The following scenario is a composite illustration drawn from patterns documented across multiple fair-lending examinations; the figures used are illustrative and do not reflect a specific institution or examination. The fair-lending examination had been on the calendar for six weeks when the bank's model-risk officer finally ran the outcomes analysis on the AI underwriting tool. The model used no demographic data. Race, color, national origin, sex, marital status, and the other protected classes defined by the Equal Credit Opportunity Act (ECOA, the federal statute prohibiting credit discrimination in any aspect of a credit transaction on the basis of race, color, religion, national origin, sex, marital status, age, or receipt of public assistance) and the Fair Housing Act were nowhere in the model's feature set. The compliance team had reviewed the inputs at deployment and concluded the model was clean. The outcomes analysis told a different story. Approval rates for Black-owned small businesses were 23 percentage points lower than for similarly qualified white-owned businesses in this illustrative scenario. The model's top predictive features included three variables that an outside consultant, called in the week before the exam, identified as correlated with race in the bank's lending geography: a minimum-account-tenure requirement, a requirement that applicants have a deposit relationship at the institution, and a geographic concentration score based on the bank's existing customer network. None of these variables mentioned race. All three were proxies for it. The model had learned to replicate, through facially neutral features, the same geographic concentration of credit that would have been identified as redlining if done deliberately. The examination was not quiet.

From Inputs to Outcomes: The Critical Shift

The history of fair-lending compliance in lending is a history of input audits. Banks learned to keep race and the other protected classes out of their credit models, policies, and processes. That discipline was necessary and is still required. But it is not sufficient, because disparate impact (the legal doctrine, central to fair lending under ECOA and the Fair Housing Act, holding that a facially neutral policy or practice that produces statistically significant disparate outcomes for a protected class is unlawful unless justified by business necessity with no less discriminatory alternative) does not require discriminatory intent. It requires only a discriminatory outcome.

An AI underwriting model that uses no demographic inputs can still produce demographic outcomes. It can do this through proxy variables (features that are correlated with protected-class status in the lending geography, such that the model's use of the feature produces the same disparity it would if it used the protected characteristic directly), through learned patterns in historical training data that reflected prior discriminatory practices, or through objective features that have differential impact on protected groups without a sufficient business justification. The move from input review to outcomes testing is not a compliance upgrade. It is the shift from asking "did we discriminate?" to asking "did discrimination occur?" Those questions do not always have the same answer.

For AI models, the outcomes question is more important and more difficult than it was for traditional credit scoring. A traditional logistic regression credit score has a defined feature set and defined coefficients that can be reviewed for proxy risk by a trained analyst. A gradient-boosted ensemble or a neural network trained on thousands of features learns complex, nonlinear relationships among variables that are not interpretable through coefficient inspection. The proxy risk is embedded in the learned relationships, not in a stated coefficient, and it may not be visible until outcomes are measured across protected classes at the population level.

This is why the outcomes analysis described in the opening story revealed what the input review missed. The input review confirmed the model's feature list contained no protected-class variables. The outcomes analysis found the model's feature combination produced a protected-class disparity. Both statements were true at the same time. Effective bias detection in practice requires testing both, and the outcomes test is the one that tells you what the model is actually doing to real borrowers.

A model's inputs tell you what it was designed to ignore. A model's outcomes tell you what it learned to do anyway. Bias detection that stops at inputs has not finished the job.

The Disparate-Impact Testing Workflow

Disparate-impact testing is not a one-time activity conducted at model deployment. OCC Bulletin 2026-13 (the April 2026 interagency model-risk update issued by the Office of the Comptroller of the Currency (OCC), the Federal Reserve, and the Federal Deposit Insurance Corporation (FDIC), superseding OCC Bulletin 2011-12 and explicitly pulling AI and generative AI (GenAI) under model-risk, fair-lending, third-party, and board-governance expectations) requires that fair-lending testing be integrated into the model-risk framework as an ongoing monitoring obligation. A bank that tested for disparate impact at deployment and has not tested again since does not have a disparate-impact testing program. It has a deployment-time snapshot.

A functioning disparate-impact testing workflow for an AI credit model has four phases that run on a cycle tied to the model's output volume and risk rating.

