Governance for automated decisions
Build and run automated credit decisions in Decisimo. Policy versions and tests are recorded as you work, so they are easy to review for DORA and the EU AI Act.
Rules that apply and when
Three rules set out what a lender needs to show. DORA and GDPR Article 22 apply now.
DORA since 17 January 2025
DORA has applied to EU financial entities and their ICT providers since 17 January 2025. It calls for managed ICT risk, documented arrangements, resilience testing and an exit strategy for critical ICT providers.
GDPR Article 22 applies now
For a solely automated decision with legal or similarly significant effects, a person can seek human intervention and a meaningful explanation. This is settled for credit scoring.
EU AI Act from 2 December 2027
Creditworthiness assessment of a person and risk pricing in life and health insurance are high-risk uses under Annex III. The rules apply to the deployer from 2 December 2027.
What you need to show in Decisimo
Each row is part of normal work, so you have the records for a review as you go.
| What you need to show | Where Decisimo keeps it |
|---|---|
| Policy documentation | Every version of your decision logic has its revision history. Releases are snapshots with generated notes, and policy documents link to the requirements they produced. |
| Decision records | Execution traces go to infrastructure you control. Decisimo’s audit log records who took each portal action, when and from which IP address. |
| Human approval | An endpoint can carry a sign-off sequence, and Decisimo computes release diffs. A person accepts each AI proposal against a visible diff, one change at a time. |
| Explaining a decision | The trace shows which rules fired and what data they used, against the version live at the time. You can read it months later, without a developer. |
| Testing the policy | Unit tests and regression suites from real runs sit alongside impact analysis. You can compare a champion and challenger, and check a decision table for overlaps and gaps. |
| Access control | Role-based access, single sign-on, two-factor authentication and IP restrictions are on every plan. Credentials sit in an encrypted vault. See security controls |
Leaving and your DORA exit plan
DORA calls for an exit strategy for critical providers. These four facts give you a short plan.
- Decision results go to your own Postgres database, so the history is already yours.
- Decision logic exports as a readable Markdown file.
- Execution runs on regional endpoints, or on request on a node inside your own infrastructure.
- REST and JSON carry data in and out, and bureau credentials point to your own contracts.
Questions we get asked
Who is responsible for meeting DORA and EU AI Act rules when we use Decisimo?
Meeting the rules remains your responsibility. Decisimo keeps policy versions, test results, approvals and portal audit records as you work.
Are we or Decisimo the deployer under the EU AI Act?
The lender is usually the deployer. You set the policy, thresholds and models, then put the decision into service for your customers.
Can I explain a decision from months ago without an engineer?
The trace shows which rules fired, the values they used and the exact logic version live at the time. That version remains readable.
Does Decisimo train models on our data?
Customer data is never used to train models. Execution data passes through to make a decision and is not kept.
What standard does Decisimo work to, and is there an AI Act certification for vendors?
Decisimo’s information security is run to ISO 27001, the international standard for managing information security. There is no AI Act certification for a vendor to hold. See security
Try your policy in Decisimo
Build your own policy and see its versions, tests and approvals recorded as you work.
This page describes what the platform produces. It is not legal advice, and it is not a statement that using Decisimo satisfies your obligations under any regulation. Your compliance assessment remains yours to make.