Adverse action under algorithmic discrimination law
An explanation obligation is easy to state and hard to satisfy retrospectively. If the system did not record what drove a particular decision and what the reviewer considered, the explanation produced later is a reconstruction.
What do algorithmic discrimination laws require for an adverse decision?
A per-decision explanation: the principal reasons, the data used, and how to correct it or seek review. That requires knowing which inputs were present and which factors drove the outcome for that specific decision — which is only possible if it was captured when the decision was made.
- Deployer obligations are per-decision: explain this outcome, to this person, with the factors that drove it.
- Impact assessments operate at the system level and do not answer questions about individual decisions.
- A record capturing the output, what the reviewer saw, and their reasoning serves both the explanation duty and the diligence defence.
Part of AI oversight and regulation
Two obligations at two levels
| Level | Obligation | Artefact |
|---|---|---|
| System | Impact assessment, risk management programme, disclosure | Documents, reviewed periodically |
| Decision | Explanation of an adverse outcome, opportunity to correct or appeal | Per-decision records |
Organisations preparing for these laws tend to invest heavily in the first row, because it is familiar work that resembles a privacy impact assessment. The second row is where the operational gap sits.
What an explanation has to contain
Statutory phrasing varies; the substance is consistent. A consumer subject to an adverse decision should learn the principal reasons, the data used, and how to correct it or seek review.
That requires knowing, for a specific decision, which inputs were present and which factors drove the outcome. If the system logs only an outcome, an explanation generated afterwards is inferred from a model's general behaviour rather than from that decision.
Why reconstruction is fragile
- The model changed. Retraining, version updates and feature changes mean the current model is not the one that decided.
- The inputs changed. Source data is updated. Re-scoring today produces different values.
- The explanation method is approximate. Post-hoc attribution gives an approximation of factor influence, and different methods disagree.
- The human step is unrecorded. If a reviewer confirmed the outcome, their reasoning is usually nowhere.
Each of these is defensible individually. Together they mean a business explaining a decision from eight months ago is describing what the system probably did.
Capturing at decision time
{
"decision_id": "D-2026-88213",
"at": "2026-01-14T09:41:00Z",
"system": { "name": "underwriting-v4", "version": "4.2.1",
"model_digest": "sha256:9c1f...a83e" },
"inputs_digest": "sha256:2b7d...4056",
"outcome": "adverse",
"principal_factors": [
{ "factor": "payment_history", "direction": "negative" },
{ "factor": "credit_utilisation", "direction": "negative" },
{ "factor": "account_tenure", "direction": "negative" }
],
"human_review": {
"rendered_digest": "sha256:d7b2...1f8a",
"reviewer": "[named individual]",
"considered_alternatives": true,
"rationale": "[free text]",
"decision": "upheld"
},
"signature": "..."
}Recording the model digest and the inputs digest is what makes this durable. Years later you can state exactly which model version and which input set produced the outcome, without needing either to still exist in production.
The diligence dimension
These statutes typically provide that a deployer who exercised reasonable care is in a better position. Reasonable care is demonstrated by evidence, not asserted.
- Impact assessments performed and acted upon
- Outcome monitoring across protected categories, with results
- Human review at defined points, with records showing it operated
- Override rates that indicate review is substantive
- Response to identified disparities, with dates
The third and fourth items are where per-decision records do double duty. They serve the explanation obligation and they evidence that the oversight programme functioned.
What to do without waiting for final rules
Rulemaking under these statutes is ongoing and effective dates have moved. Three things are worth doing regardless, because every plausible version requires them.
- Record the model version and inputs digest with every consequential decision. Cheap, and it makes everything else possible.
- Capture what human reviewers were shown, as a digest of the rendered content.
- Make rationale mandatory on adverse outcomes and overrides.
None of these depends on how the final rules read. All of them are difficult to add retrospectively, which is the argument for doing them now.
This describes regulatory structure at a general level and is not legal advice. Applicability, definitions, exemptions and effective dates vary and change; take specifics to counsel.
Why reconstruction fails
| Reason | Effect |
|---|---|
| The model changed | Retraining and version updates mean the current model is not the one that decided |
| The inputs changed | Source data is updated; re-scoring today produces different values |
| Attribution is approximate | Post-hoc methods give an approximation, and different methods disagree |
| The human step is unrecorded | If a reviewer confirmed the outcome, their reasoning is usually nowhere |
Each is defensible on its own. Together they mean a business explaining a decision from eight months ago is describing what the system probably did.
Objections and honest limits
“Our impact assessments cover this.” They operate at the system level. An explanation obligation attaches to an individual decision, and no assessment answers it.
“The rules are not final, so we should wait.” Recording a model version and inputs digest is cheap, survives any rulemaking outcome, and cannot be added retrospectively. Waiting costs you the decisions made in the meantime.
Reasonable care is demonstrated by evidence, not asserted. Outcome monitoring across protected categories, human review with records showing it operated, override rates indicating the review is substantive, and dated responses to identified disparities.
Three things worth doing before the rules settle
- Record the model version and inputs digest. With every consequential decision. Cheap, and it makes durable explanation possible.
- Capture what human reviewers were shown. As a digest of the rendered content.
- Make rationale mandatory on adverse outcomes and overrides. These are the decisions that get examined.
Terms used here
- Algorithmic discrimination
- An unlawful differential outcome produced or contributed to by an automated system, which these statutes require deployers to guard against.
- Deployer
- The party using a high-risk system in its own decisions, as distinct from the developer. Most obligations attach here.
- Principal reasons
- The factors that drove an adverse outcome, which an explanation obligation requires be communicated to the affected person.
Frequently asked questions
Do impact assessments satisfy the explanation duty? No. They operate at the system level. Explanation obligations attach to individual decisions and require per-decision records.
Why can't we reconstruct explanations later? The model version and input data change, post-hoc attribution is approximate and method-dependent, and the human reviewer's reasoning is usually unrecorded.
What is the cheapest first step? Record the model version and an inputs digest with every consequential decision. It is small work and makes durable explanation possible.
Is this legal advice? No. Applicability, definitions, exemptions and effective dates vary by state and continue to change. Take specifics to counsel.
Why can't explanations be reconstructed later? Model versions and input data change, post-hoc attribution is approximate and method-dependent, and the reviewer's reasoning is usually unrecorded.
Where this fits in Manav
Manav's decision receipt fixes the model digest, the inputs digest, the principal factors and the reviewer's rationale at the moment of the decision, so an explanation years later is a retrieval rather than a reconstruction.
Sources and further reading
- Colorado SB24-205 — Consumer Protections for Artificial Intelligence (signed act)
- Regulation B (12 CFR Part 1002) — Equal Credit Opportunity Act
- NIST AI Risk Management Framework 1.0
- Published guidance on post-hoc explanation methods and their limitations.