Contesting automated decisions: explanation, human review and appeal

When a public body or a company uses an automated system to deny a benefit, flag a person for investigation or refuse a contract, what can the affected person actually do? Law offers three distinct tools: a right to an explanation (to know why), a right to human review (to have a person reconsider) and a right of appeal (to take the matter to an independent body). Between 2023 and 2026 these tools changed substantially. The Court of Justice of the European Union (CJEU) held in SCHUFA (C‑634/21, 2023) that a credit score can itself be an automated decision and in Dun & Bradstreet Austria (C‑203/22, 2025) that people are entitled to an explanation of "the procedure and principles actually applied"; the EU AI Act added a right to explanation for decisions based on high-risk systems; the Council of Europe adopted the first binding AI treaty; the UK rewrote its rules on automated decisions; and US federal and state rules introduced appeal and human-review duties. This study maps these rights, compares them, and asks what the evidence from real cases says about which mechanisms help people in practice.

Key findings

• The EU now has a workable explanation standard. In Dun & Bradstreet Austria the CJEU held that controllers must describe the procedure and principles actually applied so that people can understand which data were used and how; merely communicating an algorithm is not enough, and trade-secret objections go to a court or supervisory authority to balance.
• The scope of "automated decision" has widened. SCHUFA held that a score is an automated individual decision under Article 22 GDPR where the client attributes "a determining role" to it.
• The AI Act's Article 86 is narrower than it looks. It covers decisions based on Annex III high-risk systems with legal or similarly significant effects, applies only where Union law does not already provide the right, and depends on high-risk obligations that the 2026 Digital Omnibus delayed to 2 December 2027.
• Jurisdictions are converging on a common menu — notice, reasons, human intervention, contestation — but differ on whether solely automated decisions are prohibited in principle (EU) or permitted with safeguards (UK after 2025, Colorado, US federal agencies).
• In practice, individual rights have rarely stopped harmful systems. The well-documented cases — SyRI, Robodebt, the Dutch childcare-benefit model, MiDAS — were stopped by strategic litigation, class actions, regulators and inquiries; individual appeals helped individuals, slowly.
• Human review is only as good as the reviewer's information, time and authority. Evidence from the Netherlands and Serbia shows reviewers deferring to systems they could not interrogate.

Research question and scope

The study asks two linked questions: what legal rights to explanation, human review and appeal now exist for people subject to automated decisions, and what does the evidence show about which of them work? It covers EU law (GDPR, CJEU case law, the AI Act), the Council of Europe Framework Convention, the UK, and US federal and state measures, with France noted where the OECD documents its rules. It concentrates on public-sector decisions but includes private credit scoring because the leading CJEU judgments concern it and their reasoning applies to public controllers.

Background

Three rights, three functions

The three depend on each other. Without an explanation, a reviewer or tribunal is asked to check a result without its reasons; without independent appeal, human review can become a formality inside the same organisation.

The academic debate

Soon after the GDPR was adopted, Wachter, Mittelstadt and Floridi (2017) argued that a legally binding "right to explanation" of individual automated decisions did not exist in the Regulation, which provided at most a right to be informed about system functionality. Edwards and Veale (2017) argued that, whatever its scope, a right to explanation was "probably not the remedy you are looking for", because it places the burden on individuals and because meaningful explanations of complex models are hard to give; they pointed to other tools such as impact assessments. Wachter, Mittelstadt and Russell (2018) proposed counterfactual explanations — statements of what would have had to be different for a different outcome — as a way to inform people without opening the model. The CJEU's 2025 judgment can be read as adopting a version of this idea.

Method and sources

The study relies on primary legal texts (GDPR, UK Data (Use and Access) Act 2025, AI Act as amended, the Council of Europe Convention, OMB Memorandum M‑25‑21, Colorado statutes, California regulations), the CJEU's official press releases for SCHUFA and Dun & Bradstreet Austria, and peer-reviewed scholarship. Evidence on practice comes from the case studies in Polity Atlas' comparative study of automated welfare enforcement and its studies of the Dutch childcare-benefits scandal and Robodebt.

Limits. The CJEU judgments are summarised from the Court's own press releases, which the Court describes as unofficial; the full texts should be consulted for detail. Several regimes are recent or not yet fully applicable, so there is little evidence of their effects. The Council of Europe's websites were not accessible when this study was checked, so the Convention's articles were read in the authentic English text published in the Dutch government's treaty database, and its current ratification status is not stated here.

