NIST AI RMF, MeasureMEASURE 3.3

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly serious effects, unless a listed exception applies, and where an exception does apply, let them obtain human intervention, express their view, and contest the decision.

Honour a data subject's right to object to automated decision-making.

Do not base a decision that produces legal effects concerning a person, or significantly affects them, solely on automated processing, including profiling, unless a listed exception applies, and where one does, let the person obtain human intervention, express their point of view, and contest the decision.

Let a data subject request review of any decision made solely on automated processing of their personal data, including a decision that defines their personal, professional, consumer, or credit profile or an aspect of their personality.

Do not base a decision that produces legal effects on a person, or significantly affects them, solely on automated processing of their personal data, including profiling, unless a statutory or consent-based exception applies with human-intervention, expression and contestation safeguards.

If the assessment of creditworthiness is based on automated processing of data, inform the consumer of that fact, of the consumer's right to human assessment and of the procedure for contesting the decision; Article 18(9) places this information duty in the paragraph on a rejected credit application (Article 18(9), second sentence).

Where a decision referred to in Article 11(1) infringes the rights of a person performing platform work, rectify it without delay and in any case within two weeks of its adoption; where rectification is not possible, offer adequate compensation for the damage sustained; and in any event take the steps necessary, including, if appropriate, the modification of the automated decision-making system or the discontinuation of its use, in order to avoid such decisions in the future (Article 11(3)).

Do not subject a person to a decision based solely on automated processing, including profiling, without letting them oppose it.

Where a data subject, within twenty-one days after you notify them of a solely automated decision, requires you in writing to reconsider it, reconsider the decision and, within twenty-one days after receiving their notice, tell them in writing what steps you intend to take to comply.

Where a decision based solely on automated processing about a person in Ireland rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).

Where an Irish enactment authorises or requires a solely automated decision about a person and the decision does not simply grant what they asked for, let them make representations, request human intervention and appeal the decision, and tell them in writing the steps you took and, on appeal, the outcome, under Data Protection Act 2018 section 57.

If you are a lender and your creditworthiness assessment involves automated processing of personal data, let the consumer demand and obtain human intervention on your side: give clear and comprehensible explanations of the assessment, including the logic and risks of the automated processing, let the consumer state his or her own view, and review the assessment and the decision to grant the credit when the consumer asks (section 17(5)).

In each such communication, give clear instructions describing how the patient can reach a human health care provider or other appropriate person

If you are a creditor and your creditworthiness assessment involves automated processing of personal data, tell the consumer so in writing, and tell the consumer of the right to a human assessment (Article 30(1)).

Let the consumer express a view, and give the consumer on request a review of the assessment and of the decision to grant credit (Article 30(1), points 2 and 3, and Article 30(2)).

Appoint an authorised person who reviews decisions made in the automated management system when a worker asks, and who decides on them (Article 221.g(1), point 4).

When a worker says a decision made in the automated management system has violated an employment right, give the worker protection of the right, a written explanation and a review of the decision (Article 221.i(1)).

If you are a creditor and your creditworthiness assessment uses automatic processing of personal data, let the consumer request and obtain human intervention: give a clear and comprehensible explanation of the assessment, including the logic and risks of the automatic processing and its effect on the decision, let the consumer express a view, and review the assessment and the credit decision when the consumer asks (Credit Agreements Act, section 7 c(9)).

Inform the consumer of those rights (section 7 c(10)).

The CBJ expects you to offer opt-out or alternative service options to customers who prefer not to interact with AI-driven systems, without compromising their access to essential banking services, to let customers access, correct and request deletion of their personal data where applicable, and to keep open channels for customers to question and appeal AI decisions that affect them (sections 2.3 and 2.4).

It reaches you if you are licensed by the Financial Services Commission of Mauritius as an insurer, a wealth manager or another non-bank financial institution (NBFI): the Commission says that, in accordance with section 38 of the Data Protection Act 2017, you are required to ensure that data subjects are informed that automated decision-making processes exist, that meaningful information is provided on their logic, criteria and significance, and that individuals can obtain human intervention, express their views and contest the outcome.

The Commission advises you to give customers clear and understandable information on how algorithms are used for decision-making, a clear channel to seek information and raise concerns, and an effective grievance redress mechanism for complaints about AI-driven decisions.

A QCB-regulated entity must give a customer a mechanism to raise inquiries about an AI-driven decision affecting them and request a review of it.

When your answering machine, conversational bot or similar means handles a customer's query, complaint, claim or incident report by telephone or electronic means, let the customer request personalised attention from the options of your main menu at any time from the start of the interaction (article 8(2)).

If your credit assessment involves automated processing of personal data, on the consumer's request review the assessment through human involvement, explain it and the significance of the automated processing for the decision on the application, and inform the consumer of the risks of automated processing (Chapter 3, section 15, first paragraph).

Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.

Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.

Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.

Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.

Communicate to the persons concerned a decision with significant impact on them that you take through algorithms, and keep it open to appeal and audit as the law provides (Article 9(2)).

If you operate a social media platform, provide an easily accessible complaint system letting a user report explicit deep fake material, alongside illegal content and content-removal decisions.

Give clear, conspicuous, plain-language notice of that complaint system and how to use it.

Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.

If you operate a covered platform under 47 U.S.C. Sec. 223a, set up a process letting a harmed individual or the Attorney General notify you of such an image and request its removal.

Post a clear and conspicuous notice describing that removal process in plain language.

If you operate a covered platform, one that primarily hosts user-generated content or that in the regular course of business publishes, hosts, or makes available nonconsensual altered sexual depictions, establish a process for a depicted person to request removal and post a clear and conspicuous notice describing it.

You must provide an easily accessible system for a depicted person to request removal, and a clear, plain-language notice describing that process and your responsibilities under it.

Give users a clear way to report a non-consensual counterfeit intimate image and remove a reported image within 48 hours of notice, if you operate a covered platform

Give the person a way to challenge the decision before a competent natural person who can confirm, modify or revoke it.

In that notification, confirm that AI was involved, explain the role it played, and give the person a way to challenge the decision.

Offer an easy-to-use function for flagging that content

Allow the person to demand review of the decision by an authorised specialist where it carries legal consequences or can affect their rights and legitimate interests.

Document information about an AI system and its usage, make it available to affected persons so they can challenge a decision made through or substantially based on the system, and provide an effective way to complain to a competent authority.

Provide a mechanism for an applicant to request a reasonable accommodation where an automated tool screens applicants based on a schedule requirement.

Inform the affected individual and any covered agent within 10 days that a high-risk AI system has been used to make a consequential decision, and provide and explain a process to appeal it (Section 108(2)(a)).

Preserve the individual's option to request human review of the decision.

Let a person exercise access, rectification, erasure, objection, processing-limitation, portability, and revocation rights over their personal data, and let them object to being subject to a fully automated decision.

Do not base a decision that significantly affects a data subject solely on automated processing of their personal data without notifying them and honouring a request to reconsider.