Carlos recently published a useful piece on mapping automated decision-making technology (ADMT) exposure in Colorado and California. His central point is the one I would underline: the compliance question is not “where do we use AI?” Instead, it is “where do models, scores, and rules feed our decisions, and how much do they change the outcome?”
He is right, and the same question travels well. Once you have an ADMT decision map, you can answer it for Europe, the UK, and Australia too. What changes from one jurisdiction to the next is the legal test applied to that map.
A Global ADMT Decision Map: Two US Tests, Plus Three More
Carlos’s piece contrasts two US ADMT regulations:
- Colorado: an output that is a non-de minimis factor affecting the outcome triggers the law.
- California: the trigger is technology that replaces or substantially replaces human decision-making.
Here is how three ADMT regulations outside of the US compare:
European Union: the score can be the decision.
GDPR Article 22 protects people from decisions based solely on automated processing. In the SCHUFA case, the Court of Justice found that when a bank relies heavily on a credit score to grant a loan, the processing that produced the score counts as automated decision-making. For anyone building decisions around vendor scores, that matters: the provider of the score can be in scope even when the lender “makes” the decision. Separately, the EU AI Act classifies credit scoring as high risk; however, the Digital Omnibus moved those stand-alone obligations from August 2026 to December 2027.
United Kingdom: allow, with safeguards.
On February 5, 2026, the Data (Use and Access) Act replaced Article 22 of the UK GDPR, which had operated as a near-prohibition with narrow exceptions. The new regime is more permissive and built around safeguards. According to the ICO, those safeguards include proactively giving people information and letting them contest decisions and request human intervention. The ICO also says that a decision with meaningful human involvement is not solely automated. This echoes California’s “meaningful human involvement” test. The ICO consulted on updated guidance from March 31 to May 29, 2026 and expects final guidance this winter.
Australia: transparency first.
Starting from December 10, 2026, Australian Privacy Principle 1.3 requires entities to disclose in their privacy policies where a computer program makes, or is substantially and directly related to making, a decision that could significantly affect someone’s rights or interests. This is a disclosure duty rather than a right to opt out, but you cannot disclose what you have not mapped.
What the Five Tests Have in Common
Look at the triggers side by side and a pattern emerges. They ask how much an automated component influences the outcome, and whether a human can genuinely change it. The words differ: “materially influences”, “substantially replaces”, “solely automated”, “significantly drives”. However, the evidence does not. You need to show which inputs shaped a decision, how each one was used, and what the human reviewer could actually do.
That is why I like Carlos’s framing of a map built around decisions rather than systems. A model registry tells you a credit model exists. It does not tell you whether its score is a hard cutoff, one factor of twelve, or context on a screen. Under the EU’s SCHUFA logic, that difference may decide whether a vendor score is itself the decision.
Three Additions I Would Make to the ADMT Decision Map
- Mark vendor and third-party scores explicitly: Record the source of each external input, its role in the decision, and what happens when it is unavailable. If a bureau score is a hard cutoff, assume a regulator will treat it as decisive.
- Add a jurisdiction column for the legal test: For each decision, note which test applies (material influence, substantial replacement, solely automated, or disclosure only) and which notice, review route, or record each one requires.
- Capture each round of data requests: When a decision asks for more data, for example a second bureau or an identity check, store what was asked, what came back, and why. That history is exactly what a contest or human review request will need.
Design Once, Configure Per Jurisdiction
The practical risk is forking: a Colorado version, a California version, a UK version, each drifting apart. A better approach is one decision with shared core logic, jurisdiction-specific exceptions for notices, human review routing, and disclosures, and a versioned history of every change. All this, as Carlos discussed, can be done in SMARTS™ Decision Manager.
Regulators in all five places are heading the same way: they will judge automated decisions one decision at a time. Organizations that treat decisions as explicit, versioned, measurable assets will find most of the work already done.
This article is general commentary, not legal advice.
Sources
Source article: ADMT Compliance: Map Your Colorado and California Exposure