UkraineDraft Law No. 8153, automated decision making
Draft Law No. 8153, arts. 18, 25 (automated individual decisions)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
What it requires
- Disclose your automated decision making mechanisms to a data subject in Ukraine, under Article 18.NIST Privacy FrameworkCM.AW-P1
- Do not base a decision that significantly affects a data subject in Ukraine solely on automated processing, including profiling, under Article 25.NIST Privacy FrameworkCT.DM-P10
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 18 of Draft Law No. 8153 would require a controller to disclose its automated decision making mechanisms to a data subject. Article 25 would prohibit a decision that significantly affects a data subject if that decision is based solely on automated processing, including profiling. The draft passed its first reading on , and the Verkhovna Rada's bill card records it as being prepared for second reading since .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .