NIST AI RMF, MeasureMEASURE 2.9

If you are a lender and your creditworthiness assessment involves automated processing of personal data, let the consumer demand and obtain human intervention on your side: give clear and comprehensible explanations of the assessment, including the logic and risks of the automated processing, let the consumer state his or her own view, and review the assessment and the decision to grant the credit when the consumer asks (section 17(5)).

For models using advanced techniques such as AI/ML, model owners should consider the level of transparency and explainability required, the need for alternative controls, and the potential for biased outcomes, negative social and ethical implications or privacy risks.

Give the consumer on request a clear and comprehensible explanation of the assessment, including the logic and risks of the automated processing and its significance and effects on the decision (Article 30(1), point 1).

If you are a digital labour platform or aggregator that employs workers and manages their work through an algorithm-based automated system, tell the worker how work is organised on the platform and how decisions are made in the system (Article 221.g(1), point 1).

If you are a creditor and your creditworthiness assessment uses automatic processing of personal data, let the consumer request and obtain human intervention: give a clear and comprehensible explanation of the assessment, including the logic and risks of the automatic processing and its effect on the decision, let the consumer express a view, and review the assessment and the credit decision when the consumer asks (Credit Agreements Act, section 7 c(9)).

Institutions should understand the underlying models used, including their capabilities, assumptions and limitations, and ensure their traceability, auditability, and robustness and resilience, and ensure that the models are fit for purpose, giving consideration to developing an interpretable model if explanations are required during the models' use (paragraph 53(c) and (d)).

When using automated models for creditworthiness assessment and credit decision-making, institutions should understand the models used, and their methodology, input data, assumptions, limitations and outputs (paragraph 54).

On the worker's request, have a natural person give an intelligible reason for the decision, including how far AI systems affected the decision process and the main parameters considered.

The CBJ expects AI systems with material impact on customers, such as credit scoring or anti-fraud measures, to produce explainable outputs, and expects you to notify customers clearly and prominently, at the point of interaction, that they are interacting with AI-driven systems (section 2.2).

It reaches you if you are licensed by the Financial Services Commission of Mauritius as an insurer, a wealth manager or another non-bank financial institution (NBFI): the Commission says that, in accordance with section 38 of the Data Protection Act 2017, you are required to ensure that data subjects are informed that automated decision-making processes exist, that meaningful information is provided on their logic, criteria and significance, and that individuals can obtain human intervention, express their views and contest the outcome.

If you are an employer, give the worker the parameters, criteria, rules and instructions on which algorithms or other artificial intelligence systems are based that affect decisions on access to and retention of employment and working conditions, including profiling and monitoring of professional activity (Article 106(3), point s)).

Give that information on paper or in electronic form within one month of the start of the contract (Article 107(4)).

Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling, and disclose the underlying logic and the significance and consequences of such processing when the person asks.

Provide, on request, clear and adequate information about the criteria and procedures used for an automated decision, subject to trade and industrial secrecy.

Where the processing relies on artificial intelligence, disclose to the data subject the criteria and the nature of the personal data behind the automated decision, from the moment you collect it.

On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.

Let a data subject obtain, at any time and without restriction, information about how an artificial intelligence system is processing their personal data.

Disclose to a data subject, on request, the logic underlying an automated decision taken about them under Article 65 and the significance and expected consequences of that processing.

Give the consumer the right to request and obtain from you a clear and comprehensible explanation of the assessment of creditworthiness, including on the logic and risks involved in the automated processing of personal data as well as its significance and effects on the decision (Article 18(8), point (a)).

Tell the data subject, when collecting their data (or, where the data came from another source, within the Article 14(3) period) and on any access request, that this kind of automated decision-making occurs, and give meaningful information about the logic involved, the significance, and the envisaged consequences.

Include in that information, for an automated decision-making system, the fact that it is in use or is in the process of being introduced, the categories of decision it takes or supports, the categories of data and the main parameters it takes into account and their relative importance, including the way the personal data or behaviour of the person performing platform work influence the decisions, and the grounds for decisions to restrict, suspend or terminate the account of the person performing platform work, to refuse the payment for work performed by them, as well as decisions on their contractual status or any decision of equivalent or detrimental effect (Article 9(1), point (b)), together with all categories of decision taken or supported by automated systems that affect persons performing platform work in any manner (Article 9(1), point (c)).

A person performing platform work has the right to obtain an oral or written explanation from you for any decision taken or supported by an automated decision-making system without undue delay, provided in a transparent and intelligible manner, using clear and plain language (Article 11(1)).

Let a person know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, tell them the criteria and the nature of the personal data behind it from the point of collection.

When a consumer requests access to your use of ADMT to make a significant decision, respond with a plain-language explanation of the specified information about that use

Design and develop the system so that its operation is sufficiently transparent to enable deployers to interpret its output and use it appropriately, with a type and degree of transparency that supports compliance with the provider and deployer obligations of Section 3.

Provide the system so the assigned overseers can correctly interpret its output.

If you are the deployer of a high-risk AI system listed in Annex III, other than the Annex III point 2 critical-infrastructure use case, and your decision based on the system's output produces a legal effect, or similarly significantly affects a person in a way they consider to adversely impact their health, safety or fundamental rights, give that person, on request, a clear and meaningful explanation of the AI system's role in the decision-making procedure and the main elements of the decision.

Where such a system's output feeds a decision that could affect a person's rights, the user must publish or otherwise supply plain-language information about the system and, on request from an affected person, explain free of charge how that person's result was reached.

Where a high-risk AI system's decision affects a person's human rights, explain the result to the affected user in accessible language, covering the criteria and factors the decision relied on.

Establish and carry out a plan to explain, so far as technically feasible, your AI's final output, the main criteria it used to reach that output, and an overview of the training data you used to develop or use it.

Give the person an explanation of the key factors and criteria that influenced the decision, without disclosing the algorithm, source code or a legally protected secret.

If you are a trader making an offer to consumers individually, personalised on the basis of automated decision-making, inform them of the parameters used for the personalisation and, for offers on contracts for financial products or services, of the data sources used (Ley 3/1991, article 27, paragraph 9).

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).

If you profile a Minnesota consumer's data for a decision with legal or similarly significant effect, be prepared to answer the consumer's questions about why the profiling reached that result and what they could have done differently, not merely to honor an opt-out request.