Finding 1: EU data protection law after SCHUFA and Dun & Bradstreet

The baseline: Articles 22 and 15 GDPR

Article 22(1) GDPR gives a person "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions exist for contracts, explicit consent and decisions authorised by Union or Member State law that lays down suitable safeguards. Where the contract or consent exceptions apply, Article 22(3) requires "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". Article 15(1)(h) gives a right of access to "meaningful information about the logic involved" in such decisions.

SCHUFA (C‑634/21), 7 December 2023

The German credit agency SCHUFA produced scores used by banks. The Court held that scoring "must be regarded as an 'automated individual decision' prohibited in principle by the GDPR, in so far as SCHUFA's clients, such as banks, attribute to it a determining role in the granting of credit". The significance is structural: the right attaches to the body that produces the decisive score, not only to the body that formally decides. For the public sector, this suggests that a risk score which in practice determines whether a claim is investigated or refused may itself fall within Article 22, even if an official signs the outcome.

Dun & Bradstreet Austria (C‑203/22), 27 February 2025

A mobile operator refused a customer a contract — with a monthly payment of €10 — because of an automated credit assessment by Dun & Bradstreet. An Austrian court had already found that the company failed to provide "meaningful information about the logic involved". On a reference about enforcement, the Court held:

• the controller must "describe the procedure and principles actually applied in such a way that the data subject can understand which of his or her personal data have been used, and how they have been used";
• it "could in particular be appropriate to inform the data subject of the extent to which a variation in the personal data taken into account would have led to a different result" — a counterfactual-style explanation;
• "the mere communication of an algorithm does not constitute a sufficiently concise and intelligible explanation";
• where the controller claims that the information contains third parties' data or trade secrets, it must provide that information to the competent supervisory authority or court, which balances the interests; a national rule that excludes access as a rule whenever trade secrets are involved is precluded.

The Court's own headline was that "the explanation provided must enable the data subject to understand and challenge the automated decision". Explanation is thus defined by its function in contestation.

Finding 2: the EU AI Act

Article 86: a right to explanation for high-risk decisions

Article 86(1) of the AI Act gives "any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III", except systems under point 2 of that Annex (critical infrastructure), and which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, the right to obtain "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken". Article 86(3) states that the article applies "only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law" — so where the GDPR already provides an explanation, the GDPR governs.

Timing after the Digital Omnibus

The AI Act's general date of application is 2 August 2026. However, Regulation (EU) 2026/1744 (the Digital Omnibus on AI) amended Article 113 so that Chapter III, Sections 1–3 — the core obligations for high-risk systems — apply from 2 December 2027 for Annex III systems and from 2 August 2028 for systems under Annex I. Because Article 86 is defined by reference to Annex III high-risk systems, its practical effect before the high-risk regime applies is uncertain; how authorities and courts treat the interim period is an open question.

Other AI Act routes

The Act also lets any person lodge a complaint with a market surveillance authority, requires deployers of high-risk systems to use them with human oversight, and requires public-law deployers of certain Annex III systems to carry out a fundamental-rights impact assessment. These are mostly ex ante duties; Article 86 is the main individual remedy.

Finding 3: the Council of Europe Framework Convention

The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225) opened for signature on 5 September 2024 in Vilnius. Chapter IV deals with remedies. Article 14 requires each party, "to the extent remedies are required by its international obligations and consistent with its domestic legal system", to ensure "accessible and effective remedies" for human-rights violations resulting from AI systems, including measures to document relevant information about systems that may significantly affect human rights and, where appropriate, make it available to affected persons; to ensure that this information is "sufficient for the affected persons to contest the decision(s)" made or substantially informed by the system; and "an effective possibility for persons concerned to lodge a complaint to competent authorities". Article 15 requires effective procedural guarantees where an AI system "significantly impacts upon the enjoyment of human rights", and asks parties to "seek to ensure" that people are notified that they are interacting with an AI system. The obligations are framed generally, leaving parties discretion over implementation, and they bind only parties: under Article 30(3) the Convention enters into force three months after five signatories, including at least three Council of Europe member states, have ratified it.

