---
title: "Give notice and an appeal before automated · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights
id: CMP-67
level: Required
region: US
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1180
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give notice and an appeal before automated decisions

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-67
- Level: Required
- Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)
- Rule: Before software alone decides on credit, housing, education, work or health care, tell people in advance. Let them get an explanation and appeal to a person.
- Check: The build fails when a decision type in a covered area lacks a notice text, an appeal route, a reviewer role or an access explanation. An end-to-end test appeals a denied application, and a reviewer account changes the outcome.
- Risk: A law broken
- Region: United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: California's rules on automated decisionmaking technology apply from 1 January 2027. They cover any decision that grants or denies credit, housing, education, work or health care. Show a pre-use notice when you collect the data, or before you use data you already hold this way. Offer an opt-out, or an appeal to a reviewer who can change the decision. Stop processing for a person who opts out within 15 business days, and tell your service providers to do the same. Answer access requests with the purpose, the logic and how the output shaped the outcome. In the EU, GDPR Article 22(3) also asks for a review by a person and a chance to contest. Build the review as [let a person decide what matters](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/human-decides.md) describes. Screen each decision type in the [US risk assessment](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments.md) too.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const COVERED_AREAS = ['credit', 'housing', 'education', 'employment', 'healthcare'];
const DECISION_FIELDS = ['preUseNotice', 'appealRoute', 'reviewerRole', 'accessExplanation'];

export const decisionProblems = decision => COVERED_AREAS.includes(decision.area)
  ? DECISION_FIELDS.filter(field => !decision[field]).map(field => `${decision.id}: missing ${field}`)
  : [];
```

### Python example

```python
COVERED_AREAS = {"credit", "housing", "education", "employment", "healthcare"}
DECISION_FIELDS = ["pre_use_notice", "appeal_route", "reviewer_role", "access_explanation"]

def decision_problems(decision: dict) -> list[str]:
    if decision["area"] not in COVERED_AREAS:
        return []
    return [f"{decision['id']}: missing {field}" for field in DECISION_FIELDS if not decision.get(field)]
```

## Sources

- [California Privacy Protection Agency rules on automated decisionmaking technology](https://cppa.ca.gov/regulations/ccpa_updates.html)
- [GDPR Article 22 on automated decisions](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- AIF-36 [Let a person decide what matters](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/human-decides.md) in AI features
- CMP-60 [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments.md) in Compliance and governance
- MLO-37 [Explain each decision to the person it affects](https://agentwranglers.se/playbook/machine-learning/people-affected-by-the-model/explain-decisions.md) in Machine learning

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws.md)
- Next: [Report health data leaks under the FTC rule when HIPAA does not cover you](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification.md)
- [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)