit profile.

In the view of CJEU, the controller should describe the procedure and principles applied in such a way that the data subject can understand which of his or her personal data have been used in what way in the automated decision-making.

It would be insufficient in this context to provide the algorithm used alone, as this is not understandable to an average recipient. It should also be clear from the information to what extent a change in the personal data taken into account would lead to a different result.

The CJEU’s  position is an important indicator of the jurisprudence’s approach to the use of artificial intelligence and the need to grant certain rights to individuals whose data is processed in an automated manner.

• CJEU judgment of 27 February 2025, C-203/22