Imagine getting a letter in the mail telling you that your mortgage application was rejected. As required by law, the letter includes a list of reasons. However, because the decision was made by a machine learning model with thousands of interacting variables that even its own creators are unable to link to a single cause, the explanations are ambiguous—standardized language produced by a system that no one at the bank can completely explain. This isn’t speculative. It is the current state of AI-assisted lending at a number of institutions, and regulators and courts are increasingly clear that it constitutes a legal problem rather than simply a technical one.
The change has been developing for years and picked up speed in 2024 and 2025. The Equal Credit Opportunity Act, which was passed in 1974, forbids discrimination in credit on the grounds of race, color, religion, national origin, sex, marital status, and age. This fundamental legal framework has not changed. Similar protections for mortgage lending are provided by the Fair Housing Act, which came before the ECOA.
The way those laws are being applied by regulators and plaintiffs to systems that did not exist at the time they were drafted has changed. In a 2024 response to the Treasury Department, the Consumer Financial Protection Bureau stated unequivocally that consumer financial protection law does not make an exception for technology. The CFPB pointed out that courts have already ruled that using an algorithmic decision-making tool might be a policy that results in unequal effect liability. If a model produces biased results, the fact that it was created without any overt bias is not an excuse.
Important Information
| Field | Details |
|---|---|
| Core Issue | AI and machine learning models used in loan approvals can produce discriminatory outcomes by inheriting biases from historical training data — generating higher denial rates for protected groups even when race, gender, or other characteristics are not explicitly included |
| Primary Legal Frameworks | Equal Credit Opportunity Act (ECOA) — prohibits discrimination in credit on the basis of race, color, religion, national origin, sex, marital status, or age; Fair Housing Act (FHA) — prohibits discrimination in mortgage lending; Disparate Impact doctrine — legal liability arises when a neutral-seeming model disproportionately harms a protected group |
| CFPB Position | The CFPB stated in its August 2024 Treasury Department comment: “There are no exceptions to the federal consumer financial protection laws for new technologies” — courts have held that using algorithmic tools can itself constitute a policy that produces disparate impact liability |
| Adverse Action Notice Requirement | ECOA requires lenders to provide specific reasons for any loan denial; if an AI model cannot explain why it rejected an applicant, the lender is in violation of federal law regardless of the model’s technical sophistication |
| Massachusetts 2025 Settlement | Massachusetts Attorney General Andrea Joy Campbell settled with a student loan company in July 2025 over allegations that its AI underwriting model produced disparate impact against Black and Hispanic applicants; the case turned on a Cohort Default Rate factor — the average default rate associated with specific colleges — that the AG found correlated with race |
| Proxy Discrimination / Redlining 2.0 | Even when race is excluded, algorithms using ZIP codes, educational background, or shopping behavior can serve as proxies for protected characteristics, producing discriminatory outcomes through indirect means |
| CFPB Operational Status (2025) | CFPB operations were substantially disrupted in February 2025 under the Trump administration; the agency proposed in November 2025 to end the use of disparate impact analysis to enforce ECOA — a significant shift that consumer groups warn will reduce AI accountability precisely as lender AI use expands |
| Colorado SB 24-205 | Effective 2026 — requires developers and users of high-risk AI systems to use “reasonable care” to prevent discrimination; demands transparency and auditability |
| Regulatory Requirement: LDA Search | Regulators now expect lenders to actively search for “less discriminatory alternatives” — if a biased model is found, the lender must identify alternative models that are equally predictive but produce less discriminatory outcomes |
This is demonstrated in practice by the Massachusetts lawsuit that was settled in July 2025. The Cohort Default Rate, or the average loan default rate linked to particular colleges and institutions, was a variable in an AI underwriting model used by a student loan company. On its own, that factor sounds neutral. However, the model effectively penalized applicants based on where they attended school in a way that strongly correlated with race and immigration status because historically Black colleges and some institutions with higher proportions of minority students have higher average default rates due to systemic economic disadvantage.
Citing infractions of the ECOA and the state’s comparable fair lending laws, Massachusetts Attorney General Andrea Joy Campbell reached a settlement. It is a clear example of what regulators refer to as “proxy discrimination,” which is the use of data connected with protected characteristics to generate discriminatory results while preserving plausible deniability regarding intent.
The proxy discrimination issue and the adverse action notice issue coexist as separate legal risks. Since 1974, ECOA has mandated that lenders provide applicants with detailed explanations for loan refusal. The fact that a machine made the decision does not make meeting that condition any easier; on the contrary, it makes it more difficult.
The precise explanations required by the law are frequently not produced by complex machine learning models, such as those that evaluate hundreds of factors and give weights using procedures that are difficult to understand. In its January 2025 Supervisory Highlights, the CFPB reported that examiners had discovered institutions utilizing standardized checklist justifications that did not clearly and precisely explain why an individual applicant was rejected. That failure is a regulatory infringement in and of itself, regardless of whether intentional prejudice is found.
The changing federal regulatory framework is what truly complicates the current situation. Early in 2025, the Trump administration severely hampered the CFPB’s functioning. The agency then proposed in November 2025 to eliminate statistical disparate impact analysis as a tool for enforcing ECOA — a change that Bloomberg Law and consumer groups described as removing the primary mechanism by which AI lending discrimination can be detected, given that the models themselves are closely guarded trade secrets.
The bias within a black box remains inside the black box in the absence of outcome analysis. State attorneys general have taken a different stance since they are not constrained by changes in federal policy. Colorado’s SB 24-205, which goes into effect in 2026, demands openness and auditability in addition to “reasonable care” to prevent prejudice in high-risk AI systems.
Observing the differences between state and federal strategies gives the impression that the legal risk for lenders has simply shifted rather than diminished. For a while, federal enforcement might be more lenient. State enforcement is not, and a regulator is not necessary to initiate private litigation under the Fair Housing Act and ECOA.
The industry’s acceptance of the regulators’ “less discriminatory alternatives” methodology, which tests if an equally predictive model with less disparate impact exists, as a true compliance requirement or as a compliance checkbox is still up in the air. The answer to that question will have a significant impact on the course of the action over the coming years.
