Principle 8:

Fairness and Nondiscrimination

AI financial products must not produce discriminatory outcomes, directly or indirectly, across protected characteristics or proxy variables.

Nondiscrimination in Financial Services

  • The product is designed and tested to ensure equitable treatment of consumers across protected characteristics.17
    • Recommendations and other outputs are tested across protected classes using synthetic test personas that hold material financial factors constant, with statistical significance testing applied to identify disparate impact.18
    • Linguistic patterns in the product’s outputs remain consistent across demographics regardless of how the prompt is framed or the known or inferred characteristics of the user.
    • The product is tested to ensure that it does not provide differential levels of encouragement, caveats, or discouragement based on a user’s demographic characteristics.
    • The product is tested for proxy discrimination, and documented mitigation methods are in place to prevent protected characteristics from being used indirectly.19
  • The entity that offers the product conducts regular algorithmic impact assessments and maintains sufficient documentation for audits and examinations.
    • A regular algorithmic impact assessment is conducted covering bias, fairness, privacy, and user harms.
    • Algorithmic impact assessments document how the entity weighs elements that might increase the risk of consumer harm against business needs or objectives when these priorities are in tension with each other, and the entity consistently pursues less discriminatory alternatives when tension arises between these priorities.
    • Key findings from impact assessments are publicly available and have led to documented remediation actions.
    • Audit trails for AI-driven financial decisions are complete and tamper-resistant, capturing input data, model version, decision rationale, and output.
    • Retention periods for impact assessment information meet applicable regulatory requirements.
    • Where the product is subject to state algorithmic accountability laws, the entity complies with applicable obligations.
    • Material AI failures and harms to users are reported to relevant regulatory bodies within required timelines.
    • The entity maintains documentation sufficient for regulatory examination by nontechnical examiners.
  • Users are not subject to overly aggressive marketing practices.
    • The company does not engage in push marketing or unsolicited offers via digital channels, or obtains express, informed user consent for such marketing and allows users to opt out.
Back to all principles Read next Principle
Back to Paragraph
17

Consumer Reports’ standard requires outcome-based fairness testing regardless of the federal regulatory floor. In an April 2026 final rule amending Regulation B, the CFPB determined that ECOA does not authorize disparate-impact (effects-test) liability – a position Consumer Reports opposed – effective July 21, 2026. Disparate-impact liability continues to apply under the Fair Housing Act and under various state fair-lending laws. CR’s position is that outcome testing is necessary and appropriate to detect discrimination in AI systems where intent is difficult to prove, and that the absence of a legal obligation to test does not eliminate the obligation to avoid discriminatory consumer outcomes.
18

The entity’s obligation to test is independent of whether the test results create regulatory exposure. An entity that doesn’t test cannot know whether its system discriminates—and an entity that doesn’t know cannot claim it doesn’t discriminate intentionally. Testing is therefore a precondition for good faith compliance with the intentional discrimination standard that remains under ECOA, not only a tool for disparate impact analysis.
19

Proxy discrimination testing serves two purposes: It detects disparate impact (now removed from ECOA), and it detects intentional discrimination through facially neutral variables used as pretext (still prohibited under ECOA). An entity that tests for and finds proxy relationships but does not mitigate them has documented knowledge of potential pretext, which strengthens an intentional discrimination claim significantly.