CNIL, Deliberation No. 2026-047 of 2 April 2026: Recommendation on creditworthiness assessment in the granting of credit (published 7 May 2026)
🔑 Key Takeaways
- The recommendation repeals single authorisation AU-005 of 9 July 2008, which had lapsed since the GDPR.
- It is addressed to all private bodies that grant credit, as well as to intermediaries in banking transactions and payment services.
- It covers consumer credit and mortgage credit governed by the Consumer Code (code de la consommation).
- The principle of data minimisation is reaffirmed: only relevant and strictly necessary data may be processed.
- Retention periods are strictly regulated, including for past contractual defaults (repayment incidents).
- Drawing on the SCHUFA judgment (CJEU, 7 December 2023, C-634/21) and on C-203/22, the recommendation establishes that scoring constitutes an automated decision where it plays a determining role, giving rise to the right to an explanation.
- It anticipates the entry into force in November 2026 of a statutory authorisation for fully automated decisions in consumer credit, recalling the associated safeguards: transparency, human intervention, explainability.
- For borrowers: new levers in the event of a credit refusal (request for a detailed explanation, challenge, request for human review).
Table of Contents ▼
- Why is this recommendation coming now?
- Who is covered by the recommendation?
- What are the main contributions?
- Minimisation of the data processed
- Regulation of past repayment incidents
- Retention periods
- What does the recommendation change on scoring?
- The decisive contribution of the SCHUFA judgment
- The right to an explanation enshrined
- How is the November 2026 generalisation of automated decisions being prepared?
- The three associated safeguards
- The right to human review
- What new levers do borrowers have?
- In the event of a credit refusal
- For people registered on the FICP
- What should you do in practice?
- FAQ: Frequently Asked Questions
Why is this recommendation coming now?
Assessing the creditworthiness of credit applicants is an intimate mechanism of the financial system: in a few seconds, an algorithm ranks a credit applicant, accepts or refuses, proposes a rate, sets a guarantee. And behind these decisions, dozens of variables (income, expenses, repayment history, Banque de France registration, sometimes behavioural data) are collected, processed, and sometimes resold. For the applicant, the process is largely opaque: she does not know which data are used, how they are weighted, or why her application was accepted or refused.
In 2008, the CNIL regulated these practices through a single authorisation (AU-005), which is now outdated. The GDPR coming into application in 2018, the generalisation of artificial intelligence techniques in scoring and, above all, the case law of the Court of Justice of the European Union made an update indispensable. That is the mission the CNIL set itself in May 2025 by opening a public consultation on a draft recommendation. The final version, adopted on 2 April 2026 and published on 7 May 2026, stabilises the framework.
For borrowers, the stakes are immediate: although this recommendation is not “prescriptive” in the strict sense, it is the interpretive standard the CNIL will apply in its future inspections and that courts hearing credit disputes will take into account. Any departure by an institution from these guidelines will have to be justified.
Who is covered by the recommendation?
The scope is broad:
- All private bodies that grant credit: banks, specialised credit institutions, finance companies, captive financing arms of car manufacturers, online platforms.
- Intermediaries in banking transactions and payment services: brokers, agents, comparison sites with a transactional dimension.
- The material scope covers consumer credit and mortgage credit governed by the Consumer Code. Excluded at this stage: purely professional credit and interbank transactions.
Creditworthiness assessment is the operation by which the lender checks the applicant’s ability to repay the credit requested. It is imposed by the Consumer Code (Articles L. 312-16 for consumer credit and L. 313-16 for mortgage credit) and is a positive obligation of the lender. Failure to comply opens, in the event of the borrower’s later default, an action in liability against the bank for failure to warn or for unreasonable granting of credit.
What are the main contributions?
Minimisation of the data processed
The first pillar, in line with Article 5.1.c of the GDPR: lenders may collect and process only the data that are “relevant and strictly necessary” for the creditworthiness assessment. The recommendation identifies in detail the admissible categories of data: identity, family and professional situation, income, recurring expenses, assets, and repayment history on previous credits.
