Make AI Decisions Possible to Challenge

The UK regulator's overview says the data-protection provisions of the Data (Use and Access) Act are in force. Its detailed automated-decision guidance, however, still identifies itself as draft guidance. The distinction matters: legislation and a regulator's developing interpretation are not the same source of obligation. ²

That detailed guidance addresses decisions based solely on automated processing with legal or similarly significant effects. It distinguishes meaningful human involvement before a decision from human intervention requested afterwards. Its safeguards explain how people can offer information, contest a decision and obtain a review that may change it. Do not assume that occasional staff spot checks provide that individual route. ³

In the EU, AI Act Article 86 concerns explanations for specified consequential decisions based on Annex III high-risk systems, excluding point 2. It contains exceptions and avoids duplicating rights already supplied by other Union law. It is not a universal right to a human appeal for every AI output. The Act's phased application rules also need checking for the deployment concerned. [4, 5]

Brazil's LGPD Article 20 provides a right to request review of decisions based solely on automated personal-data processing that affect a person's interests. The current wording does not expressly require review by a natural person. ANPD's work on interpreting this article remains ongoing. Do not copy the UK formulation into a Brazilian compliance statement without checking the local basis. [6, 7]

The Institute's recommendation goes beyond choosing the right notice. Treat the challenge route as part of the service. Explain the decision in language the person can use, identify how to raise a concern and make clear what information could help. A general description of the model may not explain why this particular case turned out as it did.

Accept a challenge through a channel the affected person can use. That may require a phone option, accessible forms, language support or help from a representative. Avoid requiring people to understand your supplier structure or select the correct technical category before anyone takes responsibility for the case.

Set the response owner and the timing before launch. The appropriate deadline depends on law, sector and the harm that delay could cause. A routine preference recommendation and a decision affecting access to an essential service should not share a queue simply because both use AI.

Decide which consequences can be paused while a challenge is examined. That is a risk and service decision, not a promise that every appeal must succeed. Tell the person what will happen during review and what options remain if they disagree with the response.

Make the original inputs, relevant rules, system version and decision record available to the authorised reviewer. Include the person's new evidence. Agree with suppliers how records will be retrieved when a result is challenged; access should not depend on finding a helpful engineer after the event.

Keep only what is needed and permitted, with access controls and a defined retention policy. An appeal process is not a reason to store every conversation indefinitely. Privacy and confidentiality obligations still apply to the evidence used for review.

New research offers a useful warning. BLADE, a preprint submitted on 13 October, studies how information is used at handoffs between AI agents. Its tests cover 1,228 failed benchmark runs. Automated analysis improved error attribution in that setting, but did not make it reliably correct in every case. It is a tool for investigation, not proof of legal responsibility. ⁸

The reviewer therefore needs authority as well as information: to reject a faulty recommendation, correct a record, restore a service or escalate a disputed case. Separate the explanation of how a result arose from the judgment about what should happen now. An AI-written account should not become its own independent evidence.

The practical questions travel: who receives the challenge, what can they see, and what can they change? The legal answers do not travel unchanged. UK automated-decision safeguards, EU explanation rights and Brazilian review rights have different triggers and limits. Other privacy, employment, education and consumer rules may also matter.

For operations in North America, Asia-Pacific, Africa or the Middle East, map the applicable rights and sector rules rather than assuming the examples here cover them. This brief does not establish a comparative legal position for every market. That gap should stay visible in a rollout plan.

Institutional capacity matters too. A small service team may need a shared specialist reviewer; a multilingual service may need different submission routes. Test these arrangements with the people expected to use them. A process that works for an English-speaking employee on a laptop may fail for a customer using a phone or assistive technology.

Choose one consequential workflow and run a clearly labelled test case through its existing challenge process. Use an authorised tester and safe data. Start at the decision notice, not an internal support shortcut. Introduce missing or incorrect information and watch how the case reaches someone able to reconsider the outcome.

Follow any correction into downstream records and actions. Closing a support ticket does not prove that a ranking, restriction or customer record changed. Record the evidence of completion and the response given to the person.

Measure whether people can enter and complete the process, how long reviews take, why decisions change and whether the same fault recurs. A low complaint count may mean few problems—or a route nobody can use. Fund the missing review capacity before expanding the volume of consequential decisions.