Phase one: data collection and aggregation. The testing workflow requires loan-level outcome data that includes the model's decision or recommendation, the demographic characteristics of the applicant (obtained through government monitoring data, Bayesian Improved Surname Geocoding (BISG), or similar methodologies, never through asking applicants their race in the credit context), and the relevant credit quality variables that will be used to construct the comparator groups. The data must cover a sufficient time period and volume to produce statistically meaningful results. For a high-volume consumer lending model, monthly testing on rolling 90-day windows may be appropriate. For a lower-volume commercial lending model, quarterly or semi-annual testing on a larger rolling window may be more appropriate. The right cycle depends on the model's volume, the risk rating, and the regulatory environment.

Phase two: comparator group construction. The core of a disparate-impact test is comparing the approval rates (or denial rates, or pricing outcomes) for protected-class applicants against the rates for similarly situated non-protected-class applicants. "Similarly situated" is the critical modifier. The comparison cannot be raw approval rates across the applicant pool, because the applicant pool for protected and non-protected classes may differ in meaningful ways that reflect legitimate credit quality differences. The comparator group construction must control for legitimate credit quality variables: credit score bands, income ranges, requested loan amount ranges, and loan-to-value ranges. The comparison is within-band: within a given credit quality stratum, what are the approval rates for protected versus non-protected applicants? A disparity that persists after controlling for legitimate credit quality variables is the evidence of disparate impact.

Phase three: statistical significance assessment. Not every difference in approval rates between demographic groups constitutes legally significant disparate impact. Statistical significance matters: a 2-percentage-point difference in approval rates in a sample of 47 applications may be random variation. A 2-percentage-point difference in a sample of 20,000 applications is likely not. The standard tests for statistical significance in fair-lending analysis are the Z-test for differences in proportions (comparing approval rates across groups), the chi-square test for independence (testing whether approval outcomes are independent of protected-class membership), and Fisher's exact test for small samples. The choice among these depends on the sample size and the specific statistical hypothesis being tested. The results of the significance test determine whether the observed disparity warrants investigation and remediation or falls within expected random variation.

Phase four: escalation and remediation. When statistically significant disparate impact is identified, the finding triggers a formal remediation process. The remediation process begins with an investigation of the disparity's source: which features or feature combinations are driving the outcome difference? This requires the explainability tools described in the preceding chapter. The investigation produces a finding about the proximate cause of the disparity, which determines the remediation approach. If the disparity is driven by proxy variables that lack sufficient business justification, the remediation is model modification or proxy-variable removal. If the disparity is driven by a policy threshold that has a less discriminatory alternative, the remediation is a policy change. The remediation must be documented with the same rigor as the finding. An institution that identifies a disparity, investigates it, and remediates it has done what the regulation requires. An institution that identifies a disparity and takes no action has not.

Proxy Variable Identification in Practice

A proxy variable is a model feature that is correlated with a protected characteristic in the lending geography, such that the model's use of the feature produces a protected-class disparity even in the absence of the protected characteristic itself. Proxy variable identification is the analytical step that connects an outcome disparity (the model is denying Black applicants at a higher rate within a given credit quality stratum) to a specific feature or feature combination (the account-tenure requirement and the geographic concentration score are the primary drivers of the disparity).

The challenge of proxy variable identification in AI models is that the proxy risk may not be visible in any single feature. Modern machine learning models learn interactions among features. A feature that is not independently a proxy for race may become a proxy when combined with two or three other features in a specific interaction that the model has learned. The opening story illustrates this: no single feature of the three (account tenure, deposit relationship requirement, geographic concentration score) was independently a reliable proxy for race. Their combination in the model's learned decision function produced the disparity. Identifying this type of interaction-level proxy requires going beyond feature importance scores to look at the relationship between feature combinations and protected-class outcomes.

The practical toolkit for proxy variable identification at the practitioner level includes three methods.

Correlation analysis. For each feature in the model's feature set, calculate the correlation between that feature's values and the protected-class variable (using BISG or geocoding to estimate protected-class membership where direct demographic data is not available for non-HMDA applications). Features with material correlation to the protected-class variable are candidate proxies. The correlation analysis does not prove that a feature is driving the disparity, but it identifies the candidates for further investigation. A feature with a Spearman rank correlation greater than 0.3 with a protected-class variable deserves investigation; a feature with correlation greater than 0.5 is a strong candidate proxy.

