Built for the human-oversight era.

A person may not be subject to a solely automated decision with legal or similarly significant effect — human intervention must be available on request.

The Data (Use and Access) Act replaced Article 22 on 5 February 2026: significant automated decisions are permitted, but safeguards are mandatory — people must be able to obtain human intervention, make representations, and contest the decision.

Automated employment decision tools require an independent bias audit and advance notice to candidates — an automated decision alone is not enough.

Switzerland’s revised data protection law: automated individual decisions must be disclosed, and the person can ask for the decision to be reviewed by a human.

Quebec requires businesses to inform people when a decision is based exclusively on automated processing — and to offer a path to a human who can review it.

South Korea’s privacy law grants the right to refuse, or demand a human explanation of, fully automated decisions that significantly affect a person.

Consumers must be told when they are interacting with generative AI in regulated services — disclosure on request, upfront for regulated professions.

Israel’s modernized privacy law sharpens regulatory enforcement over automated processing of personal data; the regulator’s AI guidance is principles-based.

Japan’s first AI law sets a light-touch national governance baseline — an "endeavor to cooperate" duty and transparency expectations rather than hard oversight mandates or penalties today.

Singapore’s PDPC framework recommends human-over-the-loop controls scaled to risk. Not binding — but the governance reference point for the region.

Korea’s AI Basic Act (in force 22 January 2026) imposes duties on high-impact AI — employment, loans, healthcare and more — including risk management, explainability, and human-oversight mechanisms.

Transparency obligations apply: people must be told when they interact with an AI system, and AI-generated content must be disclosed (machine-readable marking grace period runs to December 2, 2026).

Australia’s Privacy Act amendments require privacy policies to disclose automated decisions that significantly affect individuals — transparency first, with broader reform still moving.

Colorado repealed and replaced its 2024 act (SB 26-189, May 2026): deployers of automated decision-making technology must give clear notice, explain adverse outcomes, and offer meaningful human reconsideration of consequential decisions.

Human oversight becomes mandatory for high-risk AI systems: humans must be able to understand, intervene in, and override the system (deferred from 2026 by the Digital Omnibus, adopted June 2026).