Give notice and an appeal before automated decisions

How to do it

California's rules on automated decisionmaking technology apply from 1 January 2027. They cover any decision that grants or denies credit, housing, education, work or health care. Show a pre-use notice when you collect the data, or before you use data you already hold this way. Offer an opt-out, or an appeal to a reviewer who can change the decision. Stop processing for a person who opts out within 15 business days, and tell your service providers to do the same. Answer access requests with the purpose, the logic and how the output shaped the outcome. In the EU, GDPR Article 22(3) also asks for a review by a person and a chance to contest. Build the review as let a person decide what matters describes. Screen each decision type in the US risk assessment too.

Examples

JavaScript example

const COVERED_AREAS = ['credit', 'housing', 'education', 'employment', 'healthcare'];
const DECISION_FIELDS = ['preUseNotice', 'appealRoute', 'reviewerRole', 'accessExplanation'];

export const decisionProblems = decision => COVERED_AREAS.includes(decision.area)
  ? DECISION_FIELDS.filter(field => !decision[field]).map(field => `${decision.id}: missing ${field}`)
  : [];

Python example

COVERED_AREAS = {"credit", "housing", "education", "employment", "healthcare"}
DECISION_FIELDS = ["pre_use_notice", "appeal_route", "reviewer_role", "access_explanation"]

def decision_problems(decision: dict) -> list[str]:
    if decision["area"] not in COVERED_AREAS:
        return []
    return [f"{decision['id']}: missing {field}" for field in DECISION_FIELDS if not decision.get(field)]

How to check

The build fails when a decision type in a covered area lacks a notice text, an appeal route, a reviewer role or an access explanation. An end-to-end test appeals a denied application, and a reviewer account changes the outcome.

Sources

• California Privacy Protection Agency rules on automated decisionmaking technology
• GDPR Article 22 on automated decisions

Related rules

• Let a person decide what matters in AI features
• Assess risky processing for US laws too in Compliance