Contestability and recourse

Related explainers

Short explainers that restate the obligations for policy and product teams.

Article I: The right to notice and reasons

A person an automated system decides about gets the reasons for the decision, in plain language, when it is made.

1. §1.1 Decision objects: Every automated decision must produce a decision object containing reason codes, evidence sources, and scope boundaries.

2. §1.2 Plain language: Reasons must be written in language a layperson can understand. Legalese and internal codes are insufficient.

3. §1.3 Immediate availability: Reasons must be available at the moment of decision. An explanation deferred until someone asks for it does not comply.

4. §1.4 Reasons belong to the decision: A reason given under §1.1 and §1.2 must state what the decision actually rested on: the inputs, rule, policy, and threshold that produced it. An explanation written afterward by a component that did not make the decision is an account, not a reason. It must be labeled as one, and it does not satisfy §1.1 or §1.2 on its own. Where the component that decided gives no reasons, as a classifier that returns only a score does not, the decision object says so and names the policy, the threshold, and the inputs the decision ran on. The standing register entry for that class then includes whether the evidence supported the decision among its standards of review under §8.2.

Article II: The right to an appeal path

The appeal path starts from the decision itself and reaches someone who can reverse it.

1. §2.1 Accessible intake: The appeal path must be reachable directly from the decision notification or interface.

2. §2.2 Named authority: The appeal path must identify the accountable authority with reversal power.

3. §2.3 Binding deadlines: Appeal deadlines must be published, time-bound, and enforced.

Article III: The right to a review clock

Every review has a maximum duration, and this article fixes what happens to the person while it runs and when it runs out.

1. §3.1 Declared maximum: Every review process must declare a maximum duration.

2. §3.2 Auto-escalation: When the clock expires without resolution, the case must auto-escalate to a higher authority or default to reversal.

3. §3.3 Interim protections: While review is pending, the person the decision is about must receive provisional protection (continued access, status quo, safe fallback).

Article IV: The right to remedy and reversal

An upheld challenge reverses the decision. Wrongful harm is compensated without a separate claim, and a defect in a rule reaches everyone it affected.

1. §4.1 Reversal as default: Upheld challenges result in reversal of the contested decision unless safety criteria explicitly prohibit it.

2. §4.2 Automatic compensation: Wrongful harm triggers automatic credits, fee waivers, or restitution without requiring a separate claim.

3. §4.3 Verified delivery: Remedy delivery is tracked with timestamps and verified by the person it is owed to.

4. §4.4 Scope of remedy: Where a defect is found to arise from a rule, a model, or a notice rather than from one decision, the remedy reaches every affected case without a further claim. The institution enumerates the affected population from its own records, reverses each affected decision, restores each person it harmed, and tells each person what was reversed and how they were restored. A remedy reachable only by individual challenge does not discharge the obligation.

Article V: The right to evidence and accountability

Every decision leaves a receipt, and every contested decision is entered in the decision log. Appeal outcomes are published. A score is evidence in a challenge, not the answer to it.

1. §5.1 Receipts: Every decision emits a receipt with timestamp, owner, and a reference to its decision record.

2. §5.2 Outcome transparency: Appeal passage rates and reversal rates are published and used to improve decisions.

3. §5.3 Decision log: The decision log links every contested decision to its evidence, reviewers, and outcome.

4. §5.4 What a score may not do: A measurement of burden, a safety-case result, an audit finding, or any other score the challenged party did not produce is evidence and not a bar. It may not dispose of an objection, and it may not be cited to establish that a person’s account is unfounded. Where a score and an account conflict, the conflict goes to a named reviewer holding authority to resolve it, and the score does not travel as the default. An institution that answers a challenge with a number has answered a different question.

Article VI: The infrastructure of review

A review can happen only if three things exist, and each is easy to omit: a human who can be asked, reviewers who are not penalized for finding in the challenger’s favor, and records that last long enough, and resist tampering well enough, to support the investigation. A review offered without all three exists only on paper.

1. §6.1 Human review on request: Where an automated system denies a claim or takes a consequential action, a human review of that outcome is available on request. The request requires no new evidence, no additional form, and no stated reason, because the alternative is that the system’s output becomes final by default.

2. §6.2 Reviewer incentives: Where reviewers are evaluated, the evaluation must not reward upheld denials, closure speed, or any other metric that biases against remedies. A reviewer whose performance depends on the answer the institution prefers is not a reviewer. The evaluation policy is itself evidence, and it is disclosed to the people whose cases depend on it.

