Domain Atlas / Public benefits & eligibility
BOSCO (Spain)
In judgment STS 1119/2025 of 11 September 2025, the Third Section of Spain's Supreme Court (Sala de lo Contencioso-Administrativo) ordered the government to give the transparency foundation Civio access to the source code of BOSCO, the software that determines eligibility for the electricity social bonus (bono social electrico). Applying the Transparency Law (Ley 19/2013) together with Article 42 of the EU Charter of Fundamental Rights and Article 105.b of the Spanish Constitution, the Court held that access to public information is a constitutional right and that neither intellectual property nor national security is an automatic shield, dismissing the government's secrecy claims as a 'mere risk' of eventual harm to be assessed case by case under a proportionality test. Civio and legal commentators describe an 'error multiplier': because BOSCO decides automatically and gives no reasons, one systematic error can propagate to thousands of eligible people at once. As of May 2026, roughly eight months after the ruling, the source code had still not been delivered and Civio had filed for judicial enforcement.[7]
What happened
BOSCO is the software Spain's Ministry for Ecological Transition (Ministerio para la Transicion Ecologica y el Reto Demografico) uses to determine who qualifies for the bono social electrico, a regulated discount on electricity bills for "vulnerable consumers." Eligibility turns on legal categories — pensioners, low-income households up to income thresholds tied to a multiple of a reference index, and large families, who qualify regardless of income — and electricity retailers (comercializadoras) run applicants through BOSCO to verify their status. Contemporary accounts describe BOSCO as a deterministic rules-encoding program (commentators call systems like it "decision trees") rather than a machine-learning or statistical-risk model; its exact architecture and implementation are unknown to the public precisely because the source code was withheld.
After a 2017-2018 regulatory overhaul, every existing beneficiary had to re-apply by 31 December 2018. Enrollment collapsed. Against a prior scheme with roughly 2.4 to 2.5 million beneficiaries, only 1,111,958 people were enrolled as of January 2019 (later coverage cited around 1.5 million), while an estimated 4.5 to 5.5 million people met the criteria; more than half a million applicants were rejected. The net effect the record documents is under-inclusion — eligible vulnerable consumers denied a benefit they were entitled to — rather than fraudulent over-enrollment.
In a May 2019 investigation, the transparency foundation Fundacion Ciudadana Civio documented two specific, systematic ways BOSCO denied aid to people who qualified, reconstructed from the partial technical specifications and functional test cases it was able to obtain. First: when a pensioner (Civio's example was a widow living on a pension) ticked the "pensioner" box, BOSCO could return an "imposibilidad de calculo" (impossibility of calculation) error and reject the application without properly evaluating income, even though the applicant qualified on income grounds. Second: large families — entitled to the bonus irrespective of income — were denied whenever any household member declined to authorize consulting income data, although income was not a regulatory requirement for that category. Civio reported receiving dozens of warnings from affected people. Because a rejection came with no reasons, an applicant had little basis to detect or contest a wrongful denial and could only re-apply.
Civio requested BOSCO's technical specifications, verification-test results, and source code under Spain's Transparency Law (Ley 19/2013) beginning in 2018. The Consejo de Transparencia y Buen Gobierno granted the specifications and use cases but not the code; the Central Administrative Court No. 8 (December 2021) and then the Audiencia Nacional (30 April 2024) rejected disclosure of the source code, citing intellectual property, national security, confidentiality, and economic-policy grounds. The Supreme Court admitted Civio's cassation appeal in December 2024, heard oral argument on 8 July 2025, and in judgment STS 1119/2025, dated 11 September 2025 (Sala de lo Contencioso-Administrativo, Seccion Tercera; recurso de casacion 7878/2024; reporting judge rendered as Juan Pedro Quintana Carretero in the legal analyses), ordered the Administration to give Civio access to BOSCO's source code. (Civio's own English post at one point dates the signing to 9 September; the CGPJ and the independent legal sources anchor the judgment at 11 September 2025.)
