- Your rights after a declined business application come from lending law, not from AI law. In the US that is the Equal Credit Opportunity Act and Regulation B.
- Regulation B splits business applicants at 1 million dollars of gross revenue in the preceding fiscal year, and the smaller side gets a lighter procedure rather than fewer rights.
- The CFPB has stated that a lender cannot excuse a vague denial by saying its model is too complex to explain. Not understanding your own method is not a defence.
- The EU AI Act treats credit scoring as high risk only for natural persons, so a sole trader is covered by that clause and a limited company is not.
- Those EU high risk duties apply from 2 December 2027 after the AI Omnibus, so today the enforceable route in Europe is data protection law and national lending rules.
- Fraud detection is carved out of the credit scoring clause, which matters because a decline dressed as a fraud flag sits outside it.
A decline arrives as a sentence with no detail. Your application did not meet our current criteria. You have been trading for four years, your revenue is up, and nothing in that sentence tells you what to change before you try again. Somewhere behind it a model produced a score, and the question worth answering is not whether that is fair. It is what you are entitled to be told.
The answer is more generous than most small business owners assume, and it comes from an unexpected place. Not from any of the new AI rules. From credit law that has been on the books for decades and applies whether the decision was made by a model or a person in a back office.
Does lending law cover a business, or only a consumer?
It covers businesses, and this is the fact most owners get wrong. The Equal Credit Opportunity Act and its implementing rule, Regulation B, apply to applicants for business credit as well as consumer credit. The procedure differs, the entitlement does not disappear.
Regulation B section 1002.9 sets out the notification rules, and paragraph (a)(3) carves out business credit specifically. The dividing line is a business that had gross revenues of 1 million dollars or less in its preceding fiscal year. Most readers of this article are on that side of the line.
For a business under that threshold, the statement of the action taken may be given orally or in writing when adverse action is taken. Notification has to come within a reasonable time of a completed application, and Regulation B deems the 30 day standard in section 1002.9(a)(1) reasonable in all instances. For a business above the threshold, the creditor must provide a written statement of reasons when the applicant makes a written request within 60 days of the notification.
Read the asymmetry carefully, because it runs against intuition. The smaller business gets the lighter procedure, which sounds worse and is often better: the reasons are owed without you having to construct a formal written demand inside a 60 day window. The larger business has a stronger paper trail and a deadline it can miss.
| Who you are | Rule that gives you standing | What you can require | Timing |
|---|---|---|---|
| US business, revenue at or under 1m dollars | Regulation B 1002.9(a)(3) | A statement of the action taken, orally or written, with reasons | Within a reasonable time, 30 days deemed reasonable |
| US business, revenue above 1m dollars | Regulation B 1002.9(a)(3) | A written statement of reasons, after you ask in writing | Your request within 60 days of notification |
| Any US applicant scored by an opaque model | CFPB Circular 2022-03 | Specific and accurate principal reasons, model complexity no excuse | Same as the notice above |
| EU sole trader | AI Act Annex III point 5(b), as a natural person | High risk duties on the lender, including human oversight | Applies from 2 December 2027 |
| EU limited company | Not Annex III 5(b), which names natural persons | Data protection and national lending law instead | Already in force |
Can a lender hide behind the model?
No, and a US regulator has said so in writing. CFPB Circular 2022-03 asks whether creditors using complex algorithms that prevent them from identifying specific denial reasons still have to give a statement of specific reasons. The answer is yes.
The circular's own language is unusually direct. A creditor cannot justify noncompliance based on the mere fact that the technology it employs is too complicated or opaque to understand, and a creditor's lack of understanding of its own methods is not a cognizable defence against liability. It goes further and says the rules do not permit creditors to use complex algorithms when doing so means they cannot provide specific and accurate reasons.
The practical value of that paragraph is leverage in a phone call. You are not asking a favour when you ask why. You are asking for something the lender is required to be able to produce, and the requirement does not soften because the answer came from a score.
A caution on scope. The circular was published in 2022 and sits inside a US supervisory framework whose enforcement posture has shifted more than once since. The statutory duty in Regulation B is the durable part. Treat the circular as the regulator's reading of that duty rather than as the duty itself.
What does the EU AI Act give a business borrower?
Less than the headlines suggest, because of one word. Annex III of the EU AI Act lists as high risk those systems intended to evaluate the creditworthiness of natural persons or establish their credit score, with an exception for systems used to detect financial fraud.
Natural persons. A sole trader, a self employed maker, an individual applying in their own name is a natural person and falls inside the clause. A limited company applying for a facility in the company's name does not. Two businesses of identical size, doing identical work, can sit on opposite sides of that sentence purely because of how they were incorporated.
The timing matters as much as the scope. Following the AI Omnibus, the Commission's regulatory framework page gives 2 December 2027 for high risk systems in sensitive areas and 2 August 2028 for high risk AI embedded in regulated products. Nothing in those obligations binds a lender today. We set out which duties are already live and which are not in the obligation map for the EU AI Act, and the short version is that transparency and staff AI literacy arrived while the high risk regime did not.
Several widely shared timeline pages still print 2 August 2026 for high risk obligations. If somebody quotes that date at you, they are reading a page written before the Omnibus entered into force on 27 July 2026.
Why does the fraud exception matter so much?
Because a decline can be relabelled. The Annex III clause excludes AI systems used for detecting financial fraud, which is a sensible carve out and also a gap with your name on it. An application refused because a fraud model flagged something looks, from your chair, exactly like an application refused on creditworthiness.
