{
  "question": "How do I show a customer or regulator that a human reviewed an AI decision before it went out?",
  "slug": "how-to-show-a-customer-or-regulator-that-a-human-reviewed-an-ai-decision-before-it-went-out",
  "url": "https://www.rightshold.com/answers/how-to-show-a-customer-or-regulator-that-a-human-reviewed-an-ai-decision-before-it-went-out",
  "short_answer": "Keep three records and make their order checkable: what the AI produced, what the reviewer decided and when, and what was actually sent. Hash the AI's draft decision when it's produced, hash the final version when it's approved, and log the send with its time, so anyone can see the approval came before the send and covered exactly what was sent, including any edits. Regulators look past a click on 'approve'. Under GDPR Article 22, a decision with legal or similarly significant effects that is based solely on automated processing is restricted, and the EU data protection authorities' guidelines (WP251rev.01) say human involvement must be meaningful, 'rather than just a token gesture', by someone with the authority and competence to change the decision. So the record should also show what the reviewer saw, that they could change the outcome, and how often reviewers actually do. On Rightshold, record_ai_run seals the AI draft, request_human_approval binds the approval to a hash of the exact decision to be sent, decide_human_approval returns a signed, timestamped decision, and verify_human_approval lets the customer or regulator check it for free.",
  "checklist": [
    "Hash and timestamp the AI's draft decision when it's produced, with the model and inputs, before any human touches it. That's the baseline the review is measured against.",
    "Show the reviewer the draft, the inputs it was based on and anything the person affected sent in. Record what was shown (hashes of the case file and the draft), not just that a screen opened.",
    "Record the decision as a separate event: approve, change or reject, the reason, the reviewer's role and identity in your own system, and the time. If they changed it, hash the final version too, so the edit is visible as a different hash.",
    "Bind the approval to the exact decision being sent: hash the final decision text or object and require the send step to match it. An approval of draft A shouldn't let draft B go out.",
    "Log the send with its time and the final decision's hash. The approval time must come before it.",
    "Measure whether review is real: share of drafts changed or rejected, time spent per case, cases per reviewer per day. A reviewer who approves every draft in seconds is the 'token gesture' the guidelines warn about.",
    "Keep the records past the dispute window and the logging period your rules set. For high-risk systems, Article 26(6) of the EU AI Act requires deployers to keep the system's automatically generated logs for at least six months, unless other law provides otherwise.",
    "Write down which decisions skip review, why, and who signed off on that rule. A gap you documented is easier to defend than one found in an audit."
  ],
  "sections": [
    {
      "heading": "What 'reviewed by a human' has to mean",
      "points": [
        "GDPR Article 22(1) gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, with exceptions that come with safeguards such as the right to obtain human intervention and to contest the decision (Article 22(3)).",
        "The Article 29 Working Party's guidelines (WP251rev.01, endorsed by the EDPB) say a controller can't avoid Article 22 by fabricating human involvement: if someone routinely applies automated outputs without any actual influence on the result, it is still solely automated. The review must be meaningful, by someone with the authority and competence to change the decision, who considers all the relevant data. The CJEU's SCHUFA judgment (C-634/21, December 7, 2023) held that an automatically generated score can itself be an Article 22 decision when a third party relies on it decisively.",
        "Spain's data protection authority (AEPD) lists what to assess in a reviewer: competence to alter the outcome, training, independence, and the means to act, including information in time and enough time per case. Its example: 100 reports of 100 pages a day works out to about 21 pages a minute, which isn't feasible review."
      ]
    },
    {
      "heading": "The EU AI Act adds oversight and logging duties",
      "points": [
        "For high-risk AI systems, Article 14 requires that people assigned to oversight can understand the system's limits, stay aware of automation bias, correctly interpret its output, and decide to disregard, override or reverse it. Article 26 requires deployers to assign oversight to people with the necessary competence, training and authority, and to keep the system's logs. artificialintelligenceact.eu lists these high-risk rules as applying from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems.",
        "For remote biometric identification systems (Annex III point 1(a)), Article 14(5) goes further: no action may be taken on an identification unless at least two people with the necessary competence, training and authority separately verified and confirmed it, with limited exceptions.",
        "Outside the EU the vocabulary differs, but a customer's complaint or a regulator's inquiry asks the same questions: who looked, what did they see, could they change it, and did they look before it went out?"