3. §6.3 Tamper-evident retention: Where logs support review or remedy, they are retained for at least the full review and appeal period plus the limitation window, and they are tamper-evident: a deletion or modification after a dispute begins is itself recorded. A log the operator can silently rewrite is not evidence; it is the operator’s account.

Article VII: Liability and capacity

Deploying automation does not redeploy responsibility. Two failures recur: the institution pointing at the vendor’s infrastructure when access or remedy is needed, and the institution scaling the volume of decisions without scaling the capacity that must answer them. Both convert a right into a queue.

1. §7.1 Operator liability: Where automation causes an error or a delay, liability for the resulting harm rests with the operating institution. The delegation was the institution’s, and the harm travels the same path as the benefit. That the system acted is a description of the mechanism, not an answer to the person harmed.

2. §7.2 Vendor-managed infrastructure: Where a vendor operates the logs, the models, or the controls, the operating institution still guarantees access and remedy to the person the system decided about. A contract with a vendor is not visible to that person and does not shorten their route. The obligation survives the outsourcing.

3. §7.3 Proportional review capacity: Where automation increases the throughput of decisions, review capacity is funded in proportion to the actions taken, and the capacity plan is part of the deployment’s evidence. Throughput that outruns review converts the review right into a queue, and a queue is the mechanism by which this standard’s clocks become decorative.

Article VIII: The standing mechanism

“A channel that accepts a complaint is not standing. Standing is who may challenge what, answered by whom, by when, against what standard, with what possible outcomes.”

Every formal model meets cases it cannot represent. When it does, someone carries the error. Without a route to challenge the decision, they carry it in silence. This article turns exposure to a system’s errors into standing: the power to make a named responder review the decision by a deadline, against a published standard, with a published set of outcomes.

A route to challenge requires seven things to be named together: who may challenge, what may be challenged, what evidence is admissible, who is obliged to respond, by what deadline, against what standard of review, and which state transitions a successful challenge can produce. Named separately, or named in a policy nobody can cite, they do not compose into a route.

STD-07 §4.1 already requires a record that affects outsiders to declare who may object and where, and §4.2 already obliges an accepted objection to be answered with a revision or a reasoned refusal within the reversal clock. This article does not restate either. It adds the two fields those clauses leave open: the standard the responder decides against, and the set of state transitions a successful challenge can produce.

1. §8.1 The register: For each class of consequential decision, the operator must publish a standing register entry naming who_may_challenge, what_may_be_challenged, admissible_evidence, responder, response_deadline, standard_of_review, and possible_state_transitions. An entry missing any of the seven is incomplete, and the decision class it covers is uncontestable in practice.

2. §8.2 The standard of review: The register must state what the responder decides against: whether the decision followed policy, whether the policy was correct, whether the evidence supported the decision, or whether the outcome was reasonable. A responder who is not told what to decide against will decide whether the process ran, which is the one question the challenger did not ask.

3. §8.3 Possible transitions: The register must enumerate the state changes a successful challenge can produce, drawn from the same set as a reconsideration outcome: the decision stands, is narrowed, suspended, reversed, corrected, or the grant behind it is expanded or withdrawn. A challenge route with no enumerated transition is correspondence, not standing.

4. §8.4 Error-bearing parties: Standing extends to the parties who absorb the system’s errors: the people the decision falls on, and the operators who handle its exceptions, work its queues, and perform the manual repair the automation assumes. The register entry’s who_may_challenge names both, as affected_party and corrective_labor. Each holds the force set out in §8.5, and an operator’s challenge is answered within the same response_deadline as anyone else’s.

5. §8.5 Force, not veto: Standing is procedural force. A party with standing can compel receipt, an answer within the deadline, and a decision against the published standard. They cannot compel the outcome. A challenge that must be answered but need not prevail is standing; a challenge that halts the system on assertion is a veto, and this standard does not require one.

6. §8.6 Issue rate bounded by answer capacity: The register entry must state how many challenges the responder can answer within response_deadline in a period. Where the class’s issue rate in that period, multiplied by its measured error rate, or by an assumed rate stated in the entry until one is measured, exceeds that capacity, the class is uncontestable in practice under §8.1 until capacity is raised or the issue rate is lowered. Narrowing who may challenge does not cure it. The bound is set on errors made, not on challenges received, because an error nobody could challenge in time never shows up as a challenge.

Article IX: Prospective auditability

“Forensic records answer what happened. A governing record answers whether this should still be running.”

