# Rights Protections in Automated Public Systems From an appeal promise to a decision system that can be corrected True Tomorrow Foundation · Policy Memo · Published 2026-09-23 Foundation synthesis; not peer reviewed. Evidence reviewed through 2026-09-23. An operational rights model for verifying legal rules, preserving discretion, testing unequal error, funding accessible review, and repairing failures across affected cases. ## Research question What institutional and technical controls make rights effective before, during, and after an automated public decision? ## Executive synthesis An appeal route is essential, but it cannot carry the full burden of protecting people from automated public decisions. Individuals may not know that an error occurred, may lack time or assistance, or may suffer harm before review concludes. This memo extends True Tomorrow’s Public AI That Can Be Appealed brief by examining the production of the decision itself: how legal rules become software, how staff retain genuine authority, how unequal errors are detected, and how one successful challenge triggers correction for others. True Tomorrow proposes four decision gates: lawful authority and appropriate scope; valid evidence and operational testing; accessible decision delivery and empowered human review; and systemic correction after error. These gates are an original design proposal, not a certificate of safety or a statement that every jurisdiction already requires them. Each gate should have an accountable owner and evidence that can fail it. Procurement approval, a vendor’s accuracy score, or a nominal human sign-off should not settle the question. The central tradeoff is how to obtain administrative consistency without hardening an unlawful assumption or removing discretion that the law preserves. Small, reversible support functions may be suitable for controlled deployment; essential-service refusals and sanctions demand stronger justification, testing, and continuity arrangements. Rights safeguards should scale with the consequences, while a minimum ability to identify responsibility and correct error should remain across the service. ## Findings ### Authority to decide and authority to automate are separate questions Australia’s 2025 Automated Decision-Making Better Practice Guide distinguishes legislative authority for a decision from authority to automate it. It warns against automating discretion without independent external legal advice and emphasizes maintaining administrative-law principles. This is Australian agency guidance, not a general judicial ruling that all discretion must always be exercised manually. Our proposed gate requires counsel and the service owner to map every material rule to its legal source and identify which judgments cannot be reduced to a fixed condition. Ambiguous law should be resolved through the appropriate legal process rather than silently converted into code. [1] ### An official failure investigation points beyond model accuracy The Robodebt Royal Commission recommended lawful end-to-end data exchanges, stronger data-matching governance, clear review paths, understandable information, scrutiny of rules, and possible independent monitoring. It also emphasized recipient-sensitive communication. These are findings and recommendations from a specific Australian inquiry, not proof that a single safeguard prevents all failures, and not a claim that every recommendation is now enacted. Their operational implication is to inspect the whole administrative chain: source records, legal interpretation, notices, collection activity, review, and management response. A correct calculation applied to an invalid premise can still produce an unlawful result. [2] ### Risk assessment must be tied to deployment and change Canada’s Directive on Automated Decision-Making requires a published algorithmic impact assessment before production and updates when scope or functionality changes. Its June 2025 revisions gave relevant existing systems until June 2026 to comply with updated requirements. The directive has a defined federal institutional and administrative-decision scope; it does not govern every Canadian automated system. This provides an administrative precedent for an explicit release gate. True Tomorrow proposes treating a material change in data, policy rules, decision threshold, or affected population as a new review event, with records that show who authorized the change. [3] ### EU implementation dates require current, specific reading The Commission reports that the AI Omnibus entered into force on 27 July 2026 and that the relevant Annex III high-risk rules will apply from 2 December 2027, with regulated-product high-risk rules following on 2 August 2028. The service desk’s reproduced Article 27 illustrates assessment of affected groups, likely rights harms, human oversight, and complaint arrangements for specified deployers. That reproduction explicitly uses the 2024 text and is a design reference here, not a claim of verified consolidated compliance. Existing data-protection and administrative obligations require their own analysis. A postponed AI-specific date does not, by itself, answer whether a present public decision is lawful. [4] [5] ### Explanation must make the individual outcome intelligible In its 2025 Dun & Bradstreet Austria judgment summary, the Court of Justice describes an explanation that lets a person understand how their data were used and challenge the decision. Merely providing an algorithm is insufficient, while disputed trade secrets may require assessment by the competent authority or court. This interpretation concerns GDPR access rights in a particular EU legal context; it is not an unlimited global entitlement to source code. The proposed operational test is whether a reviewer and affected person can identify the decisive inputs, applicable rule, material uncertainty, and route to correct an error. [6] ### Unequal harm can