Finding 4: the United Kingdom after 2025

The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, replaced Article 22 of the UK GDPR with new Articles 22A–22D. The change of approach is significant:

• a decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision", and "significant" if it produces a legal or similarly significant effect;
• solely automated significant decisions are restricted mainly where they rely on special-category data — permitted only with explicit consent, or where the decision is necessary for a contract or required or authorised by law and the substantial-public-interest condition of Article 9(2)(g) applies — or on the new "recognised legitimate interests" basis, rather than being prohibited in principle;
• where such decisions are taken, controllers must provide safeguards that "provide the data subject with information about decisions", "enable the data subject to make representations", "enable the data subject to obtain human intervention" and "enable the data subject to contest such decisions";
• the Secretary of State may define by regulations what counts as meaningful human involvement and similarly significant effects.

The UK has thus moved from a prohibition-with-exceptions model to a permission-with-safeguards model, while keeping the four core safeguards.

Finding 5: the United States

There is no general federal right to explanation or appeal of automated decisions; instead, a patchwork:

• Federal agencies. OMB Memorandum M‑25‑21 (3 April 2025), which rescinded and replaced M‑24‑10, requires agencies to apply minimum risk-management practices to "high-impact AI" within 365 days, including to "ensure that individuals affected by AI-enabled decisions have access to a timely human review and a chance to appeal any negative impacts, when appropriate". Agency Chief AI Officers may waive minimum practices, with waivers tracked, reported and summarised publicly.
• Colorado. SB24‑205, approved on 17 May 2024, requires deployers of high-risk AI systems that make or substantially influence consequential decisions to give consumers notice, a chance to correct incorrect personal data and "an opportunity to appeal, via human review if technically feasible, an adverse consequential decision". SB25B‑004, signed on 28 August 2025, extended the effective date of these requirements to 30 June 2026. In May 2026 the legislature changed course: SB26‑189, signed on 14 May 2026, repeals and re-enacts the 2024 provisions as a law on "automated decision-making technology" used to materially influence consequential decisions, with duties starting on 1 January 2027. Deployers must give notice at the point of interaction and, within 30 days of an adverse outcome, a plain-language description of the technology's role; consumers may request their data, correction of factually incorrect data and "meaningful human review and reconsideration"; enforcement lies with the attorney general, with no new private right of action.
• California. Regulations of the California Privacy Protection Agency, approved on 22 September 2025 and effective from 1 January 2026 with phased compliance dates, implement consumers' rights to access information about, and opt out of, businesses' use of automated decision-making technology.
• New York City. Local Law 144 of 2021 prohibits employers from using automated employment decision tools unless they have had a bias audit within a year, the audit's results are public and candidates receive notice — an audit-and-notice model without an individual appeal right.

Comparison

Finding 6: what works in practice

Systemic routes outperform individual ones

Across the best-documented cases, the decisive interventions were collective or institutional:

• Strategic litigation. In the SyRI case, a coalition of civil-society organisations obtained a judgment that the legislation breached Article 8 ECHR. The court reasoned that without insight into the risk model it was "difficult to comprehend how a data subject could be able to defend themselves" — treating transparency as a precondition of individual contestation.
• Class actions. Robodebt's class action produced settlements of at least $1.8 billion (2021) and $548.5 million (approved 2026).
• Regulators. The Dutch data-protection authority found nationality-based risk indicators unlawful and fined the tax administration.
• Inquiries. The Dutch parliamentary inquiry and Australia's Royal Commission forced political accountability.

Individual appeals mattered mainly as signals. In Michigan, lawyers noticed a spike in successful fraud appeals before discovering that MiDAS issued findings without human review. In Serbia, Amnesty documented a woman who won reinstatement on her second appeal with free legal aid — after months without income.

Human review fails without information, time and authority

The Dutch childcare-benefit reviewers were not told why an application was scored as high-risk. Serbian social workers told claimants that "the new system from Belgrade" had decided. Experimental evidence from the Netherlands (Alon-Barkat and Busuioc, 2023) found no general automation bias but a tendency to follow advice that matched group stereotypes, absent among civil servants tested soon after the childcare scandal. Ben Green (2022) argues that human-oversight requirements can give false reassurance and legitimise flawed systems, and proposes that agencies instead justify the use of algorithms and submit them to institutional oversight.

Explanations work when they are actionable

The CJEU's Dun & Bradstreet standard — which data were used, how, and what change would have altered the result — is the kind of explanation that allows a person to correct data (as in the Serbian cases of wrongly recorded income or scrapped cars) or to challenge a method (as in Robodebt's averaging). Generic descriptions of "the algorithm" do not.

