---
title: "Give notice and an appeal before automated · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/automated-decision-rights
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give notice and an appeal before automated decisions

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: CMP-67
- Level: Required
- Chapter: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- Rule: Before software alone decides on credit, housing, education, work or health care, tell people in advance. Let them get an explanation and appeal to a person.
- Risk: A law broken
- How: California's rules on automated decisionmaking technology apply from 1 January 2027. They cover any decision that grants or denies credit, housing, education, work or health care. Show a pre-use notice when you collect the data, or before you use data you already hold this way. Offer an opt-out, or an appeal to a reviewer who can change the decision. Stop processing for a person who opts out within 15 business days, and tell your service providers to do the same. Answer access requests with the purpose, the logic and how the output shaped the outcome. In the EU, GDPR Article 22(3) also asks for a review by a person and a chance to contest. Build the review as [let a person decide what matters](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/human-decides) describes. Screen each decision type in the [US risk assessment](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments) too.
- Check: The build fails when a decision type in a covered area lacks a notice text, an appeal route, a reviewer role or an access explanation. An end-to-end test appeals a denied application, and a reviewer account changes the outcome.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const COVERED_AREAS = ['credit', 'housing', 'education', 'employment', 'healthcare'];
const DECISION_FIELDS = ['preUseNotice', 'appealRoute', 'reviewerRole', 'accessExplanation'];

export const decisionProblems = decision => COVERED_AREAS.includes(decision.area)
  ? DECISION_FIELDS.filter(field => !decision[field]).map(field => `${decision.id}: missing ${field}`)
  : [];
```

### Python example

```python
COVERED_AREAS = {"credit", "housing", "education", "employment", "healthcare"}
DECISION_FIELDS = ["pre_use_notice", "appeal_route", "reviewer_role", "access_explanation"]

def decision_problems(decision: dict) -> list[str]:
    if decision["area"] not in COVERED_AREAS:
        return []
    return [f"{decision['id']}: missing {field}" for field in DECISION_FIELDS if not decision.get(field)]
```

## Sources

- [California Privacy Protection Agency rules on automated decisionmaking technology](https://cppa.ca.gov/regulations/ccpa_updates.html)
- [GDPR Article 22 on automated decisions](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- [Let a person decide what matters](https://agentwranglers.se/playbook/ai-features/guardrails-and-human-review/human-decides) in AI features
- [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/automated-decision-rights">Agent Wranglers compliance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws)
- [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)