Conditional analysis (the "remove and retest" approach). For candidate proxy variables identified through correlation analysis, test whether removing the variable from the model (or replacing it with a less discriminatory alternative) reduces or eliminates the outcome disparity. This is the "remove and retest" approach. If removing a feature substantially reduces the disparity, the feature is likely a significant driver of the proxy risk. The remove-and-retest approach requires model re-estimation or simulation, which requires cooperation with the model development team or the vendor. For vendor models where the feature set is not adjustable, this approach may be approximated through conditional regression analysis of the outcomes data rather than through model re-estimation.

Geographic disparity analysis. Geographic features are among the most common proxy variables in lending AI models, because residential and commercial geography in many American cities correlates strongly with race, reflecting decades of segregated housing patterns and concentrated lending. A geographic feature (census tract designation, zip code cluster, distance from branch) that is legitimate as a credit quality indicator in some geographies may be a proxy in others. Geographic disparity analysis plots approval rates by geography and overlays protected-class demographic composition by geography to identify whether the model's geographic features are producing geographically concentrated denials in areas of high protected-class concentration. This analysis is a standard fair-lending examination tool and should be part of the institution's ongoing monitoring.

The Less-Discriminatory-Alternative Search

Identifying a proxy variable and documenting a disparity is the first half of the fair-lending compliance analysis. The second half is the less-discriminatory-alternative (LDA) search. Under the disparate-impact doctrine as applied in fair lending, a facially neutral practice that produces a statistically significant disparity may be permissible if it is justified by a legitimate business necessity. But even a practice justified by business necessity is required to be replaced if a less discriminatory alternative exists that serves the same business purpose with a materially smaller disparate impact. The LDA search is the process of identifying and testing whether any such alternative exists.

The LDA search has three components.

Business necessity justification. For each proxy feature identified as a disparity driver, document the business justification for the feature's use in the model. Account tenure may be justified as a proxy for account-holder stability and relationship depth. A deposit-relationship requirement may be justified as reducing default risk (existing customers default at lower rates at some institutions). The business necessity justification must be specific and documented. "We have always required this" is not a business necessity justification. "Our historical data shows a 40 percent reduction in 90-day delinquency rates for borrowers with 24-plus months of account tenure" is a business necessity justification, provided the data is current and the relationship holds in the current portfolio.

Alternative feature testing. For each proxy feature with a documented business necessity, identify and test alternative features that could serve the same business purpose with a smaller disparate impact. If account tenure is justified as a predictor of repayment stability, test whether other repayment stability indicators (payment history on existing obligations, cash flow consistency over a 12-month period, relationship tenure at any financial institution rather than specifically at this bank) produce comparable predictive performance with a smaller disparity. The testing requires access to the model development infrastructure and historical loan performance data. The result is a comparison of the business necessity metric (for example, model discrimination performance, measured as the area under the ROC curve) and the disparate-impact metric for the original feature versus the alternative.

Documentation and decision. The LDA search must be documented regardless of its outcome. If the search finds a less discriminatory alternative that produces comparable business performance, the institution must implement the alternative or document a specific, defensible reason why it cannot. If the search finds that no less discriminatory alternative exists (every tested alternative produces a substantially larger reduction in predictive performance than the reduction in disparate impact justifies), that finding must be documented with the testing methodology and results. The documentation of the LDA search is what an examiner looks at when a disparity is found. An institution that can produce a well-documented LDA search showing a diligent effort to find alternatives is in a materially better position than one that identified a disparity and took no action, or one that took action but did not document the process.

Under OCC 2026-13, the LDA documentation is specifically required to appear in the model's risk file, not only in the compliance team's records. The practical consequence is that the model risk management function must be aware of and involved in the fair-lending testing and LDA process, not just the compliance or fair-lending team operating independently. A compliance officer who conducts a thorough LDA analysis but does not route the results through the model-risk governance structure is not satisfying the 2026-13 framework.

Bias in Generative AI Outputs

The discussion to this point has focused on predictive AI models in credit decisioning, where bias detection is a statistical analysis of outcomes across a population of decisions. Generative AI (GenAI) outputs in lending create a different but related bias risk: outputs that are differentially accurate, differentially favorable, or differentially compliant for protected-class applicants.

Three GenAI bias failure modes appear in banking contexts.