What the evidence does not show

• There is little evidence yet on the new regimes' effects. Article 86, the UK's Articles 22A–22D and Colorado's human-review right are too recent for outcome data.
• It does not show that individual rights are useless. They are necessary inputs to systemic remedies; litigation coalitions and regulators often build on individual complaints.
• It does not show that explanations can always be given. For some complex models, faithful explanations of individual outcomes remain technically contested; the CJEU's standard sidesteps this by focusing on data and principles actually applied.
• It does not establish how often reviewers override systems. Few public bodies publish override rates or appeal success rates for automated decisions.

Implications for institution design

A layered design is better supported by the evidence than any single right:

1. Notice that an automated system was used, at the time of the decision.
2. Actionable reasons: the data used, how they were used and what would change the outcome — the Dun & Bradstreet standard — with trade-secret disputes resolved by an independent authority, not by the controller.
3. Real human review: reviewers with access to the system's reasons, time to investigate and explicit power to override; publication of override rates.
4. Independent appeal that suspends recovery or sanctions while pending, with legal aid for low-income claimants.
5. Systemic triggers: aggregated appeal statistics reported to a regulator or ombudsman, power to suspend a system, and access to collective redress.
6. Registers and pre-deployment legal sign-off, so that the lawfulness of a method is tested before it is applied to thousands of people.

Open questions

• How will national courts apply SCHUFA's "determining role" test to public-sector risk scores that formally only select cases for review?
• Will supervisory authorities develop practical procedures for balancing trade secrets against access rights, as Dun & Bradstreet requires?
• How will Article 86 operate before December 2027, and will the Commission's guidance clarify its relationship with the GDPR?
• Will the UK's shift to a permission-with-safeguards model increase solely automated decisions, and will "meaningful human involvement" be defined strictly?
• Will US federal waivers of minimum practices be used sparingly or routinely, and will states converge on Colorado's human-review model?

Sources

1. European Parliament and Council (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 15 and 22.
2. Court of Justice of the European Union (2023). Press release No 186/23: SCHUFA Holding (Scoring), C‑634/21, 7 December 2023.
3. Court of Justice of the European Union (2025). Press release No 22/25: Dun & Bradstreet Austria, C‑203/22, 27 February 2025.
4. European Parliament and Council (2024). Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 86.
5. European Parliament and Council (2026). Regulation (EU) 2026/1744 (Digital Omnibus on AI).
6. Council of Europe (2024). Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225).
7. UK Parliament (2025). Data (Use and Access) Act 2025, section 80.
8. Office of Management and Budget (2025). Memorandum M‑25‑21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust.
9. Colorado General Assembly (2024). SB24‑205, Consumer Protections for Artificial Intelligence.
10. Colorado General Assembly (2025). SB25B‑004, Increase Transparency for Algorithmic Systems.
11. California Privacy Protection Agency (2025). CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT and Insurance Regulations.
12. NYC Department of Consumer and Worker Protection. Automated Employment Decision Tools (Local Law 144 of 2021).
13. OECD (2026). Digital Government Outlook 2026, Box 4.7.
14. Wachter, S., Mittelstadt, B. and Floridi, L. (2017). Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation. International Data Privacy Law 7(2): 76–99.
15. Edwards, L. and Veale, M. (2017). Slave to the Algorithm? Why a 'Right to an Explanation' Is Probably Not the Remedy You Are Looking For. Duke Law & Technology Review 16(1): 18–84.
16. Wachter, S., Mittelstadt, B. and Russell, C. (2018). Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR. Harvard Journal of Law & Technology 31(2).
17. Rechtbank Den Haag (2020). SyRI judgment, ECLI:NL:RBDHA:2020:1878.
18. Alon-Barkat, S. and Busuioc, M. (2023). Human–AI Interactions in Public Sector Decision Making. JPART 33(1): 153–169.
19. Green, B. (2022). The flaws of policies requiring human oversight of government algorithms. Computer Law & Security Review 45.
20. Amnesty International (2023). Trapped by automation, EUR 70/7443/2023.
21. Charette, R. N. (2018). Michigan's MiDAS Unemployment System. IEEE Spectrum.
22. Colorado General Assembly (2026). SB26‑189, Automated Decision-Making Technology.
23. Council of Europe (2024). Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law — authentic English text, as published in the Dutch government treaty database.