NIST AI RMF, MapMAP 3.5

Do not base a decision that produces legal effects on a person, or significantly affects them, solely on automated processing of their personal data, including profiling, unless a statutory or consent-based exception applies with human-intervention, expression and contestation safeguards.

Do not make a decision based solely or partly on automated processing, including profiling, that produces legal or similarly significant effects for a data subject, and give heightened protection where the data subject is a child or adolescent.

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law, code or scientific standard with safeguards in place.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.

If your creditworthiness assessment involves the use of automated processing of personal data, give the consumer the right to request and obtain human intervention from you (Article 18(8)).

Do not subject a natural person to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless it is necessary to enter into or perform a contract with them, is authorised by a law that itself safeguards their rights, or rests on their explicit consent.

Do not subject a person to a decision based solely on automated processing, including profiling, without letting them oppose it.

Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.

Give a data subject the right to demand that a decision significantly affecting them is not based solely on automated processing of their personal data, and notify them as soon as reasonably practicable when such a decision is taken without a prior notice.

Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.

Do not subject a data subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, unless the decision is necessary to a contract with them, authorised by a law with suitable safeguards, or authorised by their consent.

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.

Do not base a decision that has a legal effect on a person, or that significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except where taken under a contract at their request or under a law with safeguards in place.

Do not base an administrative or private decision assessing a person's conduct solely on automated profiling.

Do not base a decision producing legal effects for a person solely on an automated processing designed to profile them or evaluate aspects of their personality.

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality.

Do not subject a person to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, and where a carve-out applies, give them human intervention, a chance to express their point of view and a way to contest the decision.

Do not base a decision that produces legal effects for a person or significantly affects them solely on automated processing, including profiling, unless a listed exception applies, and where it does, guarantee at least the right to obtain human intervention, express a view, and contest the decision.

Do not base a decision producing legal effects on a person solely on automated processing meant to profile them or evaluate an aspect of their personality, except a decision taken in forming or performing a contract where the person could comment, or one that grants the person's own request.

Do not base an administrative or private decision assessing a person's behaviour or personality solely on automated processing, unless the person gave explicit consent, it is necessary to enter into or perform a contract with them, or a law or regulation otherwise authorizes it.

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.

Do not subject a data subject to a decision based solely on automated processing of their personal data that produces a negative legal effect or a detriment to a right, unless they consented, the decision is necessary to perform a contract, or a special law authorizes it.

Do not base a decision that has legal effects on a person, or significantly affects them, solely on an automated evaluation of their personality or conduct, outside a contractual relationship or a public-entity entry evaluation, and let them state their own view.

Do not base a decision producing legal effects for a person solely on automated processing intended to define their profile or evaluate aspects of their personality, unless the decision arises from concluding or performing a contract on which the person had a chance to comment, or it grants their own request.

Do not make a decision that produces legal consequences for a Russian data subject, or otherwise affects their rights and legitimate interests, solely on the basis of automated processing of their personal data, unless they consented in writing or a federal law that protects their rights provides for it.

Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.

Where a decision based solely on automated processing about a person in San Marino rests on a contract with them or on their explicit consent, put appropriate measures in place to safeguard their rights, freedoms and legitimate interests, at least the right to obtain human intervention, to express their point of view and to contest the decision, under Article 22(3) of Law No. 171 of 2018.

Do not subject a person to a decision that affects their legal situation or affects them significantly based solely on automated processing that assesses their personality, professional capacity, credit, trustworthiness or behavior, unless the decision is taken in connection with a contract and the person's request for the contract has been satisfied or appropriate measures safeguard their legitimate interests, or a law authorizing it establishes measures guaranteeing the data holder's legitimate rights and interests.

Do not base a decision producing legal effects for a person solely on automated profiling or an automated evaluation of their personality, except where they had the chance to make observations or the decision grants their own request.

Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.

Do not base a decision that produces legal or similar significant effects on a person solely on automated processing, including profiling, unless a contract, a written law with safeguards, or the person's consent authorises it.

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and never base such a decision on special categories of personal data unless a narrow exception applies with appropriate safeguards.

Do not base a decision producing legal effects concerning a person solely on an automated evaluation of their personal characteristics or profile, except a contractual decision on which they could state their views or one granting their own request.

Let a data subject avoid a decision based solely on automated processing.

Do not base a decision that significantly affects a data subject solely on automated processing where they have given written notice against it, and where such a decision is made, notify the data subject and reconsider it within twenty-one days of their written request.

Do not base a decision that significantly affects a data subject in Ukraine solely on automated processing, including profiling, under Article 25.

Where you take a significant decision about a person in the United Kingdom based solely on automated processing of their personal data, have safeguards in place that give them information about the decision, let them make representations about it, let them obtain human intervention, and let them contest it, under UK GDPR Article 22C.

