AI guardrails in 10 weeks → 94% fewer unsafe automated decisions, zero critical audit findings

About the client

A fintech company using AI to score creditworthiness and to detect fraud. Its name is withheld under NDA.

The challenge

The company’s AI was growing faster than its controls, and three pressures made guardrails mandatory.

Regulation

AI used to assess creditworthiness falls into the high-risk category of the EU AI Act (Annex III), which brings duties for risk management, human oversight, logging and transparency. GDPR rules on automated decisions and consumer credit rules applied on top.

Live incidents

In one quarter the scoring model approved applicants outside the company’s own risk policy, the fraud model blocked a growing share of legitimate customers, and unmasked personal data flowed into model training sets.

No audit trail

Neither model kept a reviewable record of inputs, outputs and decisions. The compliance team could not explain a single declined application or blocked payment to a regulator on request.

With an external audit four months away, the board froze any new AI rollout until the risks were under control.

What CodeLions built

A guardrail layer between the company’s systems and both AI models, so every input and every decision passes through checks before it affects a customer.

• Input guardrails: validation that rejects incomplete or out-of-range applications, and automatic masking of card numbers, IBANs and ID data before anything reaches the models.
• Policy guardrails: every model decision is checked against the live credit and risk policy, and decisions that break a rule are blocked and rerouted.
• Human in the loop: borderline credit decisions and high-value fraud blocks go to a review queue with a clear reason code, so a person makes the final call.
• Explainability and logging: every decision is stored with its inputs, model version and top factors, ready for a regulator or a customer complaint.
• Monitoring: a compliance dashboard tracks blocked decisions, drift in approval rates across customer groups and false-positive fraud blocks in real time.

How the rollout worked

Ten weeks, four phases, with both models live throughout.

• Risk discovery (weeks 1 to 2): every AI use case mapped to its regulatory obligations, and both models stress-tested with 1,500+ edge-case and adversarial scenarios.
• Guardrail build (weeks 3 to 6): input and output filters, PII masking and policy checks deployed in shadow mode, measuring impact without touching customers.
• Oversight and logging (weeks 7 to 8): the human review queue, decision logs and the compliance dashboard launched.
• Go-live and handover (weeks 9 to 10): guardrails switched to enforcing mode, risk and compliance teams trained, audit-ready documentation delivered.

Outcomes

Within 90 days of go-live the company passed its external audit and lifted the freeze on new AI features.

The last row matters to the business: fewer good customers blocked means more completed transactions and fewer complaints.