# AI Automated Decision-Making Assessment Template

## Organisation: Cerebrum AI Labs

---

## SECTION 1: AI DECISION SYSTEM IDENTIFICATION

| Field | Value |
|-------|-------|
| System Name | |
| Description | |
| Category | Credit / Employment / Healthcare / Public Admin / Insurance / Education / Other |
| Data Subjects Affected | |
| Monthly Decision Volume | |
| Assessment Date | |

---

## SECTION 2: ART. 22 APPLICABILITY

### 2.1 Is There a Decision?

| Question | Response |
|----------|----------|
| Does the AI output directly determine an outcome? | Yes / No |
| Or is it advisory input for a human decision? | Advisory / Determinative |

### 2.2 Is the Decision Solely Automated?

| Question | Response |
|----------|----------|
| Is there human involvement in the decision chain? | Yes / No |
| If yes, does the reviewer have authority to change the decision? | Yes / No |
| Does the reviewer have domain expertise? | Yes / No |
| Does the reviewer have all relevant information? | Yes / No |
| Is sufficient time allocated for review? | Yes / No |
| Does the reviewer exercise genuine discretion? | Yes / No |
| What is the override rate? | ___% |
| **Determination**: Is the decision solely automated? | Yes / No |

### 2.3 Legal or Significant Effects?

| Effect Type | Applicable? | Description |
|-------------|------------|-------------|
| Legal effects | Yes / No | |
| Access to services | Yes / No | |
| Financial impact | Yes / No | |
| Health/safety impact | Yes / No | |
| Freedom/autonomy | Yes / No | |
| **Determination**: Legal or significant effects? | Yes / No |

### 2.4 Art. 22 Conclusion

| | |
|---|---|
| **Art. 22 triggered?** | Yes / No |
| If yes, exception relied upon | Art. 22(2)(a) Contract / (b) Law / (c) Consent / None |
| Special category data used? | Yes / No |
| If yes, Art. 22(4) condition | Art. 9(2)(a) / Art. 9(2)(g) |

---

## SECTION 3: HUMAN OVERSIGHT ASSESSMENT

| Element | Assessment |
|---------|------------|
| Oversight level | HITL / HOTL / HIC / Autonomous |
| Reviewer authority to override | Yes / No |
| Reviewer domain competence | Yes / No |
| Reviewer access to all information | Yes / No |
| Sufficient time for review | Yes / No |
| Reviewer exercises discretion | Yes / No |
| Override rate | ___% |
| Average review time | ___ seconds |
| Daily volume per reviewer | ___ decisions |
| Automation bias countermeasures | Yes / No — Describe: |
| Training provided | Yes / No |
| Monitoring dashboard | Yes / No |
| **Effectiveness determination** | Effective / Nominal / Insufficient / Absent |

---

## SECTION 4: CONTESTATION MECHANISM (Art. 22(3))

| Element | Assessment |
|---------|------------|
| Contestation mechanism exists | Yes / No |
| Mechanism is accessible | Yes / No |
| Response timeframe | ___ days |
| Independent reviewer assigned | Yes / No |
| Data subject can submit evidence | Yes / No |
| Written outcome provided | Yes / No |
| Further appeal options indicated | Yes / No |
| Contestation rate | ___% |
| Overturn rate | ___% |
| **Contestation compliant?** | Yes / No |

---

## SECTION 5: ART. 22(3) SAFEGUARDS

| Safeguard | Implemented? | Details |
|-----------|-------------|---------|
| Right to human intervention | Yes / No | |
| Right to express point of view | Yes / No | |
| Right to contest the decision | Yes / No | |
| Explanation of decision provided | Yes / No | |
| Notification of automated decision | Yes / No | |

---

## SECTION 6: RISK ASSESSMENT

| Factor | Assessment |
|--------|------------|
| Art. 22 triggered without valid exception | Yes / No |
| Human oversight insufficient | Yes / No |
| Contestation mechanism non-compliant | Yes / No |
| Special category data without Art. 22(4) | Yes / No |
| High decision volume | Yes / No |
| Vulnerable data subjects | Yes / No |
| **Overall Risk Level** | Low / Medium / High / Critical |

---

## SECTION 7: REMEDIATION ACTIONS

| # | Action | Priority | Owner | Deadline | Status |
|---|--------|----------|-------|----------|--------|
| 1 | | | | | |
| 2 | | | | | |

---

## SECTION 8: APPROVAL

| Role | Name | Date |
|------|------|------|
| System Owner | | |
| DPO | | |
| Legal Counsel | | |

**Next Review**: _______________