      ]
    },
    {
      "heading": "Making the order and the content checkable",
      "points": [
        "Order: the AI run receipt and the decision receipt are timestamped by Rightshold's clock, not yours. Write the decision receipt id into your send log, so each send points at the approval it relied on. A send logged before its decision, or with no decision id, is visible as a failure, not a footnote.",
        "Content: the approval is bound to action_sha256, the hash of the canonical JSON of the decision to be sent. verify_human_approval checks a decision receipt and that the action you show matches what was approved, so a different decision can't ride on the same yes.",
        "Edits: when the reviewer changes the draft, the AI receipt's output hash and the approved action's hash differ, and that difference is the evidence that the human changed the outcome. Track the change rate over time; zero changes across thousands of cases is a finding in itself."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Before this AI-drafted claim denial goes to the customer, ask me to approve the exact final decision, tied to the AI run receipt for the draft, and wait for my yes or no.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "summary": "Send claim decision for case C-20418: partial approval, 60% of the claimed amount. AI draft receipt air_<id>; reviewer changed the draft from a full denial.",
        "action": {
          "type": "send_decision",
          "case_ref": "C-20418",
          "final_decision_sha256": "<sha256 of the final decision text>",
          "ai_draft_receipt": "air_<id>",
          "ai_draft_output_sha256": "<sha256 of the AI draft>"
        },
        "expires_in_minutes": 240
      }
    },
    "also": [
      "Needs an API key. The action is hashed (action_sha256) and only the summary is stored in clear, so keep personal data out of the summary and use your own case references.",
      "decide_human_approval takes the one-time token and an account key (delegated agent keys are refused), decides once, and returns a signed, timestamped decision receipt on the ledger. The receipt records that your account's key decided; record which person used it in your own system.",
      "verify_human_approval is free and needs no key: send the approval id for its status and receipts, or the receipt, signature and action to check that what was sent is what was approved. record_ai_run seals the AI draft beforehand, and verify_ai_run checks it."
    ],
    "scope": "Rightshold records the AI run, the approval request and the decision you send it, signs and timestamps them, and lets anyone check them. It doesn't see your case file, judge whether the review was meaningful, identify which person held the account key, or stop a decision that was sent without asking. Whether your process meets GDPR, the AI Act or a sector rule is for your counsel and regulator. Not legal advice."
  },
  "sources": [
    {
      "title": "Regulation (EU) 2016/679 (GDPR), Article 22",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "title": "Article 29 Working Party: Guidelines on Automated individual decision-making and Profiling (WP251rev.01)",
      "url": "https://ec.europa.eu/newsroom/article29/items/612053"
    },
    {
      "title": "AEPD: Evaluating human intervention in automated decisions (March 4, 2024)",
      "url": "https://www.aepd.es/en/press-and-communication/blog/evaluating-human-intervention-in-automated-decisions"
    },
    {
      "title": "CJEU: Case C-634/21, SCHUFA Holding (Scoring), judgment of December 7, 2023",
      "url": "https://curia.europa.eu/juris/liste.jsf?num=C-634/21"
    },
    {
      "title": "EU AI Act, Article 14: Human oversight",
      "url": "https://artificialintelligenceact.eu/article/14/"
    },
    {
      "title": "EU AI Act, Article 26: Obligations of deployers of high-risk AI systems",
      "url": "https://artificialintelligenceact.eu/article/26/"
    },
    {
      "title": "Verified AI Runs on Rightshold",
      "url": "https://www.rightshold.com/verified-ai-runs"
    }
  ],
  "related": [
    {
      "title": "How to audit which human authorized an AI agent action",
      "url": "https://www.rightshold.com/answers/how-to-audit-which-human-authorized-an-ai-agent-action"
    },
    {
      "title": "How to show a human the actual change before approving an AI agent action",
      "url": "https://www.rightshold.com/answers/how-to-show-a-human-the-actual-change-before-approving-an-ai-agent-action"
    },
    {
      "title": "How to require two independent approvals before an AI agent acts",
      "url": "https://www.rightshold.com/answers/how-to-require-two-independent-approvals-before-an-ai-agent-acts"
    },
    {
      "title": "How to prove which model version, prompt and settings produced an AI output",
      "url": "https://www.rightshold.com/answers/how-to-prove-which-model-version-prompt-and-settings-produced-an-ai-output"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-07"
}