Most audit trails are built for reconstruction after harm. They can establish what the system did and rarely establish whether the delegation behind it still deserves to stand. The difference is what is retained: an audit trail retains outputs, and a governing record retains the justification, the assumptions, and the correction route that were in force at the time.

1. §9.1 Retention for decision, not only reconstruction: Records must retain what is needed to decide whether the delegation still deserves to stand: the authority it ran under, the policies that authority rested on with their versions, the assumptions those policies declared, the correction capacity claimed at the time, and the challenges received and how they were answered.

2. §9.2 Answerable without the vendor: The retained set must be sufficient for the operating institution to answer the standing question without the cooperation of the supplier of any component. A justification that can only be assembled by the party whose product is under review is not evidence available to the review.

3. §9.3 Reviewed on a cadence: The standing question is asked on a published cadence, not only after an incident. The review produces a dated record whether or not anything changed, so that a period in which nobody asked is visible as such.

Article X: The depth of consent

“Consent to enter a dependency is not consent to every degree of dependency its operation produces.”

A party who adopts a system consents to the relationship as it stands at adoption. They cannot consent to the constraint set the system’s own success later manufactures: data accumulates inside it, collaborators organize around it, the alternatives that were live at adoption stop being maintained, and the competence needed to work without it atrophies. Each of those changes the terms without anyone deciding to change them. By the time they have all happened, “you chose this” no longer describes the present relationship, and it is the present relationship the party is living under.

Article VIII establishes who may challenge and with what force. This article addresses when that set changes and when a recorded consent stops covering what the system now does. The measurements it relies on are the dependency record’s, held under STD-06 Article V.

1. §10.1 The affected set does not close at adoption: Standing MUST extend to parties who became affected after adoption, including those who never consented and those whose exposure changed materially without any new decision by them. Enumerating the affected parties at adoption records who was affected then; it does not define who may challenge now. A standing register entry that admits only the parties named at adoption is incomplete under §8.1.

2. §10.2 Deepened dependence reopens consent: Where dependence has materially deepened since consent was given, the operator MUST disclose the change to the consenting party and MUST NOT treat the original consent as covering the new degree. Deepening is material when, as against the values recorded when consent was given, any level of reversibility has moved from evidenced to not evidenced, or exposure_score or substitution_cost has risen by a quarter or more. Disclosure is owed within 30 days of the dependency record entry that shows the move, states which measure moved and by how much, and names the standing route under §8.1. Until it is made, the operator MUST NOT cite the original consent as the basis for the current degree of dependence.

Publication history

• v1.4.1 (Oct 13, 2026): Editorial revision; no obligation changed. Retitled in sentence case, with “and” in place of the ampersand; formerly “Contestability & Recourse”. Wording aligned with the site’s vocabulary: challenge for the act, standing for the right, remedy for what the person is owed, receipts (§5.1) and a decision log (§5.3) in place of decision receipts and audit trails, and a remedy that reverses each decision and restores each person (§4.4).

• v1.4 (Oct 6, 2026): §8.4 no longer says standing is proportional to exposure, which no record could show. It now requires the register to name both the people a decision falls on and the operators who handle its exceptions, each with the force §8.5 sets and the same response deadline.

• v1.3.1 (Oct 6, 2026): Editorial revision; no obligation changed. The clause register above the text now matches §1.1–§5.3 as written. Articles I–V open with a plain statement of what they require in place of a slogan, the Article VIII preamble is rewritten, and labels are in sentence case.

• v1.3 (Oct 3, 2026): Publishes Articles VI and VII: review infrastructure, liability, and capacity (§6.1–§7.3).

• v1.2 (Sep 22, 2026): Adds two clauses for decisions made faster and with fewer reasons than recourse assumed. A reason must be what the decision rested on, and an explanation written afterward by another component is labeled as an account (§1.4). A decision class whose expected errors outrun the responder’s capacity to answer is uncontestable in practice (§8.6).

• v1.1 (Sep 7, 2026): Adds Article X, the depth of consent: standing for parties who became affected after adoption, and the disclosure owed when dependence has materially deepened since consent was given.

• v1.0 (Sep 6, 2026): Adds Article VIII, the standing mechanism with its seven fields, the standard of review, the possible state transitions, standing for error-bearing parties, and the force-not-veto rule; adds Article IX, prospective auditability.

• v0.9 (Jan 1, 2026): Peer review draft aligned to evidence and remedy clocks.