Four regulators, no new law: the AI statement put the buyers of models on the hook

The week

On April 25, 2023, the heads of the Consumer Financial Protection Bureau, the Justice Department’s Civil Rights Division, the Equal Employment Opportunity Commission and the Federal Trade Commission issued a joint statement on enforcement against discrimination and bias in automated systems. It said existing legal authorities apply to automated systems and new technologies just as they apply to other practices, and that the agencies would use them. It named three sources of potential discrimination: unrepresentative or flawed data and datasets, model opacity and lack of access, and design and use that ignore the context in which a system is deployed. It cited earlier actions, including a 2022 CFPB circular on adverse action notices for complex models and EEOC technical assistance on AI in hiring under the Americans with Disabilities Act. In January 2023 the Justice Department and HUD had filed a statement of interest in a tenant screening case.

Public discussion of AI regulation in spring 2023 looked ahead, to the EU’s AI Act and to possible US legislation. The joint statement looked at the present and said something narrower and more useful. Credit, employment, housing and consumer protection law already applied, and none of it had an exemption for decisions made with a purchased model. Most banks, health systems, employers and agencies do not build the models they use. They buy them inside screening services, hiring platforms and decision engines. The statement therefore landed hardest on buyers. Its own three sources of risk mark out what a buyer has to own: the data, the opacity and the use.

The data

Historical data can carry past discrimination into future decisions. A model trained on past lending, hiring or tenant screening outcomes can learn patterns that disadvantage protected groups without ever seeing a protected characteristic. Location, gaps in employment history, eviction filings and certain consumer behaviors can act as proxies.

Lenders had tested for disparate impact for years, under fair lending examinations and their own compliance programs. The method is established. Compare outcomes across groups, identify which variables drive any disparity, and look for a less discriminatory alternative that serves the same legitimate purpose. Employers using hiring tools, landlords using screening services and insurers using pricing models were often newer to it.

The harder problem for a buyer is access. A vendor may report that its model was tested for bias on its own client base. That says little about outcomes for the buyer’s applicants, in the buyer’s markets, at the buyer’s cut-off scores. The useful contract terms are specific. The buyer needs decision-level outputs and the inputs behind them. It needs the right to run its own disparity testing or commission it independently. And it needs the vendor’s commitment to support a search for alternatives if a disparity appears. Without those terms, the organization holds the legal exposure and the vendor holds the evidence.

The opacity

Complex models are hard to explain, sometimes even for their developers. That creates two problems. Internally, it is harder to see whether a model treats groups unfairly. Externally, it collides with legal duties to explain individual decisions.

Credit shows this most clearly. Under the Equal Credit Opportunity Act and Regulation B, a creditor that takes adverse action must state the specific principal reasons. The CFPB’s 2022 circular said complexity does not excuse that duty. A lender that cannot identify why a model declined an applicant should not use the model for that decision. Employment has a parallel. An applicant cannot ask for a reasonable accommodation under the ADA for an assessment whose nature and scoring nobody has explained.

For buyers, opacity is partly a procurement choice. Before signing, a compliance team can ask the vendor to produce reason codes for a sample of real declines and check whether those reasons would mean anything to an applicant. It can ask whether the model changes after deployment, how the buyer is told, and whether reason codes are revalidated after each change. A model that retrains silently can make last quarter’s validation meaningless. A short validation memo for each version, kept with the model inventory, gives examiners and plaintiffs’ counsel the same answer.

The use

A model sound in one setting can harm in another. A tool validated on one population may perform poorly on another. A screening score meant as one input can become a hard cut-off in practice, which magnifies its errors. A system designed without considering people with disabilities can exclude them before any human sees the application.

These are decisions the deploying organization makes, often without noticing. A vendor sells a score. The buyer chooses the threshold, decides whether a person reviews borderline cases, and decides whether applicants can ask for reconsideration or an alternative assessment. Each choice changes legal exposure. A threshold set to cut review workload by half may also double the disparity.

The controls belong with the business owner of the decision, supported by compliance and technology. Document the intended use and the population the model was validated on. Record who set each threshold and why. Define which cases get human review and check that reviewers do more than confirm the score. Monitor approval and rejection rates by group after launch, at a set interval. Publish a route for applicants to request review or accommodation, and track how often it is used.

The statement also changed the division of labor inside organizations. AI governance had often sat with data science or innovation teams. The statement placed it inside compliance programs that already handled fair lending, equal employment and consumer protection. Those programs had testing methods, examination experience and counsel. They often lacked an inventory of where models made or shaped decisions, and building that inventory became the first concrete task.

With hindsight

In April 2024 more agencies, including HUD, the Labor Department and HHS, joined an updated version of the statement. The CFPB followed its 2022 circular with another in September 2023, saying lenders using complex models must give accurate and specific reasons, not generic checklist items. Enforcement then diverged. The October 2023 executive order on AI was revoked in January 2025, and an April 2025 executive order directed federal agencies to deprioritize disparate-impact enforcement. States stepped in. In July 2025 the Massachusetts attorney general announced a $2.5 million settlement with a student lender over AI underwriting models it said could produce disparate harm, with required model governance and testing. Colorado enacted a high-risk AI law in 2024, then delayed it and moved in 2026 to narrow it. The statutes the statement relied on did not change, and private litigation continued under them.