Skip to content

REAL INCIDENT CASE STUDY

30 September 2025A European data-protection authority
Published by the authority

An automated credit decision that could not explain itself.

A financial-services provider in the EU used automated, algorithm-based decisions to assess credit-card applications. Several applicants with good creditworthiness were rejected. The decisions were made without human intervention. When applicants asked why, the provider did not give adequate information about the logic, significance or consequences, and did not meet its information and access obligations. The authority fined the company EUR 492,000.

What we have done: we reconstructed the credit-card decision and applicant-rights scenario as a normal project and executed it in the DutAIx Requirements module.

We do not claim the provider used AI. The published facts describe automated, algorithm-based decisions; we assume AI could have been in scope. This is not an assurance that the incident would have been prevented and is not legal advice.

WHAT THE LAB IDENTIFIED

Acts and gaps.

4stories assessed22applicable now13story-level duties9project-level duties

GDPR

EU AI Act

Executed the Requirements module only for this case study. Design, Build and QA modules were not run.

THE REPORT RETURNED

The actual report.

Inside the report

  • Gaps identified against each submitted story
  • Suggested changes and acceptance details for review
  • 13 story-level + 9 project-level duties, with acts
  • Audit trail and evidence record
Cover of the Requirements assessment PDFPDF · 12 PAGES
Open the report

Requirements only · 4 stories · Version 1.

The PDF is advisory and not a legal opinion or compliance certificate.

SEE THE PLATFORM IN PRACTICE

Inspect the evidence.
Ask the next question.

See how the platform supports a practical review in a walkthrough.

Request a walkthrough