Four Laws Now Require an Appeal Button. None of Them Call It That.
Right to appeal. Right to human review. Meaningful human oversight. Not solely automated. Four vocabularies, four statutes, one screen almost nobody has built — and the override rate is the number that decides whether yours counts.
Why This One Is Different
Most AI compliance obligations are documents. Impact assessments, model inventories, policies, notices — you can staff them with a lawyer and a template and close them in a quarter without touching the product.
Appeal and human review are not documents. They are a route in the interface, a queue, a reviewer role with reversal authority, a data structure that retains the inputs long enough to re-decide, and an audit log. They land on the engineering roadmap. That is why they slip, and why they will be the visible gap when a regulator or a plaintiff's counsel asks what happens after an adverse output.
What Each Law Asks For
Colorado AI Act — explanation plus appeal
For a consequential decision that is adverse to the consumer, the deployer owes a statement of the principal reasons, including the degree to which the system contributed and the type of data used, an opportunity to correct incorrect personal data, and an opportunity to appeal for human review where technically feasible. The 'technically feasible' qualifier is the sentence teams lean on and the sentence that will be tested — it is a justification standard, not an opt-out.
CCPA ADMT regulations — access and opt-out
California's automated decision-making technology rules approach the same territory through privacy rights rather than through an appeal: pre-use notice, a right to opt out of certain uses, and a right to access meaningful information about the logic and the outcome. Where the opt-out applies, the practical consequence is that you need an alternative path to a decision — which is, functionally, human review under another name.
EU AI Act — oversight designed in, explanation owed out
High-risk systems must be built so that natural persons can effectively oversee them, including the ability to interpret output, to decide not to use it, and to intervene or halt. Separately, a person affected by a decision taken on the basis of a high-risk system's output has a right to obtain a clear and meaningful explanation of the role it played. One obligation faces your operator; the other faces the public.
GDPR Article 22 and the state profiling opt-outs
Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and where an exception applies it still requires safeguards including the right to obtain human intervention, to express a point of view and to contest the decision. Colorado, Virginia, Connecticut, Texas and the rest of the comprehensive state privacy laws carry profiling opt-outs that operate in the same space with narrower scope and less litigation history.
The Rubber Stamp Problem
Teams reach for the same defence: there is a human in our loop, so the decision is not automated and none of this attaches. The problem is that every authority using the phrase "solely automated" has been explicit that a nominal human does not break the chain.
What is examined instead is whether the reviewer had authority to differ, competence to evaluate, information sufficient to evaluate, and a demonstrated practice of differing. The last one is measurable, and it is the one that will be requested. If your reviewers accept the model's output in essentially every case, you have built a very expensive logging layer over an automated decision.
- •Reviewer sees inputs and reason codes, not just the score
- •Reviewer is organisationally separate from the original decision
- •Documented authority to overturn without escalation
- •Time-per-review consistent with actually reading the file
- •A non-trivial, tracked override rate with reasons recorded
- •A single approve button on a screen showing only the outcome
- •Reviewers graded on throughput rather than accuracy
- •The same person who ran the model signing off on it
- •No mechanism to correct an input and re-run the decision
- •Override rate unknown because it was never instrumented
The One Workflow That Covers All Four
You do not need four appeal processes. The union of the requirements is a single path, and building to the strictest element of each collapses the matrix.
- Notice at the point of adverse outcome. Say that an automated system contributed, what it weighed, and that review is available. Do not bury it in the privacy policy.
- A findable route. A link in the decision message, not a support macro a person has to discover.
- Input correction before re-decision. Colorado names this explicitly and it is the cheapest source of genuine reversals.
- A reviewer with reversal authority. Separate person, sees the reason codes, records a rationale either way.
- A stated turnaround. Pick a period, publish it, and measure against it.
- Retention that outlives the appeal window. If you have already purged the inputs, you cannot re-decide and cannot prove you did.
- An override-rate dashboard. The number that answers the only question a regulator will actually ask.
Frequently Asked Questions
Our model only produces a recommendation. A person makes the call. Are we out of scope?
That is the right structure and it is not automatically an exemption. The tests turn on substance: whether the reviewer can and does depart from the recommendation, and whether the recommendation is presented in a way that permits departure. A recommendation shown as a green or red badge with no supporting reasons is engineered to be followed, and the resulting decision will be characterised as substantially automated regardless of the org chart.
What is a defensible override rate?
No statute sets a number and you should be suspicious of anyone who quotes you one. The useful framing is comparative: if human reviewers disagree with the model far less often than two humans reviewing the same files disagree with each other, the review is not adding independent judgment. Run a periodic blind sample where reviewers decide without seeing the model output, and compare. That study is also the single best artifact to have on file.
How long do we have to keep the inputs?
Long enough to satisfy the longest of three clocks: your published appeal window, the record-keeping period of any sector rule that applies to the decision, and the limitations period for a discrimination claim in the relevant jurisdiction. Privacy minimisation pushes the other way, which is why the retention decision should be written down with the reasoning rather than inherited from a default table setting.
Does the appeal have to be free?
Treat it as free. None of the frameworks contemplate charging for the exercise of a statutory right, and the state privacy laws are explicit that responses to consumer rights requests are free absent manifestly unfounded or excessive requests. A fee on an appeal route would also be a striking exhibit in any enforcement action.
Does this apply to internal decisions about employees?
Frequently yes, and it is the domain most often overlooked. Employment is on every consequential-decision list, and internal tooling — scheduling, performance scoring, promotion ranking, layoff selection, deactivation — tends to be built without any of the consumer-facing plumbing. If an automated system contributes to an adverse employment outcome, the same notice, correction and review expectations attach even though nobody would describe the employee as a customer.
Ship the Screen, Then Write the Policy
The usual order is reversed here and it costs teams a full cycle. A policy describing an appeal process that no interface exposes is worse than no policy, because it is a written representation you are not honouring.
Build the route, the reviewer role and the log first. The policy is then a description of something real, and the override dashboard answers the question before it is asked.
This article is general information about a fast-moving regulatory area, not legal advice. The Colorado AI Act's effective date and the California ADMT regulations have both been subject to amendment — confirm current text and timing with counsel before scoping work against them.