Automated Decision Review Procedure

How to use this document

• What it is for. This is a base procedure to handle requests for explanation, human review and challenge of decisions made fully or partly by AI systems, and to review those decisions on the organization's own initiative when there are signs of error. It sets out triggers, owners, steps, timelines, response content and records.
• Who should own it. Usually Legal, with system owners carrying out the reviews and the Data protection officer (or the country's equivalent role) handling the link with data protection rights. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Relationship with other documents. This procedure is where human review, challenge, objection and opt-out are handled. The catalog of rights communicated to people is in the "AI User Rights Notice"; requests that only ask for an explanation are handled through the circuit in the "AI Transparency and User Explanation Policy" and come here when the person also asks for a review.
• Decisions to take first. Before adopting it, identify which decisions are covered (Section 4), who reviews each type of decision and with what authority (Section 10), which internal timelines apply (Section 13) and whether the effects of a decision are suspended during review (Section 8).
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [PRIVACY EMAIL], [REVIEW FREQUENCY] and [COMPLETE], and complete the table in Section 4. Keep [OPTIONAL] clauses only if they apply.
• Country variants. Keep the variant for each country where you make automated decisions about people and delete the rest. The variants state which right exists, what the response must contain, the competent authority and deadlines where the law sets them.
• Review. Ask counsel to confirm the grounds that allow solely automated decisions in your case, the applicable deadlines and the wording of the resolution template. In employment settings, consult worker representatives where the law requires it.
• Approval and publication. Have it approved by [AI COMMITTEE] or management, record the approval in "Version history," train reviewers and customer service, and link the request channel from your privacy and AI notices.

Automated Decision Review Procedure

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Procedure owner	[OWNER]
Request channel	[PRIVACY EMAIL] and [COMPLETE: web form or other channel]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]

1. Purpose

1.1 This procedure sets out how [ORGANIZATION NAME] handles requests from people who want to understand, discuss or challenge a decision made fully or partly by an automated system, and how it reviews those decisions on its own initiative.

1.2 Its aim is that the review is real: carried out by a competent person with access to the relevant information and the authority to confirm, change or reverse the decision, and documented.

2. Scope

2.1 It applies to decisions about individuals that:

a) are based solely on automated processing, including profiling, and produce legal effects or similarly significant effects on the person; or
b) are made with the support of an AI system whose output in practice determines the decision, because the decision-maker adopts it without their own assessment.

2.2 Examples: granting or denying credit or insurance, setting individualized prices or terms, hiring, promoting or dismissing people, assigning tasks or shifts, restricting, suspending or closing accounts, fraud detection that blocks a service, and access to benefits, education or essential services.

2.3 A score or classification produced by a third party that decisively determines the decision of [ORGANIZATION NAME] is included.

2.4 It does not apply to recommendations that a person reviews effectively and with real ability to depart from them, although the organization may voluntarily extend this procedure to such cases.