Skip to content
ParamergeParamerge
Stephen Lieberman
Through Paramerge
Contact

PAN Lab example

BOSCO (Spain)

The secret code: an eligibility engine that gives no reasons

Spain's BOSCO software decides who gets an electricity-bill discount. It gives no reasons, and one flaw in its rules can deny thousands of eligible people.

See more

BOSCO is software that Spain's Ministry for Ecological Transition developed to check who qualifies for the bono social, a discount on electricity bills for vulnerable consumers. Electricity retailers enter each applicant's details into it and tell the applicant its answer. It applies a fixed set of rules, and its answers give no reasons.

What went wrong

In May 2019, the Spanish transparency foundation Civio documented two ways BOSCO denied the discount to people who qualified. It worked from BOSCO's technical specification and its test cases, the worked examples used to check the software's answers.

First, a pensioner who ticked the pensioner box could be rejected with an "impossibility of calculation" message. That happened even though BOSCO had checked their income and they qualified on it. Civio's example was a widow.

Second, BOSCO denied large families whenever any household member declined consent to consult income data. Large families qualify whatever their income, so income was never a requirement for them.

Dozens of widows told Civio their applications had been rejected although they qualified. Because a rejection gave no reasons, an applicant had little basis to spot or contest a wrong denial. They could only apply again.

The 2018 re-application

After a 2017 to 2018 overhaul of the rules, every existing beneficiary had to apply again by 31 December 2018. Enrollment fell sharply.

The earlier scheme had roughly 2.4 to 2.5 million beneficiaries. As of January 2019, 1,111,958 people were enrolled, and later coverage was cited at around 1.5 million. An estimated 4.5 to 5.5 million people met the criteria. More than half a million applicants were rejected.

The net effect the sources document is under-inclusion: eligible, vulnerable consumers denied a discount they were entitled to. The problem was eligible people shut out, not ineligible people let in.

The fight for the source code

Civio asked the ministry for BOSCO's source code and technical documents in 2018. In February 2019, the Council for Transparency and Good Governance, Spain's freedom-of-information authority, granted Civio access to the technical specification and test cases. It refused the source code, citing intellectual property.

In December 2021, Central Contentious-Administrative Court No. 8 rejected Civio's appeal. On 30 April 2024, the National High Court (Audiencia Nacional) did the same. The grounds they cited included intellectual property, national security, confidentiality, and economic policy.

What the Supreme Court held

In judgment STS 1119/2025, dated 11 September 2025, the Supreme Court ordered the government to give Civio access to BOSCO's source code. It applied Spain's 2013 Transparency Law, the EU Charter of Fundamental Rights, and the Spanish Constitution.

The court declared access to public information a constitutional right. It held that neither intellectual property nor national security automatically shields public source code. It dismissed the government's claims as a "mere risk" of harm.

Secrecy must instead be weighed case by case. The government may attach safeguards, such as confidentiality agreements, rather than withhold the code outright.

The court noted that BOSCO decides automatically and gives no reasons. An error in it would have a "multiplier effect", denying an entitlement to thousands of people. So how BOSCO works was of "singular relevance."

Civio's own English post dates the signing to 9 September. Spain's judicial council and the legal sources date the judgment 11 September 2025.

After the ruling

The order did not promptly open the code. The Supreme Court sent the judgment to the National High Court in November 2025, and that court received it in January 2026.

In the week of 14 May 2026, about eight months after the ruling, Civio filed a request to enforce the judgment. The code had still not been delivered. BOSCO stayed in use throughout.

What the sources do not say

No source documents BOSCO as an AI, machine-learning, or risk-scoring system. Its method and code are unknown to the public, and no model name is on file.

No audited error rate per decision is public, because the source code was withheld. One academic analysis describes BOSCO's errors as running both ways, denying some who qualified and granting some who did not. No wrongful grant is documented, so the documented net effect is under-inclusion.

How the case file reads it

The case file reads BOSCO as a case about the right to know why. In its words, a system no one can read is a system no one can fix.

In that reading, control does not come from a better-built BOSCO. It comes from the channels for reasons and transparency that the design never had. In this case, outsiders forced them open.

The case file adds a lesson about enforcement. A final court order was necessary, but it did not carry itself out.

What this network is drawn from

This network is drawn from the public sources, not from BOSCO's own code. It shows BOSCO, the application details, the retailers, the decision records, and the outside scrutiny of Civio and the courts.

The people who applied are outside the network. The ministry that owns BOSCO is not drawn as a separate part.

What the available tools can and cannot address

Service means the useful work BOSCO does: deciding applications for the discount.

A failure pathway is a link between two parts of the network where a mistake made by one part can be passed on to the other. Closing a pathway means mistakes stop passing along it. The work it carries goes on.