The ruling rested on Articles 14 and 16 of Ley 19/2013, Article 42 of the EU Charter of Fundamental Rights, and Article 105.b of the Spanish Constitution. The Court declared access to public information a constitutional right and framed algorithmic transparency as essential to a "digital democracy," obliging public authorities to explain in an understandable way how algorithms used in decisions affecting citizens work. It rejected blanket secrecy: intellectual-property and national-security claims cannot automatically shield public source code, and were dismissed as a "mere risk" of eventual harm that was not sufficiently characterized. Secrecy must instead be assessed case by case under a proportionality test, and the Administration may impose safeguards — confidentiality agreements, no-redistribution and limited-use commitments, personal-data protection — rather than withhold the code outright. Civio and legal commentators emphasize an "error multiplier": because BOSCO decides automatically and gives no reasons, one systematic bug propagates to thousands of eligible people at once, which the Court treated as a reason the workings of the program were of "singular relevance."
The order did not promptly open the box. The Supreme Court sent the judgment to the Audiencia Nacional in November 2025; the National Court received it in January 2026; and in the week of 14 May 2026, roughly eight months after the ruling and with the code still undelivered, Civio filed a formal request for enforcement (ejecucion de sentencia) with Central Court No. 8, which had not yet acted. As of May 2026 the source code had not been released. BOSCO remained operational and in use to adjudicate bono social eligibility throughout.
Two honesty notes travel with this case. BOSCO is not documented as an AI, machine-learning, or risk-scoring system; it is eligibility-automation software whose method and code are simply unknown to the public, and no model identifier is on record. And while the dominant, well-supported framing is under-inclusion (the enrollment collapse, the rejections, the two denial-of-eligible failure modes), one academic analysis describes BOSCO's errors as running in both directions; no wrongful-grant failure mode is documented, so the net effect on the record is under-inclusion.
The sociotechnical reading
BOSCO is the Atlas's source-code-secrecy case, and its lesson is about the reasoned-decision channel — the right to know why. In map terms the defining feature is an absence: a determination was written into the record with no reasons attached, and the logic that produced it was withheld, so a wrong denial could not be surfaced or contested from inside. That closes the correction loop at both ends. The person denied cannot see the basis to challenge it; no internal reviewer can reconcile the output against the eligibility rules, because the rules-as-implemented are invisible. What is left is an "error multiplier": one deterministic rule set decides every application, so a single flaw does not scatter as noise — it denies the benefit to thousands of eligible people identically and at once. Transparency here is not a reporting nicety downstream of accuracy; it is the precondition for correction to exist at all. A system no one can read is a system no one can fix.
That places BOSCO precisely against its nearest neighbours. It is not Rotterdam, where an audit succeeded in prying open a live model and measuring its bias — BOSCO's whole story is that the box stayed closed even after a final court order to open it. It is not MiDAS, whose defining absence was the human reviewer; BOSCO kept its operators (retailers process every application) but removed the reasons, so the absence sits on the transparency side, not the staffing side, and the harm runs the opposite direction — under-inclusion of the eligible rather than over-detection of fraud. And it is not a privacy strike-down like SyRI, halted pre-harm on data-protection grounds: BOSCO's harm had already happened and been reconstructed, the remedy ordered was disclosure rather than a halt, and the system kept running. Its distinctive control is the right to explanation, won through transparency litigation to a constitutional holding that neither intellectual property nor national security automatically shields public code.
The productive levers sit on that transparency side, which is what the rehearsal is built to show. A deployment-permission gate asks the question the court answered only years later: on what published basis may a no-reasons engine be turned on vulnerable people? Labeling determinations lets a downstream reader tell a machine denial from a reasoned finding. A standing internal challenger and a review cadence are the outside scrutiny made routine and early. Data-minimization answers the large-family failure — a denial triggered by income data the rule did not need — on its own terms. And a better-built engine is the decoy: accuracy was never the binding constraint, and refining a secret engine changes nothing a denied person can act on. The case adds one more lesson the others do not carry, and it is about enforcement. A final, non-appealable order to open the box did not promptly open it; eight months on, the government was still resisting and Civio had to seek judicial enforcement. A court order is a necessary control, not a self-executing one — the compliance lag is a governance failure mode in its own right. The honest boundary is that none of this measures the harm to the people denied: who lost the discount, disproportionately pensioners, low-income households, and large families, and the collapse in coverage, are documented in the case record and measured outside any diagram like this one.
The concepts used in this reading are defined in the Field Guide; the governance responses live in the Practice Library. The model organization for this case can be stress-tested in the PAN Lab.