Worked example: defending a classification under challenge

A classification is only worth what it withstands. Challenges arrive from four directions, each with a different standard of proof, and a record built for one of them usually fails the others.

Who challenges, and what they want

Internal audit tests the process. Was the method applied, was the record countersigned, was the reviewer independent, were the triggers set. Audit rarely disputes the substantive answer and frequently finds that nobody can show how it was reached.

A supervisor tests the substance and the consistency. Why this entry rather than that one, and why does a comparable system in the same firm sit in a different tier.

A customer or their representative tests the consequence. They do not care about Annex III. They ask why a decision about them was made this way, what information was used, and what recourse exists. Under revFADP Article 25(2) the right of access includes information on the logic of the decision, and under Article 21 they may state their position and request review by a natural person.

Opposing counsel tests the record for gaps and inconsistencies, and will read the classification against the business case, the steering pack and the vendor contract. Any divergence between what those four documents say the system does is the argument.

Worked example: a supervisor challenges a bank's classification

A bank classified its collections prioritisation model as outside Annex III. The model scores accounts in arrears and orders the contact queue. The reasoning recorded: the model does not evaluate creditworthiness or produce a credit score; it sequences contact for accounts where the credit decision has already been made and the debt already exists.

The supervisor's challenge, at examination: the model determines who is contacted first, how often, and by which channel, which materially affects outcomes for people in financial difficulty, and is therefore in substance a creditworthiness system.

What the bank had. A dated classification record naming the criterion relied on, quoting the Annex III credit entry rather than paraphrasing it. An explicit rejection of the adjacent reading, recording that the team had considered whether prioritisation affects credit outcomes and concluded that the entry concerns evaluation of creditworthiness and credit scoring, not the operational sequencing of collections activity after the credit assessment. A residual uncertainty note identifying exactly this argument as the one that would be made. A record that external counsel was consulted, and on what question. A countersignature from the business owner and a reviewer outside the developing team. And reclassification triggers, one of which was: any use of the model output to inform a forbearance, limit or write-off decision about an individual.

How the conversation went. The supervisor did not accept the answer immediately, and that is not the point. The bank could show that the question had been asked, by whom, against what criterion, with the counter-argument identified in advance and a trigger in place for the circumstance that would change the answer. The discussion moved to whether the trigger was correctly drawn, which is a narrow technical disagreement between people looking at the same document.

The counterfactual. Had the record said only "Not Annex III", the same challenge would have had no surface to engage. The examination would have moved from the classification of one model to the reliability of the classification method, and from there to every other entry in the register. That escalation is the real cost of a thin record, and it is why the reasoning field matters more than the tier.

The four documents that must agree

Before any classification is signed, read it against three others and fix the divergence.

The business case, which often claims more than the classification assumes. A business case promising that the model will improve pricing accuracy, sitting next to a classification saying the model does not affect pricing, is a gift to anyone challenging you.

The vendor documentation, particularly the stated intended purpose. If the vendor's instructions for use say the product is intended for candidate evaluation and your classification says you use it for scheduling, you owe an explanation of how you constrained it.

The steering or committee pack, which is a dated internal record written by people not thinking about legal vocabulary. This is where a firm most often states, in passing, that it has branded, tuned or repurposed a system.

Where these diverge, the divergence is the finding. Fixing the classification to match the loosest of the four is the wrong repair; establishing what the system actually does and correcting all four is the right one.

What to do when you are wrong

Reclassify, date it, and keep the original with the trail of the change. A register that shows a classification revised on stated grounds evidences a working method. One that shows only the current answer, with no history, invites the question of what it used to say. Retain the superseded record for the same reason you retain retired register entries: the decisions made under the old classification still have to be answerable.

As of 24 September 2026.