AI Underwriting: Where Faster Credit Decisions Are Credible

Machine learning can shorten parts of a credit decision when identity, income and account data arrive in structured form. It does not guarantee an instant approval, a lower default rate or a fairer outcome. Those results depend on the product, applicant mix, model, operating controls and the evidence collected after deployment.

The useful question is therefore not whether "AI underwriting" is faster in the abstract. It is which steps can be automated safely, which applications should be referred to a person, and whether the lender can reproduce and explain every outcome. This article sets out that decision framework without treating vendor case studies as universal evidence.

The data advantage

Cash-flow data can add signals that a bureau file does not contain: income regularity, recurring commitments, returned payments and overdraft use. A simple illustration is two applicants with the same monthly income but different buffers after essential spending. That difference may be relevant, but only if the feature is lawful, stable, accurately categorised and demonstrably predictive for the lender's population.

Open-banking APIs can supply permissioned transaction histories. In the UK, the number of consumers and small businesses regularly using open banking passed ten million in 2024^[1]. That adoption statistic shows that the data rail exists; it does not show that any particular underwriting model is accurate. Lenders still need a lawful basis, clear consent or other applicable permissions, reliable transaction categorisation and a fallback for applicants who cannot or do not use the rail.

How the models actually work

There is no single model family that dominates every lender and product. The Bank of England and FCA survey of machine learning in UK financial services^[2] found ML used both to support lending decisions and as an input to automated retail underwriting. A lender might use a scorecard, gradient-boosted trees or another model, but the choice must be justified against predictive performance, stability, fairness, operational complexity and the ability to give accurate reasons.

In the United States, Regulation B requires specific principal reasons for adverse action^[3]. The requirement applies to the creditor's decision process, not to a particular model type: a generic score or post-hoc attribution chart is not enough if it does not accurately describe factors the creditor actually considered or scored.

The second unglamorous truth is that the algorithm is rarely the differentiator. Feature engineering, turning raw bank transactions into signals like days-in-overdraft per quarter, gambling-spend ratio, or income-source concentration, is where the proprietary value sits. Two lenders running the same algorithm over differently engineered features will write materially different loan books.

What the evidence shows so far

Vendor studies may report more approvals, lower pricing or faster decisions, but those are first-party results for a particular model and comparison set. They should be treated as hypotheses for a lender's own controlled test, not evidence that alternative data expands access for every group. A credible evaluation reports approval rate, loss and arrears outcomes, pricing, overrides and error rates by relevant customer segment over a stated period.

Models can also degrade when applicant behaviour or economic conditions move away from their training data. Monitoring should therefore cover input drift, calibration, approval and decline distributions, overrides, arrears, losses and customer outcomes. A challenger model can be useful, but it does not replace limits, human escalation and a tested rollback route.

The regulatory squeeze

The EU AI Act^[4] lists certain systems used to evaluate a natural person's creditworthiness or establish a credit score as high-risk, subject to the regulation's scope, qualifications and exceptions. Following the 2026 AI Omnibus, the core Annex III high-risk requirements apply from 2 December 2027; affected firms are preparing now rather than treating those duties as already operative. In the US, equal-credit and fair-lending obligations apply regardless of the technology. In the UK, the FCA's Consumer Duty^[5] focuses firms on customer outcomes. Product-specific legal advice is still required; "AI" is not a separate permission or exemption.

Where it spreads next

SME credit is a plausible use case because permissioned bank and accounting data can reduce document handling and support cash-flow analysis. Whether a facility is economic to automate depends on acquisition cost, expected loss, fraud, servicing cost, funding and margin; no universal loan-size threshold makes the model profitable.

Mortgages and other complex products add property, affordability, documentation and legal steps that a fast model score cannot remove. An "instant" agreement in principle should not be confused with completion of the full underwrite. The automation boundary should be defined per product and customer risk, not as an industry-wide destination.

What this means for incumbents

A bank can build, buy or combine components. A defensible rollout begins in shadow mode, freezes the comparison policy, records disagreements and overrides, and moves only bounded cohorts after pre-agreed outcome checks. Procurement must also cover data rights, model changes, incident handling, audit access and an exit path; outsourcing a score does not outsource accountability.

Where AI is landing across fraud, servicing and compliance is mapped in our evidence-led guide to AI in financial services in 2026. For underwriting, speed is a useful operating metric only after accuracy, fairness, explainability and customer outcomes are shown to hold.

Evidence standard. Industry-use claims were checked against the Bank of England/FCA survey; US adverse-action requirements against current Regulation B; EU classification and timing against the official AI Act and 2026 amending regulation; and UK outcomes expectations against the FCA. Vendor performance claims are intentionally not used as market-wide benchmarks.