What California's automated decision rules ask of human review
The operative phrase is not that a human was involved. It is that the review was meaningful, performed by someone with authority to change the outcome — and that is a claim a business has to be able to support.
What records does California's ADMT framework require for human review?
Per-decision ones. A consumer asking about the decision made about them in March is asking about a single record. “Meaningful human review” generally implies a reviewer who understood the output, had authority to change it, and considered the individual's circumstances — each of which needs evidencing.
- Consumer rights around automated decisions create per-decision questions, which need per-decision records.
- 'Meaningful human review' generally implies a reviewer who understood the output and had authority to change it — both of which need evidencing.
- A record capturing the rendered output, the reviewer's identity and their rationale answers the question directly.
Part of AI oversight and regulation
Why this is harder than a policy
Most privacy obligations are satisfied at the programme level: a notice, a process, a documented retention schedule. Automated decision rights are different because they attach to a specific decision about a specific person.
A consumer asking about the decision made about them in March is asking a question about one record. A well-written policy does not answer it.
What 'meaningful' tends to require
| Element | Implication for records |
|---|---|
| A human reviewed the output | Identify the natural person, not an account |
| They had authority to change it | Show the reviewer's role permitted a different outcome |
| They considered the individual's circumstances | Capture what was presented and any rationale |
| The review was not a formality | Overrides actually occur; the rate is itself evidence |
The last row is worth dwelling on. A review process with a zero per cent override rate across thousands of decisions invites the conclusion that the review was nominal. Businesses should know their override rate before a regulator calculates it for them.
The gap in typical systems
Review interfaces in decisioning systems usually write a status field and an actor identifier. Three things are typically absent.
- What was shown. The reviewer saw a screen. The screen's contents are not recorded, so what they considered cannot be reconstructed.
- Who the person was. An account identifier resolves to an account. Establishing a natural person behind it at that moment is a separate step.
- Why. Free-text rationale is often optional and therefore usually empty.
A record that answers the consumer's question
{
"decision_id": "D-2026-88213",
"subject_ref": "[pseudonymous reference]",
"automated_output": {
"outcome": "decline",
"principal_factors": ["payment_history", "utilisation", "tenure"]
},
"review": {
"rendered_digest": "sha256:9c1f...a83e",
"reviewer": "[named individual]",
"reviewer_role": "Senior Underwriter — authorised to override",
"decision": "upheld",
"rationale": "[free text]",
"reviewed_at": "2026-05-19T10:14:02Z",
"dwell_seconds": 94
},
"signature": "...",
"credential": { "user_verified": true }
}A note on dwell_seconds: it is useful and easily over-read. A short dwell on a clear-cut case is appropriate, and a long dwell may mean the reviewer stepped away. It is context for a conversation, not a metric to enforce.
Responding to a request
With records of this shape, a consumer request becomes a retrieval rather than an investigation.
- Which decision, and when
- Whether it was fully automated or reviewed
- Who reviewed it and in what role
- What the reviewer was shown and what they concluded
- Whether the outcome was changed
Without them, responding means reconstructing from logs and asking people what they remember about a case from four months ago, which is both expensive and unconvincing.
Interaction with other frameworks
Businesses subject to several regimes should not build separate records for each.
| Framework | Overlapping demand |
|---|---|
| California ADMT rules | Meaningful human review, per decision |
| GDPR Article 22 | Human intervention in solely automated decisions |
| EU AI Act Article 14 | Oversight by natural persons, with records |
| Sector lending and insurance rules | Adverse action reasoning and reviewer accountability |
| State AI acts | Reviewer evaluation before adverse decisions |
The union of these is roughly one record: who reviewed, what they saw, what authority they had, what they decided and why. Build that once.
A practical starting point
Two changes, in order. First, capture the rendered output's digest at every review point — no authentication change required, and it is the element that makes every other record interpretable. Second, make rationale mandatory on overrides, where the question is most likely to be asked.
Signatures come third, on the decisions with legal or significant effect. Sequencing this way means each step is independently useful, which matters because regulatory timelines move.
This describes regulatory structure at a general level and is not legal advice. Applicability, definitions and timing are specific to your business; take them to counsel.
The override rate is evidence about you
A review process with a zero per cent override rate across thousands of decisions invites the conclusion that the review was nominal. Businesses should know their override rate before a regulator computes it for them, and should be able to explain the shape of it.
| Element | Record implication |
|---|---|
| A human reviewed the output | Identify the natural person, not an account |
| They had authority to change it | Show the role permitted a different outcome |
| They considered the circumstances | Capture what was presented, and any rationale |
| The review was not a formality | Overrides actually occur, at a defensible rate |
Objections and honest limits
“Dwell time proves engagement.” It does not. A short dwell on a clear-cut case is appropriate and a long one may mean the reviewer stepped away. Capture it as context for a conversation, never enforce it as a threshold.
“We need separate records for each regime.” No. California's ADMT rules, GDPR Article 22, the EU AI Act and sector lending rules converge on roughly one record: who reviewed, what they saw, their authority, the decision and why.
A practical starting point
- Capture a digest of the rendered output. No authentication change required, and it is the element that makes every other record interpretable.
- Make rationale mandatory on overrides. Where the question is most likely to be asked.
- Add signatures on significant-effect decisions. Legal or similarly significant effects, which is a minority of volume.
Terms used here
- ADMT
- Automated decision-making technology: the category California's rules attach opt-out and review rights to.
- Meaningful human review
- Review by a person who understood the output and could have decided otherwise — as distinct from a confirmation step.
- Significant effect
- A decision materially affecting a person's rights, finances or opportunities. The trigger for the strongest obligations across most regimes.
Frequently asked questions
What makes human review 'meaningful'? Generally that a person understood the output, had authority to change it, considered the individual's circumstances, and that the review is not a formality.
Is a zero override rate a problem? It invites the conclusion that review was nominal. Businesses should know their override rate before a regulator computes it.
Should dwell time be enforced as a metric? No. A short dwell on a clear case is appropriate and a long one may mean the reviewer stepped away. It is context, not a threshold.
Do we need separate records for each framework? No. The union of these regimes is roughly one record: who reviewed, what they saw, their authority, their decision and why.
What makes human review meaningful? Generally that a person understood the output, had authority to change it, considered the individual's circumstances, and that the review is not a formality.
Do we need separate records per framework? No. The union of the regimes is roughly one record, and building it once is materially cheaper.
Where this fits in Manav
Manav's review receipt carries the named reviewer, their authority, a digest of exactly what was rendered, the decision and the rationale — which is the union of what California, GDPR Article 22 and the EU AI Act each ask for.
Sources and further reading
- CPPA — CCPA regulations including ADMT
- GDPR Article 22 — automated individual decision-making
- Regulation (EU) 2024/1689 (AI Act) — consolidated text
- Sector guidance on adverse action notices and reviewer accountability.