So-called “sensitive” data within the meaning of Article 9 of the GDPR (origin, political opinions, health status, etc.) are in principle excluded, save for a very limited exception. Behavioural data drawn from open banking (detailed analysis of account statements) are admissible but within a strict framework: information of the individual, limited purpose, short retention period.
Regulation of past repayment incidents
Institutions may take into account the applicant’s past contractual defaults, for example repayment incidents on previous credits. But the recommendation regulates how this is done:
- The data used must be objective (amount, date, duration of the incident, any remedying of it) and not merely declaratory or interpretive.
- The information given to the individual about the use made of these data and their weight in the assessment must be strengthened.
- The seriousness of the incident and the applicant’s overall risk profile must be taken into account proportionately: an old, isolated incident cannot be treated as a systemic default.
This last point, added to the final version after the public consultation, is important: it opens a ground of challenge for borrowers whose credit application would be refused on the basis of an old, minor or fully remedied incident.
Retention periods
The recommendation specifies the maximum retention periods applicable to the data collected for the credit application and to those relating to past contractual defaults. The general rule is that these data may not be kept beyond what is strictly necessary for the purpose pursued. The final version introduced an important nuance: the possibility of keeping certain data for evidential purposes in the event of litigation, in specific archiving and with restricted access.
What does the recommendation change on scoring?
The decisive contribution of the SCHUFA judgment
The recommendation is a direct extension of two decisive judgments of the Court of Justice of the European Union:
- CJEU, 7 December 2023, SCHUFA, C-634/21: the Court holds that automated scoring constitutes an “automated individual decision” within the meaning of Article 22 of the GDPR where it plays a determining role in the final decision to grant credit. Consequence: the individual has, on that basis, the right to human intervention, the right to express her point of view, and the right to challenge the decision.
- CJEU, 2024, C-203/22: establishes, as a follow-on, a right to an explanation of how the mechanism that led to the decision works; this explanation must be precise enough to enable the individual to understand and, where appropriate, to challenge.
The CNIL transposes these principles by recommending that any scoring system playing a determining role in the granting or refusal of credit be accompanied by:
- Clear information given to the individual on the use of scoring and its consequences.
- An effective possibility of human intervention enabling the decision to be reviewed.
- Explainability of the result: the individual must be able to obtain the main factors that led to the score applied and to the refusal, in understandable language.
The right to an explanation enshrined
The right to an explanation is the right of any person who has been subject to an automated decision to obtain meaningful information about the logic underlying that decision, as well as its significance and consequences. It derives directly from Articles 22 and 15 of the GDPR. The CNIL’s recommendation specifies its operational content: the main factors that influenced the score, the relative importance of each of these factors, an explanation in plain language. It is one of the most powerful rights of the GDPR, and one of the least exercised in practice.
This right to an explanation fundamentally changes the situation for people facing a credit refusal. Until now, the lender’s standard answer was a generic formula such as “your application does not meet our risk policy”. That formula is no longer enough. A refused applicant can now demand, on the basis of the GDPR read in the light of the SCHUFA case law and the CNIL’s recommendation, concrete information on the factors that led to the refusal.
How is the November 2026 generalisation of automated decisions being prepared?
The recommendation anticipates a major legislative development: the coming into application, in November 2026, of a specific statutory authorisation for fully automated decisions in consumer credit. This development answers a strong demand from the sector, which wishes to industrialise the processing of small-credit applications without systematic human intervention.
Moving to fully automated decisions is legally admissible only if Article 22 of the GDPR is complied with. The new French statutory authorisation will provide a basis for this processing, but it does not reduce the safeguards: it merely frames them explicitly.
The three associated safeguards
Whatever the degree of automation, three safeguards are mandatory:
1. Transparency
The institution must inform the applicant, before the decision and at the time it is made, of the automated nature of the processing, the data used, and the general logic applied.
2. Human intervention
The individual must be able to obtain, on request, a review of her application by a human operator empowered to amend or confirm the decision. This review is not a mere formal check: the human must be able to genuinely resume the analysis, take into account contextual elements not entered into the algorithm, and rule on that basis.
