What happened
Spain’s Supreme Court held in its judgment of 11 September 2025 that the civic foundation Civio had the right to see the source code of BOSCO, a government application used to check whether people qualify for help with their electricity bills. The court ordered the government to provide the code.
BOSCO is used by electricity suppliers to check applications for the bono social, a discount on electricity bills for people who meet Spain’s rules for vulnerable consumers.
The sources reviewed describe BOSCO as an automated system but do not establish that it uses AI. This case is included because it raises a question that also applies to AI: how can people check whether government software is following the rules when they cannot examine how it works?
According to the judgment, Civio had been trying to obtain BOSCO’s source code since 2018. The Transparency and Good Governance Council granted Civio access to technical documents and test results for BOSCO, while the source code remained withheld on security and intellectual property grounds. Two lower courts had upheld that refusal.
The judgment also reported that Civio had raised concerns about possible errors in BOSCO. Civio argued that the application had denied the electricity discount to widows and asked large families for consent that the eligibility rules did not require. These were Civio’s claims, not findings made by the court.
After nearly seven years of administrative and legal proceedings, the Supreme Court ordered the government to release the code. Civio reported in May 2026 that it still had not received it.
What an auditable version would have shown
The judgment reported that the Transparency and Good Governance Council granted Civio access to technical documents and test results for BOSCO, while the source code remained withheld on security and intellectual property grounds.
Civio wanted to check whether BOSCO was applying the eligibility rules correctly. It had raised concerns that some people were being refused the electricity discount when they should have qualified.
The documents showed how BOSCO was intended to work and how it performed in the tests the government had carried out. Civio still needed to see the code to examine how the software actually checked applications.
The Supreme Court held that checking whether government software follows the law can sometimes require access to its source code.
A record of each application should have shown what information BOSCO checked, which eligibility rules it applied and why the application was approved or refused. That would have allowed individual decisions to be checked against the regulations.
The sources reviewed do not show whether the government kept records of individual BOSCO decisions that could be checked in this way.
Where the gap was
The judgment reported that the government had refused to release BOSCO’s source code because of security and intellectual property concerns.
The Supreme Court held that the general risk of exposing software vulnerabilities was not enough, on its own, to justify refusing access. It also held that the government’s intellectual property rights did not outweigh the right to examine the code in this case.
For seven years, Civio had been unable to inspect the code of a government application used to check whether people qualified for help with their electricity bills.
A ConductRecord keeps a record of each eligibility decision, including the information used, the rule applied and the result.
A MetricRecord is designed to turn those records into signed aggregate figures. For example, it could show how many applications were refused in different categories, allowing a regulator or court to examine whether particular groups were being refused more often than others.
Those records could help identify decisions that needed further examination. They would not replace access to the source code where checking whether the software followed the law required access to the code.
ConductRecord and MetricRecord are Headlights designs.
What governance should have looked like
The Supreme Court held that access to public information is particularly important when government agencies use automated systems to determine people’s social rights. It held that checking whether those systems follow the law can sometimes require access to their source code.
The court also said that access could come with safeguards, such as restrictions on how the code could be used or a requirement to keep certain information confidential.
Where a public body uses software to check whether someone qualifies for financial assistance, best practice would be to keep a record of each decision, including the information checked, the eligibility rules applied and the reason for the result.
The public body should also have a process for providing access to the source code when it is needed to check that the software follows the law, with appropriate safeguards for security and confidentiality.
Civio reported on 14 May 2026 that it had asked for the Supreme Court’s judgment to be enforced because it still had not received the code. The sources reviewed do not show whether the government has since provided it or whether the errors Civio described have been acknowledged or corrected.
Failure Pattern: a government refused for seven years to disclose the source code of software that checks eligibility for a social benefit, until the Supreme Court held that citizens may need the code to check that such a system follows the law.
Governance Principle: a public body that uses software to decide who receives a social right should be able to show how the software applies the rules, including its code where checking it requires that.
The reference implementation of ConductRecord and MetricRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Tribunal Supremo, Sala de lo Contencioso-Administrativo, Sección Tercera, Sentencia 1119/2025, 11 September 2025, recurso 7878/2024, ROJ STS 3826/2025, full text (Iberley, reproducing the CENDOJ text)
- Ocho meses después de la sentencia del Supremo, seguimos sin tener acceso al código de BOSCO (Civio, 14 May 2026)