originate outside the model NIST’s work on AI bias explains that harmful bias can arise across technology processes, including without deliberate intent. The memo draws a practical inference: an evaluation should examine the service population and workflow as well as model outputs. Excluding incomplete applications can conceal the experience of people with unstable addresses, inaccessible forms, or missing records. Review should therefore track entry, abandonment, data completeness, referral, decision, and remedy. Subgroup measurement must be lawful and proportionate, and uncertain or missing demographic information must remain visible rather than being converted into a false claim of equal treatment. [7] ### A technically accessible interface is only part of effective review WCAG 2.2 supplies testable web-accessibility criteria, including accessible authentication, clear errors, and assistance-related requirements. It is a technical recommendation whose legal force depends on the applicable regime. Conformance can improve a digital route but does not establish that a person understood the decision or reached an empowered reviewer. Our proposal adds assisted, telephone, and in-person routes where needed, interpreters and representatives, and testing with users facing real access barriers. Review deadlines should account for urgency and the consequences of delay, with interim protection determined under the relevant law. [8] ## Institutional implications — Foundation proposals ### Maintain a rule-to-decision record For each consequential decision, retain the applicable rule version, relevant input provenance, output, material staff intervention, notice, and review outcome under a justified retention schedule. A record should allow a lawful independent review without exposing unrelated personal information. The public authority must retain control of the evidence even when a vendor operates the system. ### Give reviewers authority, time, and alternatives Train reviewers on the actual policy and common system failures; permit them to obtain missing evidence and depart from a recommendation when justified. Record reasons and check a sample for automatic endorsement. Staffing plans should account for review demand and complex cases, with escalation where a reviewer lacks delegated authority. ### Test harm against the service’s real alternative Compare the proposed system with the existing process, including manual error, delay, exclusion, staff burden, and unequal treatment. Publish the comparator and uncertainty. A new system need not achieve impossible perfection, but a faster average decision is insufficient justification for a serious unmitigated rights failure. ### Make one correction travel across the system Distinguish an individual factual error from a defective rule, corrupted input feed, or unlawful practice. For systemic failures, identify potentially affected cases, stop further adverse decisions where warranted, arrange reconsideration, and correct downstream records. The authority should not require everyone to reproduce the same successful complaint. ### Prepare a service-continuity decision Define who can restrict or stop a system, which evidence triggers escalation, and how essential services continue. A complete shutdown can itself harm people waiting for benefits or care. Plan controlled manual processing, preserved records, and priority handling before deployment rather than improvising after an incident. ## Policy options — Foundation analysis ### Use automation for bounded support tasks Original option: deploy assistance for document routing or identifying missing fields where staff can verify the result and an error does not automatically deny a right. This can free capacity, but support tools still influence outcomes. Monitor whether staff begin treating a suggestion as a mandatory rule. [1] ### Require independent review before adverse action Original option: for defined high-consequence decisions, require a competent reviewer to examine the relevant evidence before the decision takes effect. This adds workload and may introduce delay. Use urgency-based triage and adequate staffing, then evaluate actual reviewer behavior rather than counting signatures. [2] ### Decline an unsuitable automated use Original option: where authority, valid data, intelligible reasons, or feasible remedy cannot be established, redesign the service or retain a supported human process. Refusal should identify the unmet condition and what evidence could change the decision. It should not be portrayed as a finding that all automation in the sector is unacceptable. [3] [7] ## Implementation — proposed sequence ### 1: Specify the decision and legal pathway Select a service and identify the legal decision-maker, affected people, adverse consequences, discretion, and available review powers. Build a rule map and inventory dependent data exchanges. ### 2: Test without changing entitlements Use historical or appropriately governed test cases to evaluate legal-rule translation, missing records, unusual circumstances, staff interventions, and accessible notices. Document where retrospective data cannot establish correctness. ### 3: Authorize a bounded operational pilot Assign release authority, publish a comprehensible system record, fund human review, and define continuity arrangements. Record explicit limits on population, decision type, data, and duration. ### 4: Review outcomes and repair failures Audit representative cases, including people who never appeal. Investigate systemic patterns and publish protected findings. Expansion requires a new decision grounded in observed service outcomes and unresolved risks. ## Measurement — proposed indicators ### Decision correctness Independent review of a defined sample against applicable law and verified facts, with reasons for disagreement. Interpretation: Historic decisions and appeal outcomes are imperfect ground truth; report