Adverse-action reason accuracy bias. As described in the preceding lesson on catching hallucinations in financial output, AI tools that generate adverse-action reason codes may produce systematically different reason codes for protected-class applicants even when the underlying decision factors are the same as for non-protected-class applicants. If an AI adverse-action tool generates "insufficient income" at a higher rate for minority applicants than for similarly situated non-minority applicants when the actual decision was driven by collateral value for both groups, the inaccurate reason codes are both a Regulation B (Reg B, the federal regulation implementing ECOA, codified at 12 CFR Part 1002, requiring accurate adverse-action notices and prohibiting credit discrimination in all aspects of a credit transaction) compliance violation and a disparate-impact finding. The detection method is the same as for predictive model bias: audit the outputs at the population level, comparing reason code distributions for protected versus non-protected applicants controlling for actual decision factors.

Borrower communication quality bias. AI tools used to generate borrower communications (loan status notifications, adverse-action letters, product offers, follow-up communications) may produce differentially detailed, clear, or favorable communications for protected-class applicants. A tool that generates less complete adverse-action explanations for minority applicants, or that generates product-offer communications with less advantageous terms for one demographic group, produces a disparate-impact outcome even if no credit decision was involved. The detection method for this type of bias is systematic review: comparing communication content across demographic groups, controlled for the communication trigger (same decision, same product, same circumstance). This is an auditing function rather than a statistical modeling function, but it requires the same structured, outcome-focused methodology as statistical bias testing.

Summarization and extraction bias. AI tools used to extract data from loan application documents or to summarize borrower narratives may produce differentially accurate outputs for protected-class applicants. If an income extraction tool produces more conservative (lower) income estimates for minority applicants' Schedule C than for similarly structured non-minority applicants' Schedule C, the systematic extraction bias creates a credit-decisioning disparity even if the credit decision model itself is unbiased. This type of bias is difficult to detect without a systematic audit of extraction accuracy across demographic groups, comparing the AI-extracted figure against the manually verified figure for a random sample of applications stratified by demographics.

Building a Bias Monitoring Program

Bias detection as a one-time or point-in-time activity provides a snapshot; bias monitoring provides a program. The difference matters under OCC 2026-13, which requires ongoing monitoring of AI model outcomes for fair-lending risk as part of the model's post-deployment performance monitoring. A bias monitoring program has four structural elements.

A regular testing cadence. The testing cadence should be matched to the model's output volume and the velocity of any model changes. A high-volume consumer lending AI model serving 5,000 applications per month should be tested monthly or quarterly. A lower-volume commercial lending model may warrant semi-annual testing if the volume is insufficient for monthly statistical significance. Vendor models that update automatically or periodically require testing after each material update because the model change may alter the bias profile even if the feature set appears unchanged. The testing cadence is documented in the model's risk file and triggers are specified for out-of-cycle testing (a material model change, a significant change in the applicant pool demographics, or an internal finding of a potential bias issue).

A documented threshold for escalation. The bias monitoring program must specify the statistical threshold at which a finding is escalated for investigation. This threshold is typically stated as a specific disparity ratio (for example, a ratio of protected-class approval rate to non-protected-class approval rate below 0.80, sometimes called the "four-fifths rule" or "80 percent rule" borrowed from employment discrimination law) or as a specific p-value for the statistical significance test. The threshold should be set conservatively enough to catch emerging disparities before they become large but not so sensitive that normal statistical variation triggers constant false alarms. A well-designed monitoring program will have different thresholds for different levels of response: a yellow-alert threshold that triggers enhanced monitoring and investigation, and a red-alert threshold that triggers mandatory remediation.

Attribution and root-cause analysis. When a finding is escalated, the program must have a defined process for attributing the disparity to specific model features or data patterns. This is the proxy variable identification step described above, integrated into the monitoring program rather than conducted ad hoc when a disparity is discovered. The attribution analysis is what allows the remediation to be targeted and effective. A remediation that reduces the overall disparity without understanding its source is fragile: the disparity may re-emerge as the model's population or the applicant pool shifts.

Board and senior management reporting. OCC 2026-13 requires that fair-lending monitoring results for AI models flow through the model-risk governance structure to board and senior management reporting. This requirement means that bias monitoring results must be reported in the same channels as other model performance monitoring, not siloed in the compliance or fair-lending function. The board report should show the testing results for each high-risk AI credit model by period, the escalation status of any identified disparities, and the remediation progress for open findings. A board that is not receiving this reporting is not meeting its governance obligation under 2026-13, and an examiner reviewing the board's meeting minutes and risk reports for evidence of AI model oversight will note the gap.