Explore (No Targets) sets no targets. Under Service Targets Only, the targets can be met within this case's budget of 12 units, in many ways. The cheapest cost 4 units. Each pairs Mark AI-written records with one of three tools: Escalate checks, Assign a challenger, or Review on schedule.

Under Service and Safety Targets, every failure pathway must be closed. Four start open: the pathways named BOSCO reads application details, BOSCO's answers recorded, Answer sent to the retailer, and One rule set for every application.

Each of those four is closed by one tool and no other. They are Mark AI-written records, Store less data, Escalate checks, and Check with a second model, in that order. Every way to meet these targets uses all four. The cheapest costs 10 units.

Escalate checks has retailers look again at a BOSCO answer when a problem is flagged. The sources do not say what retailers could compare it against. That is what closes Answer sent to the retailer.

Under All Governance Targets, there is one way only: the same four tools, with Store less data at its stronger setting. It costs 12 units, the whole budget.

Understand the system costs 3 units under Explore and Service Targets Only, and 4 under the two higher levels. It cuts the price of Store less data, Escalate checks, Check with a second model, and Assign a challenger. None of the cheapest ways uses it.

More checking is not always better here. Every tool at its strongest setting misses even the Service Targets Only targets. The added checks cut BOSCO's service too far.

Stylized model of a documented deploymentPublic benefits & eligibility

Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.

What this models

This example runs on the BOSCO-class secret-code eligibility engine network: 5 components and 9 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 3 assumed · 3 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

Show all 6 assumptions
  • assumed

    This example follows the pattern the BOSCO case file documents: an eligibility program whose source code is kept secret. It does not rebuild BOSCO itself or its withheld rules.

  • baseline

    This example assumes one rule set decides every application. A single flaw then repeats for every applicant it affects, instead of averaging out. Civio and legal commentators call this an "error multiplier."

  • baseline

    This example assumes the defining gap is a review of reasons. BOSCO's decisions gave no reasons, and its source code was withheld. So nobody at the ministry or the retailers could find or contest a wrong denial. The scrutiny that pressed for that review came from outside, through Civio's lawsuit. The Supreme Court ordered the source code released in September 2025, but it had not been delivered by May 2026.

  • baseline

    This example draws the application details and income-data consent as a real input to BOSCO. The large-family denials turned on that consent, although large families qualify whatever their income. The case file documents those denials. This example does not compute them.

  • assumed

    This example assumes Civio and the courts could read part of the picture and no more. The transparency council granted Civio access to BOSCO's specification and test cases, the worked examples used to check its answers, but not its source code. So BOSCO's logic could not be checked from outside either.

  • assumed

    The case file documents that those denied were disproportionately pensioners, low-income households, large families, and other vulnerable consumers. It also documents the reported fall in enrollment. This example shows how errors move among BOSCO, the retailers, and their records. It does not model demographics, and it estimates no harm to any group of people. That harm is measured outside this example.

What this example does not show

Show all 2 limitations
  • The harm here is under-inclusion: eligible people denied a benefit they qualified for. Civio documented it by reconstructing the software's behavior from its test cases, the worked examples used to check its answers, not from a published error rate. One academic source records errors both ways, denying some who qualified and granting some who did not. The well-documented net effect is under-inclusion. This example uses the case's shape, not measured rates.
  • The case file documents that those denied were disproportionately pensioners, low-income households, large families, and other vulnerable consumers. It also documents the reported fall in enrollment. This example shows how errors move between institutions, not who is affected. It estimates no harm to any group of people. That harm is measured outside this example.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

  • In judgment STS 1119/2025 of 11 September 2025, the Third Section of Spain's Supreme Court (Sala de lo Contencioso-Administrativo) ordered the government to give the transparency foundation Civio access to the source code of BOSCO, the software that determines eligibility for the electricity social bonus (bono social electrico). Applying the Transparency Law (Ley 19/2013) together with Article 42 of the EU Charter of Fundamental Rights and Article 105.b of the Spanish Constitution, the Court held that access to public information is a constitutional right and that neither intellectual property nor national security is an automatic shield, dismissing the government's secrecy claims as a 'mere risk' of eventual harm to be assessed case by case under a proportionality test. Civio and legal commentators describe an 'error multiplier': because BOSCO decides automatically and gives no reasons, one systematic error can propagate to thousands of eligible people at once. As of May 2026, roughly eight months after the ruling, the source code had still not been delivered and Civio had filed for judicial enforcement.