unresolved cases separately. ### Unequal error burden False adverse decisions, missed entitlements, and delays by relevant groups where lawful and statistically interpretable. Interpretation: Report denominators and uncertainty; parity of one metric does not prove non-discrimination. ### Effective review access People able to obtain a reasoned review and timely action, including assisted channels and abandoned attempts. Interpretation: A low appeal rate can reflect barriers; a high reversal rate can reflect selection or successful correction. ### Systemic repair completion Affected cases identified, reconsidered, notified, and corrected after a shared defect is confirmed. Interpretation: Track unresolved cases and downstream damage; closing an incident ticket does not establish remedy. ## Next tests 1. Ask an independent legal and service team to trace a sample of boundary cases from statutory rule to software output, including exceptions and discretion. 2. Test whether trained reviewers actually identify deliberately inserted, safe test-case errors and use their authority to correct them under realistic workloads. 3. Conduct paid accessibility and comprehension testing across digital and assisted review routes; record task completion and understanding rather than satisfaction alone. 4. Rehearse a systemic-error response using a fictional defective rule: identify all affected cases, protect continuity, produce corrected notices, and verify downstream correction. ## Method Comparative primary-source synthesis completed 23 September 2026, using national government directives and guidance, a Royal Commission report, the CJEU’s official judgment summary, European Commission implementation information, NIST research guidance, and W3C standards. No deployed system was audited and no claim is made that checklist adoption causes fairness. The four gates, measures, and operational options are original proposals. The EU timeline was checked against the Commission’s July 2026 entry-into-force notice; the Article 27 service-desk text is explicitly an older reproduction. ## Limitations The sources differ in legal status: law and judicial interpretation, administrative directives, inquiry recommendations, and voluntary technical guidance must not be treated as interchangeable. Canadian requirements are institutionally bounded; Australian guidance and the Robodebt inquiry reflect their own legal setting. The EU consolidated amending regulation could not be retrieved directly in this review, so the memo attributes dates to the Commission and does not provide article-level compliance advice. Human review and accessibility controls require local testing and adequate resources. ## Unresolved evidence - There is limited causal evidence that common human-oversight arrangements prevent harmful decisions under ordinary staffing pressure. - Rare but severe harms may escape routine samples and require complaint intelligence and targeted investigation. - Differences in administrative law, legal aid, data quality, and service access limit transferability of national examples. ## Sources [1] Commonwealth Ombudsman, Office of the Australian Information Commissioner, and Attorney-General’s Department. [Automated Decision-Making: Better Practice Guide](https://www.ombudsman.gov.au/__data/assets/pdf_file/0025/317437/Automated-Decision-Making-Better-Practice-Guide-March-2025.pdf). March 2025. Accessed 2026-09-23. Australian administrative guidance; particularly legal authority, discretion, rule mapping, and audit trails. [2] Royal Commission into the Robodebt Scheme. [Report of the Royal Commission into the Robodebt Scheme](https://robodebt.royalcommission.gov.au/publications/report). 7 July 2023; corrected edition 11 July 2023. Accessed 2026-09-23. Official inquiry and recommendations, particularly chapters 10, 16–18; recommendations are not represented as current law. [3] Treasury Board of Canada Secretariat. [Directive on Automated Decision-Making](https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592). Modified 24 June 2025. Accessed 2026-09-23. Official indexed directive text inspected; direct page retrieval was rejected. Defined federal scope, impact assessment, and transition dates. [4] European Commission. [AI Omnibus enters into force](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force). 27 July 2026; updated 31 July 2026. Accessed 2026-09-23. Primary institutional confirmation of entry into force and revised high-risk application dates; consolidated legal text was not directly retrievable. [5] European Commission AI Act Service Desk. [Article 27: Fundamental rights impact assessment for high-risk AI systems](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27). 2024 text; accessed 23 September 2026. Accessed 2026-09-23. The page identifies its text as the 13 June 2024 version. Used as a design reference with current-status caveat, not consolidated legal advice. [6] Court of Justice of the European Union. [Judgment in Case C-203/22, Dun & Bradstreet Austria: official press summary](https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-02/cp250022en.pdf). 27 February 2025. Accessed 2026-09-23. Court-owned explanation of the ruling on meaningful information and trade-secret balancing under GDPR; the press release is not the judgment text. [7] National Institute of Standards and Technology. [Towards a Standard for Identifying and Managing Bias in Artificial Intelligence, SP 1270](https://www.nist.gov/publications/towards-standard-identifying-and-managing-bias-artificial-intelligence). 15 March 2022. Accessed 2026-09-23. Technical and conceptual discussion of bias across AI processes; not a causal evaluation of the proposed safeguards. [8] World Wide Web Consortium. [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/). Recommendation 12 December 2024. Accessed 2026-09-23. Technical accessibility standard; conformance and applicable legal duties must be assessed separately.