Skip to content

CASE STUDY BASED ON A PUBLICLY REPORTED CASE

2025A European data-protection authority
Publicly reported case

An automated credit decision that could not explain itself.

This scenario is inspired by a publicly reported 2025 case in Europe. A financial-services provider used automated, algorithm-based decisions to assess credit-card applications. Some applicants with good credit histories were rejected without human involvement, and when they asked why, they did not receive a meaningful explanation. The case led to regulatory action. We do not name the organisation.

What we did: we recreated the scenario as a fictional project, with our own requirements and user stories, and ran it through the DutAIx Requirements module.

We do not claim the provider used AI. The published facts describe automated, algorithm-based decisions; we assume AI could have been in scope. This is not an assurance that the incident would have been prevented and is not legal advice.

WHAT THE LAB IDENTIFIED IN THE RECREATED PROJECT

These findings relate to our fictional project, not to the organisation in the real case.

Acts and gaps.

4stories assessed22applicable now13story-level duties9project-level duties

GDPR

EU AI Act

Executed the Requirements module only for this case study. Design, Build and QA modules were not run.

THE REPORT RETURNED

The actual report.

Inside the report

  • Gaps identified against each submitted story
  • Suggested changes and acceptance details for review
  • 13 story-level + 9 project-level duties, with acts
  • Audit trail and evidence record
Cover of the Requirements assessment PDFPDF · 12 PAGES
Open the report

Requirements only · 4 stories · Version 1.

The PDF is advisory and not a legal opinion or compliance certificate.

SEE THE PLATFORM IN PRACTICE

Inspect the evidence.
Ask the next question.

See how the platform supports a practical review in a walkthrough.

Request a walkthrough