    empirical
    • Government Consejo General del Poder Judicial, El Tribunal Supremo condena a la Administracion a facilitar a una Fundacion Ciudadana el codigo fuente de la aplicacion informatica que acredita a los beneficiarios del bono social electrico (2025) https://www.poderjudicial.es/cgpj/es/Poder-Judicial/Noticias-Judiciales/El-Tribunal-Supremo-condena-a-la-Administracion-a-facilitar-a-una-Fundacion-Ciudadana-el-codigo-fuente-de-la-aplicacion-informatica-que-acredita-a-los-beneficiarios-del-bono-social-electrico
    • Investigative Fundacion Ciudadana Civio, Civio pulls back the curtain on public algorithms: Spain's Supreme Court orders the Government to release BOSCO's source code (English) (2025) https://civio.es/novedades/2025/09/18/civio-pulls-back-the-curtain-on-public-algorithms-spains-supreme-court-orders-the-government-to-release-boscos-source-code/
    • Investigative Fundacion Ciudadana Civio, Civio abre camino en la transparencia algoritmica: el Supremo condena al Gobierno a entregar el codigo fuente de BOSCO (2025) https://civio.es/novedades/2025/09/17/civio-abre-camino-en-la-transparencia-algoritmica-el-supremo-condena-al-gobierno-a-entregar-el-codigo-fuente-de-bosco/
    • Academic Derecho Administrativo y Urbanismo, El Tribunal Supremo declara que la Fundacion Ciudadana Civio tiene derecho a acceder al codigo fuente de la aplicacion informatica BOSCO (STS 11/9/2025) (2025) https://www.derechoadministrativoyurbanismo.es/post/el-tribunal-supremo-declara-que-seg%C3%BAn-la-ley-de-transparencia-la-fundaci%C3%B3n-ciudadana-civio-tiene-d
    • Investigative Fundacion Ciudadana Civio, This is the landmark ruling that sets a new standard for algorithmic transparency in Spain (2025) https://civio.es/novedades/2025/11/17/this-is-the-landmark-ruling-that-sets-a-new-standard-for-algorithmic-transparency-in-spain/
    • Investigative Fundacion Ciudadana Civio, Ocho meses desde la sentencia de BOSCO y seguimos sin tener acceso al codigo (2026) https://civio.es/novedades/2026/05/14/ocho-meses-desde-la-sentencia-de-bosco-y-seguimos-sin-tener-acceso-al-codigo/
    • Advocacy Free Software Foundation Europe, The social value of the freedom to study source code in the Spanish Court (2026) https://fsfe.org/news/2026/news-20260205-01.en.html

  • The transparency foundation Civio documented, by reconstructing BOSCO's behaviour from partial technical specifications and functional test cases, two systematic ways the software denied the electricity social bonus to people who qualified: when a pensioner ticked the 'pensioner' box the application could return an 'imposibilidad de calculo' (impossibility of calculation) error and be rejected even though BOSCO had checked the applicant's income and the applicant qualified on it; and large families, entitled to the bonus regardless of income, were denied whenever a household member withheld authorization to consult income data, although income was not a regulatory requirement for that category. After a 2017-2018 overhaul required all beneficiaries to re-apply by 31 December 2018, enrollment fell from roughly 2.4 to 2.5 million under the prior scheme to 1,111,958 as of January 2019 (later cited around 1.5 million), against an estimated 4.5 to 5.5 million eligible people, and more than half a million applicants were rejected. No audited per-decision error rate is public, because the source code was withheld; one academic analysis records errors in both directions, but the documented net effect is under-inclusion.

    empirical
    • Investigative Fundacion Ciudadana Civio, La aplicacion del bono social del Gobierno niega la ayuda a personas que tienen derecho a ella (2019) https://civio.es/transparencia/2019/05/16/la-aplicacion-del-bono-social-del-gobierno-niega-la-ayuda-a-personas-que-tienen-derecho-a-ella/
    • Investigative AlgorithmWatch (Nicolas Kayser-Bril), Spain: Legal fight over an algorithm's code (2019) https://algorithmwatch.org/en/spain-legal-fight-over-an-algorithms-code/
    • Advocacy Free Software Foundation Europe, The social value of the freedom to study source code in the Spanish Court (2026) https://fsfe.org/news/2026/news-20260205-01.en.html
    • Trade press Xataka (Enrique Perez), Un algoritmo es el que decide quien recibe el bono social para la luz. El Gobierno y los jueces se niegan a ensenar el codigo (2024) https://www.xataka.com/legislacion-y-derechos/algoritmo-que-decide-quien-recibe-bono-social-para-luz-gobierno-jueces-se-niegan-a-ensenar-codigo
    • Academic Reboot Democracy (Jose Luis Marti), The Judicial Protection of Algorithmic Transparency (2025) https://rebootdemocracy.ai/blog/the-judicial-protection-of-algorithmic-transparency

Where this connects

Institutional pressures in this domain

  • Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
  • Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
  • Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
  • Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Public benefits & eligibility domain page.

Levers available here and the patterns behind them

Documented case histories