The Human Accountability Principle in Fair-Lending AI

The accountability principle that runs through OCC 2026-13 and through ECOA is that the institution is responsible for its credit decisions and for the processes that produce them. For AI credit models, this means that the human officers and directors of the institution are accountable for outcomes they may not have directly caused and may not have known about at the time. This is not a new principle. A bank was always responsible for the fair-lending outcomes of its credit policies even if individual loan officers were not personally discriminating. The AI context makes the principle more urgent because the feedback loop between a model's decision and human awareness of its outcomes can be very long. A credit scoring model can produce a disparate-impact pattern for months before anyone notices, if the monitoring program is not in place.

The accountability principle translates into three operational obligations.

Continuous ownership. Every AI credit model in use must have a named human owner who is responsible for its performance, including its fair-lending performance. The model owner is not the compliance team. The model owner is a named individual (a model risk manager, a credit officer, a chief credit officer) who receives the monitoring results, is responsible for escalating findings, and is accountable for the model's outcomes. Under 2026-13, the model inventory entry for each AI model must identify the model owner, and the model owner's name must be associated with the fair-lending testing results and open findings in the model-risk file.

Override analysis. When human underwriters override an AI model's recommendations (approving a loan the model would have declined, or declining a loan the model would have approved), the pattern of overrides must be analyzed for fair-lending implications. If the override pattern shows that human underwriters are approving AI-recommended declines at a higher rate for one demographic group than another (or conversely, declining AI-recommended approvals at a higher rate for one group), the override pattern introduces a human-driven disparity on top of any model-driven disparity. Both must be measured and managed. The override analysis is the control that prevents the human-in-the-loop from introducing the bias that the model-risk program is trying to remove from the AI.

The audit trail that survives the exam. The 2026 examination environment, under OCC Bulletin 2026-13, is one in which a fair-lending examiner will ask to see the disparate-impact testing results, the LDA documentation, the proxy variable analysis, the override analysis, and the model-risk file entry for any AI credit model in use. An institution that has done all of this work informally, without creating a recoverable audit trail, will struggle to demonstrate compliance under examination. The audit trail does not have to be elaborate. It has to be complete: a testing methodology, a results report, a proxy variable finding and investigation, an LDA search, and a documented escalation and remediation decision. That chain of documentation, organized by model and by testing period, is the institution's defense in a fair-lending exam.

Key Takeaways

• A model with no demographic inputs can still produce demographic outcomes through proxy variables, learned patterns in biased historical data, or objective features with differential impact on protected groups. Bias detection that stops at input review has not finished the job; outcomes testing is required.
• Disparate impact does not require discriminatory intent. It requires a statistically significant outcome disparity that cannot be justified by business necessity, or for which a less discriminatory alternative exists. This doctrine applies to AI credit models under ECOA and the Fair Housing Act regardless of how the model was designed.
• The disparate-impact testing workflow has four phases: data collection and aggregation, comparator group construction controlling for legitimate credit quality variables, statistical significance assessment, and escalation and remediation. All four phases must be documented for the model-risk file under OCC 2026-13.
• Proxy variable identification requires going beyond feature importance scores to correlation analysis (features correlated with protected-class status in the lending geography), conditional analysis (remove-and-retest), and geographic disparity analysis. Interaction-level proxy risks may not be visible in any single feature and require population-level outcomes testing to surface.
• The less-discriminatory-alternative (LDA) search is required when a disparity is identified: document the business necessity for the proxy feature, test whether alternative features can serve the same purpose with a smaller disparity, and document the result whether or not a less discriminatory alternative was found. The LDA documentation must appear in the model-risk file, not only in the compliance team's records.
• GenAI outputs create bias risks beyond predictive model decisions: adverse-action reason accuracy bias, borrower communication quality bias, and extraction bias. Each requires outcome-level auditing comparing outputs for protected versus non-protected applicants controlling for the underlying facts.
• OCC Bulletin 2026-13 requires ongoing monitoring (not one-time testing), documented escalation thresholds, attribution and root-cause analysis, and board-level reporting of fair-lending monitoring results for AI credit models. A compliance team that conducts testing without routing results through the model-risk governance structure is not satisfying the 2026-13 framework.
• Human accountability for AI fair-lending outcomes requires continuous model ownership with a named responsible officer, override analysis to ensure human judgment is not introducing the bias the model-risk program is designed to prevent, and an audit trail complete enough to survive a 2026 fair-lending examination.