AIG-03AI and Automated Decisions
Human oversight and disclosure
People affected by automated decisions are told, and a competent person can intervene.
Why it exists
Automation without a human path becomes a wall.
What usually proves it
Disclosure text, oversight procedure, intervention records.
Smaller organizations
Say when a model was used and who to ask.
Mapped to
- Deliberately absentSOC 2 Trust Services Criteria — No AI-specific criteria.
- Deliberately absentISO/IEC 27001 Annex A — Not addressed.
- Deliberately absentNIST Cybersecurity Framework — Not addressed.
- Deliberately absentPCI DSS — Out of scope.
- Deliberately absentHIPAA Security Rule — Out of scope.
- Fully addressedGDPR · Art. 22(3)
- Fully addressedEU AI Act · Art. 14, 50
- Fully addressedNIST AI Risk Management Framework · GOVERN 3.2