1. DEFINITION: WHAT IS EXPLAINABLE AI OBLIGATION?

Legal duty of deployer/developer of AI system to provide human-understandable explanation of AI's output, logic, and impact, enabling affected person to understand, contest, and seek remedy.

Two levels:

A. Technical Explainability: How model works - Feature importance, SHAP values, counterfactuals.
B. Legal Explainability: Why this decision for this person - Personalized, actionable explanation in plain language.

Law requires B, not necessarily A. You don't need to disclose source code, but must explain procedure and principles actually applied.

2. LEGAL FRAMEWORK - 5 SOURCES

A. EU AI ACT 2024 - THE MAIN SOURCE - Directly applicable in Spain from 2026

Classification: AI used for credit scoring, creditworthiness assessment, risk assessment for insurance, recruitment is High-Risk AI System - Annex III 5(b), 5(c), 4(a)

Obligations for High-Risk AI:

1. Art 11 + Annex IV - Technical Documentation: Must document logic, data, performance, explainability measures before placing on market.

2. Art 13 - Transparency and Provision of Information to Deployers:
High-risk AI system must be designed to enable deployer to understand its output and use it appropriately. Must provide instructions including:

• Characteristics, capabilities, limitations
• Expected performance
• Interpretability of output (how to read explanation)

3. Art 14 - Human Oversight: High-risk AI must be overseen by natural persons who can understand its limitations and interpret output. Human must be able to override.

4. Art 86 - Right to Explanation - The Revolutionary Article:
"Any affected person subject to decision taken by deployer on basis of output from high-risk AI system which produces legal effects or similarly significantly affects him has right to obtain from deployer clear and meaningful explanation of role of AI system in decision-making procedure and main elements of decision taken."

Example: Bank uses AI to reject mortgage. Customer has right under Art 86 AI Act to get explanation: Role of AI (was decision fully automated or human validated?), main elements (income, debt ratio, credit history weighting).

Deadline: Art 86 applies from 2 Aug 2026 for all high-risk systems already in market. Banks must comply now.

5. Art 50 - Transparency for General Purpose AI (GPAI): If bank uses chatbot for customer service, must inform customer he is talking to AI.

Penalty for Non-Compliance: Up to €35M or 7% global turnover - Art 99(3) - Highest fine.

B. GDPR - As explained in previous answer

• Art 13(2)(f), 14(2)(g), 15(1)(h): Meaningful information about logic involved
• Art 22: No solely automated decision without safeguards
• CJEU C-203/22 Dun & Bradstreet defines what meaningful means.

C. SPANISH LAW

• Ley Orgánica 3/2018 LOPDGDD Art 22: Right not to be subject to automated decisions.
• Ley 6/2023 Mercado de Valores Art 208: Robo-advisor must be explainable.
• Banco de España Circular 2/2016 + 2022 Guidelines on Loan Origination: When bank uses automated models for creditworthiness (scoring), model must be interpretable, documented, and explainable to supervisor. Black box models prohibited unless LIME/SHAP explainability layer exists.
• Royal Decree 817/2023 - Spanish AI Supervisory Agency (AESIA) in A Coruña: Enforcement authority for AI Act in Spain.

D. SECTORAL: EU Consumer Credit Directive 2023/2225 Art 18-22

Creditor must inform consumer if creditworthiness assessment involves automated processing, and must provide explanation.

3. DETAILED CASE LAWS

CASE 1: C-203/22 DUN & BRADSTREET AUSTRIA - 27 FEB 2025 - THE LEADING CASE FOR XAI OBLIGATION

Already explained in previous answer but re-state for XAI:

Facts: Mobile phone contract refused due to automated credit score by D&B.

CJEU Held for XAI Obligations:

1. Explainability is Genuine Right: Data subject entitled to explanation of procedure and principles actually applied.
2. Content of Explanation: Must include what personal data used, what weight, why it led to result for this person. Generic "AI considered many factors" = insufficient.
3. Trade Secret vs Explainability: Algorithm need not be disclosed (protect trade secret), but controller must give concise, transparent, intelligible, easily accessible explanation. Court can review algorithm in camera if dispute.
4. Actionable: Explanation must enable contest - What would change outcome? (Counterfactual)

This case is now cited as basis for AI Act Art 86.

CASE 2: C-634/21 SCHUFA HOLDING AG - 7 DEC 2023 - XAI FOR CREDIT BUREAUS

Facts: SCHUFA (German CIBIL) auto-generates score, banks rely on it to reject loans.

CJEU:

• SCHUFA score itself is automated decision under Art 22 GDPR.
• Credit bureau itself has XAI obligation, not just bank.
• Prohibited unless authorized by law with safeguards.

Impact: In Spain, Equifax, Experian, Informa D&B now must provide XAI-compliant explanations directly to consumers under Art 86 AI Act + Art 15 GDPR.

AEPD Spain fined Equifax in 2024 €300k for providing only score without explanation of logic.