The two produce different obligations and different conversations. A creditworthiness decision invites a discussion about your figures. A fraud flag often produces a wall, because explaining the signal would explain how to evade it. Sellers meet the same asymmetry on the payments side, where a legitimate order is refused by a risk model that nobody will discuss, which we covered in what false declines cost and why they are hard to appeal.
If a decline is vague about which of the two it is, ask directly. The answer determines whether you are arguing about your accounts or about your identity, and those need different evidence.
What if you signed a personal guarantee?
Then a second body of law enters, and it is attached to you rather than to the business. Most small business facilities ask a director or owner to guarantee the debt personally, which means the lender pulls a consumer credit report on a person. Once a consumer report is part of the decision, the Fair Credit Reporting Act has something to say about what you are told.
The FTC's guidance for businesses using consumer reports sets out what the notice has to contain when adverse action rests even partly on such a report. The name, address and phone number of the reporting agency that supplied it, including a toll free number for the nationwide agencies. A statement that the agency did not make the decision and cannot explain it. Notice of your right to a free copy of the report from that agency within 60 days. Notice of your right to dispute anything inaccurate or incomplete in it. And the credit score, if a score was used.
That last item is the one to chase. A score you have never seen, produced from a file you have never read, is the single most common hidden input into a small business decline. The notice has to hand it to you when it was used, and the free copy right then lets you check the file it came from.
There is a catch worth knowing before you rely on it. A guarantor is not treated as an applicant under Regulation B, so the reasons machinery described above does not automatically run for the person guaranteeing the loan in the way it runs for the business applying. The consumer report route and the business applicant route are separate paths, and which one you are on depends on whose file was pulled and in whose name the application sat.
What has to be in the notice itself?
More than most decline letters contain. Regulation B section 1002.9(a)(2) requires a written notification to include the name and address of the creditor, a statement of the provisions of section 701(a) of the Act, and the name and address of the federal agency that administers compliance, along with either the specific reasons or a disclosure of your right to request them.
Read that list against the last decline you received. A letter that names no agency, cites no statute and offers no route to reasons is not merely unhelpful, it is thin against the standard. You do not need to allege a violation to use this. Quoting the required contents back, calmly, usually produces a better second letter than an argument about fairness ever does.
Regulation B's commentary is also specific that reasons must be specific and indicate the principal reasons, and that a vague reference to internal standards or policies does not satisfy it. Did not meet our credit criteria is precisely the formulation that language was written to exclude.
Which arguments are not worth making?
Three of them, and knowing this saves weeks. Arguing that the model is unfair in the abstract goes nowhere, because nobody at the lender has the authority to relitigate their scorecard on your call. Arguing that you are a good business goes nowhere either, since the decision was made on recorded data rather than on character. And asking to speak to whoever made the decision misunderstands the structure, because in an automated process there is often no such person.
What does move is narrower and duller. A factual error in an input, evidenced. A material change since the data was pulled, such as filed accounts that postdate the application. A misreading of your banking, such as a loan drawdown counted as turnover. Each of those is a correction request rather than an appeal, and corrections are the thing these processes are actually built to handle.
What should you actually ask for?
Four things, in this order, and in writing even where writing is not required. Asking in writing costs nothing and it creates the record that makes a later complaint possible.
First, the principal reasons for the decision, stated specifically. Regulation B's commentary on section 1002.9(b)(2) requires reasons that are specific and indicate the principal reasons, and notes that a vague gesture at internal standards is insufficient. Second, what data the decision drew on, which is where you discover that a bureau file, a bank feed or a third party score was involved. Third, whether an automated system produced or contributed to the outcome. Fourth, what would have to change for a different result.
The second question is the one that most often produces something actionable, because errors in input data are far more common than errors in models. A misfiled county court judgment, a dissolved company with a similar name, a bank feed that read a loan drawdown as revenue. None of that is visible from the decline letter and all of it is correctable.
What can you do before you apply?
Make yourself legible, which is the same problem as making a product legible to an assistant. A model scoring your application is reading whatever structured record exists about your business, and gaps get read as risk rather than as absence of information.
Three practical moves. Check your business credit file with the major bureaus before a lender does, since business files are not covered by the consumer dispute rights people assume apply and errors can sit there for years. Keep your filings current, because a late set of accounts is a hard negative that no narrative overcomes. Separate business and personal banking properly, since a mixed feed makes revenue impossible to read cleanly.
Then know your own numbers well enough to challenge a score. That means your real cost base, including the software you pay for monthly, which is easy to underestimate when it arrives as a dozen small charges. If you are auditing that line, our page on what the plans cost each month exists partly so the figure is not a guess, and the same exercise across your other tools usually turns up a subscription nobody uses.
Where this is heading
Two directions at once, and they are not in tension. Lending is getting more automated, which makes decisions faster and less discussable. Disclosure duties around automated decisions are getting stronger, though in Europe more slowly than the original timeline promised.
For a business owner the useful posture is unromantic. Assume a model will score you. Assume the person on the phone did not make the decision and cannot reverse it. Then use the rights that predate all of this, because a statute from 1974 currently gives a small US business a clearer entitlement to an explanation than any AI specific rule does. That is an odd situation and it is the one you are in.
If you are building the operational side of the business at the same time, the record you keep is the record you get scored on. The same discipline that makes a catalogue readable makes a loan file readable, and we walked through the bookkeeping half of it in how a one person business can keep its books with AI without losing the audit trail.