When the AI gets it wrong about someone, how do they get it fixed?
Enhanced: 1Advanced: 12 controls
Who it applies to
Enter for every AI system whose letter is E or A (this area has no Baseline controls). Go as deep as your system letter, and implement in your mode.
Why it exists
Provide a working route for the people your AI affects to challenge a wrong outcome and have it corrected — a mechanism, not a promise. An erroneous or harmful AI output is not a closed matter simply because the system produced it; the person on the receiving end needs a way to say “this is wrong” and be heard by someone who can fix it. This closes the loop opened by the Explainability domain’s right to challenge: the explanation tells them why, this gives them the remedy.
What to actually do
Build a real remediation and redress route, and staff it. Give affected individuals a clear, usable way to raise an error or a harm, route it to a competent human with the authority to correct the outcome, and — the part that makes it real — actually correct it and, where warranted, make the person whole. A complaints channel that leads nowhere is worse than none, because it manufactures the appearance of recourse.
Feed what you learn from redress back into the system. Every upheld challenge is a signal about where the system fails. Route the pattern of redress back into the risk process and the system’s improvement, so that redress corrects not only the individual case but the cause.
Controls
Enhanced1 controls
Control 190
Provide a remediation and redress mechanism for people affected by AI outputs.
EnhancedCorrectiveall rolesper system
What it is
Reaching a human who can correct the outcome, and does.
How to implement it · Minimum structure
Channel: a visible contact route (form, email, phone) stated wherever an AI-influenced outcome is communicated
Acknowledgement within a set time (e.g. 5 working days) and a resolution target (e.g. 30 days)
Review by a named person with authority to change the outcome, not by re-running the system
Correction: outcome changed in every affected record, the person told, and harm remedied where warranted
Case log: date, issue, reviewer, decision, correction made
How to start
Name the person who will handle challenges for this system and add the contact route to every communication of an AI-influenced outcome.
Evidence
The case log showing challenges received and outcomes actually corrected.
Mode: light / standard / full
light
A dedicated email address handled by a named person, with cases logged in a spreadsheet.
standard
Handled by the customer-service or complaints team, with escalation to the system owner.
full
A redress process with service levels, case tracking and periodic reporting to governance.
Advanced1 controls
Control 191
Feed redress patterns back into risk and improvement.
AdvancedCorrectiveall rolesper system
What it is
Upheld challenges inform the system’s correction, not only the individual’s.
How to implement it · Steps
Classify each upheld challenge by cause: data error, model error, process or oversight failure
Review the pattern with the system owner at a set cadence, e.g. quarterly
Raise recurring causes as risks in the risk register, each with an owner
Agree a correction: data fix, retraining, threshold change, interface or process change
Check after the change that challenges of that type decrease
How to start
Add a cause field to the redress case log and run the first pattern review on the last quarter's upheld cases.
Evidence
The pattern reviews, the risks raised from them and the changes made to the system.
Mode: light / standard / full
light
The system owner reviews the case log each quarter and records the resulting actions.
standard
A quarterly review by the system owner and the risk lead, with tracked actions.
full
Redress data feeds the risk process automatically, with trend reports to governance and a change request per root cause.
Evidence
The redress mechanism and its usage records; evidence of outcomes actually corrected; the feedback from redress into the risk process.