CASE 3: STATE v. LOOMIS - 881 N.W.2d 749 - Wisconsin Supreme Court USA 2016 - First XAI Case in Criminal Risk Scoring

Facts: US court used COMPAS AI risk score to sentence Loomis to 6 years. Loomis argued AI not explainable, violates due process.

Held: Court can use AI but must warn: (1) Proprietary algorithm not disclosed, (2) Score based on group data not individual, (3) Not validated for this use. Must have human oversight.

Imported to EU: This case led to Art 14 Human Oversight in EU AI Act. Banking judges in Spain now cite Loomis: If bank uses AI to decide NPL classification, human must be able to override.

CASE 4: SYRI CASE - Rechtbank Den Haag - Netherlands - 5 Feb 2020 - XAI & Welfare Fraud AI

Facts: Dutch government used SyRI AI system to detect welfare fraud, linking data from 17 sources. No explanation.

Court Held: SyRI violates Art 8 ECHR + GDPR because not transparent, not explainable. Government cannot explain how risk model worked. System banned.

Impact: First time court banned government AI for lack of explainability. Direct precedent for Spanish AESIA.

CASE 5: AEPD SPAIN - CAIXABANK & BBVA - 2023-2024 - Spanish Banking XAI Fines

PS/00119/2023 CaixaBank: Loan rejection via automated scoring, letter said "Scoring insufficient". AEPD: Violates Art 13(2)(f) - No meaningful information. Fine €50k.

PS/00345/2024 BBVA: Account blocked by AML AI for suspicious transaction, no human review, customer not told why. AEPD: Violates Art 22(3) - No human intervention. Fine €100k.

Doctrine: Spanish DPA says explanation must include main factors that led to adverse decision + how customer can improve.

CASE 6: CJEU - C-223/19 - YS v. NK - Credit Scoring Explanation Limits

Facts: Data subject asked for full logic of credit scoring to understand.

Advocate General Opinion (2022): Explanation must be meaningful but not necessarily reveal entire model. Must be tailored to individual's understanding, not data scientist's.

Applied in Dun & Bradstreet 2025.

4. WHAT COUNTS AS COMPLIANT EXPLAINABILITY? - 4 METHODS ACCEPTED BY REGULATORS

Banco de España + EU AI Office accept:

1. Global Explainability (Model Level):

• What data categories model uses? (income, payment history, etc.)
• What is overall importance? (SHAP summary)
• What are limitations?

2. Local Explainability (Decision Level) - Mandatory under Art 86 AI Act:

• Why this person rejected? (Local SHAP values)
• Example: "Your debt-to-income 48% (threshold 35%) contributed -40 points, 3 defaults in last year -30 points, short tenure -10 points. Total score 520, need 600."

3. Counterfactual Explanation - Most Important for Contestability:

• "What minimal change would change decision?"
• Example: "If your debt-to-income was 30% instead of 48%, and you had 0 defaults, loan would be approved."
• CJEU in Dun & Bradstreet para 72: Explanation must enable data subject to understand what to do to change outcome.

4. Procedural Explanation:

• Role of AI vs human: Was decision fully automated or human validated?
• Human oversight: Who reviewed?

5. EXPLAINABILITY OBLIGATIONS CHECKLIST FOR BANK (HIGH-RISK AI USER)

Under AI Act + GDPR + Banco de España, bank must have:

Before Deployment:

•  Risk Assessment + Data Governance (Art 10 AI Act)
•  Technical documentation with explainability measures (Art 11)
•  Human oversight plan - Who can override AI? (Art 14)

At Time of Decision (Loan Rejection):

•  Inform customer decision involves AI (Art 50 + 13 GDPR)
•  Provide Art 86 explanation: Role of AI + Main elements + Plain language
•  Provide GDPR meaningful logic: Data used, weighting, specific reasons for this customer
•  Provide Counterfactual: What would need to change?
•  Provide Rights: Human intervention, contest, complain to AEPD/AESIA

After Decision:

•  Keep logs for 6 years (Art 19 AI Act) - So supervisor can audit explainability
•  Monitor for bias (Art 15 AI Act)

6. CONSEQUENCES OF FAILURE

• AI Act: €35M or 7% turnover
• GDPR: €20M or 4% turnover
• Civil: Loan rejection void, damages for discrimination if AI biased and not explainable (STS Spain 2024: If bank cannot explain AI, presumption of discrimination)
• Criminal (Spain): If non-explainable AI leads to discriminatory denial of basic banking service (right to payment account under RD 19/2017), can be delito de denegación de servicio Art 512 CP.

Bottom Line Post 2025: In EU banking, Explainable AI is not optional ethics - It is dual right under GDPR Art 15/22 and AI Act Art 86. Black box AI = Illegal high-risk AI. Dun & Bradstreet says: You can keep algorithm secret, but you must explain logic in human language that enables contest.