Who can stop an automated decision?

A customer is refused a service, a supplier invoice is blocked or an application is ranked out of consideration. An automated system has made, or heavily influenced, the decision. Someone notices that the result looks wrong.

What happens next?

A policy may promise human oversight. The board needs to know whether a person can actually intervene, with enough information and authority to change the outcome. Adding a reviewer to a process does little if they are expected to accept the result by default.

Identify the decisions that matter

Start with the consequences for people and for the business. A tool that suggests wording needs different oversight from one that affects access to a service or releases payments.

Ask management to identify material automated decisions, including those embedded in bought-in systems. Show where the system recommends, where a person decides and where an action happens without further approval.

Include who owns the process and who carries responsibility when something goes wrong. The presence of a supplier does not answer those questions for the company using the system.

Make intervention a real option

For the important uses, identify who can challenge an individual result, pause the process or restrict the system's use. These may be different people, with different levels of authority.

They need understandable information about the result, the limitations of the system and the grounds for escalation. They also need enough time to review it. A target that leaves seconds for a complex judgement can undermine the oversight the board has been promised.

Test what happens when the normal reviewer is absent or disagrees with the system. Staff should not need the permission of a distant project team to raise a serious concern.

Rehearse a disputed outcome

Use an illustrative case in which an apparently reasonable result rests on incomplete data. Follow it through the actual process: how the issue is noticed, how the affected person can raise it and how the company investigates.

Check whether records allow the team to reconstruct what happened. Establish how incorrect information is corrected and whether similar outcomes need to be reviewed.

Also ask what happens while a system is paused. A manual alternative may need trained people and limited capacity. Knowing that in advance makes a decision to stop more credible.

Require evidence before restarting

A correction should address the cause of the problem, with testing proportionate to the potential harm. Specify who can authorise a restart and what they must see first.

Bring material incidents, repeated overrides and unresolved complaints into board reporting. These can reveal problems that average accuracy measures conceal.

The board's role is to establish accountable ownership and a workable route for intervention. Someone must be able to say that a result needs another look, and know that the organisation will act on it.

Further reading: NIST AI Risk Management Framework Core, on governance, monitoring and managing AI risks.