3. Explainability
The outcome of the automated decision must be capable of being explained in terms accessible to the person concerned. In practice, this means the institution must have technical tools enabling it to extract the explanatory factors of each individual decision, including where the scoring relies on complex models (random forests, neural networks, gradient boosting).
The right to human review
The right to human review is, in practice, a powerful lever. It allows the refused individual to reopen the file within a formal framework, by submitting additional documents (updated proof of income, explanations of an isolated incident, an employer’s certificate confirming job stability). The review must result in a reasoned decision, which may, where appropriate, overturn the initial refusal.
What new levers do borrowers have?
In the event of a credit refusal
For anyone facing a credit refusal after May 2026, several steps are now within reach:
- Ask in writing for the detailed reasons for the refusal: on the basis of Article 15 of the GDPR and the CNIL recommendation, the institution must provide the main factors that led to the decision. A purely boilerplate reply is insufficient.
- Ask which data were used: income taken into account, expenses taken into account, score assigned, external data consulted (FICP, FCC, scoring by third-party bodies).
- Ask for human review: if the decision rests on an automated system playing a determining role, the individual has the right to review by a human operator.
- In the event of a deadlock: refer the matter to the CNIL (simplified complaint procedure), or bring a liability action against the institution (compensation for the loss arising from an unreasoned refusal or from non-compliant processing).
For people registered on the FICP
The recommendation pays particular attention to the national file of household credit repayment incidents (Fichier national des incidents de remboursement des crédits aux particuliers, FICP), which is one of the main sources of complaints to the CNIL. For registered individuals:
- The right of access and rectification must be effective (the Banque de France manages the file; the reporting institution must be able to justify the report).
- An old, isolated or remedied registration cannot be treated by lenders as an automatic systemic default.
- A credit refusal based solely on FICP registration is not, in itself, unlawful; but it must be reasoned and the applicant must be able to understand the weighting applied to it.
What should you do in practice?
For borrowers and their advisers alike, the CNIL’s recommendation offers a valuable operational framework. Three reflexes:
1. Document every refused credit application in writing
Keep the refusal letter or email, and immediately request by registered letter the detailed reasons and the factors that led to the decision. The recommendation requires the institution to reply substantively.
2. Exercise your GDPR rights precisely
Article 15 (right of access) and Article 22 (automated decisions) are the bases to rely on. A generic request such as “What data do you hold on me?” is less effective than a targeted one: “Please provide me, pursuant to Article 15 GDPR and in accordance with CNIL recommendation No. 2026-047 of 2 April 2026, with the main factors that led to the refusal of my application, the weighting assigned to them, and the identity of any external data consulted”.
3. Combine the GDPR and the Consumer Code
The GDPR opens new levers that can be combined with the classic obligations of the Consumer Code (creditworthiness assessment, duty to warn, fair and clear information). This combination is particularly powerful in disputes over unreasonable granting of credit: showing that the bank used irrelevant or outdated data to underpin a credit doomed to fail strengthens the characterisation of a breach.
Conclusion
The CNIL’s recommendation of 7 May 2026 marks an important step in the professionalisation of bank scoring and in the protection of credit applicants. By enshrining the right to an explanation, regulating automated decisions and requiring the possibility of human review, it gives refused individuals concrete levers to understand and, where appropriate, challenge the decisions taken against them.
The firm, which regularly defends borrowers facing obscure credit refusals, contestable FICP registrations or unreasonable granting of credit, is already building this new reference framework into its case preparation. The combination of GDPR tools (right of access, right to an explanation, action to stop processing) with the classic bases of the Consumer Code (duty to warn, assessment obligation, unreasonable granting of credit) opens a particularly rich field of argument.
If you have suffered a credit refusal that you consider unjustified, if you are registered on the FICP in a contested manner, or if you have been the victim of a credit grant that the bank should never have made given your situation, do not hesitate to take stock with an attorney. The range of available courses of action is wider than one might think, and it has been enriched further by this recommendation.