Do not take a significant decision based solely on automated processing where your processing for it relies in any part on the recognised legitimate interests basis in UK GDPR Article 6(1)(ea), and base one on special category data only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and the Article 9(2)(g) substantial public interest condition applies, under UK GDPR Article 22B.

Do not subject a data subject to a decision based solely on automated processing, including profiling.

Do not subject a data subject to a decision based solely on automated processing that has legal or similarly significant effects without human intervention.

Where an automated decision rests on a contract, a written law or explicit consent, put suitable safeguards in place, including the right to obtain human intervention, to put a point of view and to contest the decision, and do not process sensitive personal data automatically at all unless the data subject expressly consented, the processing is in the public interest, or a written law permits it with safeguards.

Share information generated through the use of artificial intelligence, machine learning technologies or algorithms within the partnership only where those processes were subject to adequate human oversight (Article 75(4), point (g)).

If you use online tools, let the consumer request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract is concluded, in the same language as the pre-contractual information (Article 16d(3)).

Institutions should have in place control mechanisms, model overrides and escalation procedures within the regular credit decision-making framework, including qualitative approaches, qualitative risk assessment tools (including expert judgment and critical analysis) and quantitative limits (paragraph 54(d)).

Do not let such a system issue an adverse coverage determination on its own; have a natural person qualifying as a private review agent or utilization review entity conduct the utilization review, with a clinical peer participating, before any adverse determination issues.

Do not let the system supersede the clinical peer's judgment.

If you use AI systems in decisions about the employment relationship, do not take the final decision to create, change or end it, including a disciplinary measure or a performance evaluation, solely on automated processing, and reserve it to a natural person with effective and autonomous power.

Do not rely on the worker's consent to take such a final decision solely on automated processing.

The CBJ expects human-in-the-loop and human-on-the-loop mechanisms in proportion to the criticality and risk of each AI system, direct human oversight and intervention for critical systems, fallback procedures or human review, and contingency strategies including a kill switch (sections 5.2 and 5.4).

It reaches you if you are licensed by the Financial Services Commission of Mauritius as an insurer, a wealth manager or another non-bank financial institution (NBFI): the Commission says that, in accordance with section 38 of the Data Protection Act 2017, you are required to ensure that data subjects are informed that automated decision-making processes exist, that meaningful information is provided on their logic, criteria and significance, and that individuals can obtain human intervention, express their views and contest the outcome.

The Commission advises you to include human oversight in critical decision-making processes and to define clearly who is responsible for an AI system across its entire life cycle, without changing the supervisory expectations that already apply to your governance.

If you are a utilization review organization, do not use automated processing alone, without a clinician review by an appropriate health professional, to make an adverse determination on a health care service, admission, or extension of stay.

Independently review the accuracy of any report, data or other information an AI system compiles, summarizes, analyzes or generates for those administrative purposes.

If you are an insurer in the business of homeowners, flood, or automobile insurance in New Jersey, do not use artificial intelligence to make the final decision to deny a claim filed under an automobile, homeowners, or flood insurance policy.

A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.

If you are a health care practitioner using AI for diagnostic purposes, including AI-generated recommendations on a diagnosis or course of treatment, stay within the scope of your license, do not use AI in a way state or federal law otherwise restricts, and review all AI-created records consistent with Texas Medical Board standards.

If you are a utilization review agent, do not use an automated decision system, including one that incorporates an AI system, to make an adverse determination wholly or partly; an algorithm, AI system or automated decision system may still be used for administrative support or fraud detection.

Keep AI and ML systems under meaningful human oversight and judgement, particularly for decisions with significant implications for consumers, set the level of human involvement by the risk to the consumer, and use operation without direct human involvement only for low-risk, non-material processes with appropriate controls in place (Sections 7(a) and 7(b)).

Let consumers request human review or an explanation of AI generated decisions, make alternative arrangements available where a customer does not wish to be subject to an AI decision, inform consumers of their right to challenge decisions and correct inaccurate data inputs that affect AI, and maintain clear and accessible channels for complaints and redress in line with Article 8 of the Consumer Protection Regulation (Section 7(c)).

Base an adverse preauthorization determination on clinical or medical necessity on independent medical judgment, not solely on a recommendation from any other source

Keep a health care provider in the determination process; the tool may not replace that role.

Do not let an artificial intelligence-based algorithm be the sole basis of a decision to deny, delay, or modify a health care service based, in whole or in part, on medical necessity.

Provide human management and supervision of your high-impact AI.

Where the app's output feeds a legally significant decision affecting a person's rights or freedoms, the decision may not rest exclusively on the AI-based resource's or system's conclusions.