Automated decision systems (ADS)
Inventory and govern your automated decision systems in line with Law 25 (Art. 12.1-12.2) and GDPR (Art. 22): registry, datasets, and individual notice.
What is an automated decision system?
An automated decision system (ADS) is a process that produces a decision from personal information without meaningful human intervention — for example, a credit score, an applicant ranking, an insurance premium calculation, or an automated denial. Law 25 (Art. 12.1-12.2) requires you to inform the individual that such a system is being used, disclose the main factors leading to the decision, and provide an opportunity to submit observations to a person. GDPR (Art. 22) sets equivalent rules in Europe, with an explicit right to human intervention.
Dashboard: where do you stand?
From Tools & Reference > AI and automated decisions > Dashboard, visualize the coverage of your ADS: number of systems inventoried, share with completed impact assessments, presence of human-intervention mechanisms, and alerts on high-risk datasets. This is the starting point to steer the progressive compliance of your fleet.
ADS registry: declaring a system
The Registry tab lists your decision systems with their purpose, application domain, risk level, and status (active, pilot, retired). To declare a new ADS, click New system and fill in: the purpose (granting, scoring, ranking, recommendation), the categories of individuals concerned, the input datasets, the autonomy level (fully automated final decision or decision support), and the planned human-intervention mechanism. The system can then be linked to a ROPA activity and the related PIAs.
Datasets and template catalog
The Datasets tab lists the data sources feeding your ADS, with their origin, volume, and sensitivity level. The Catalog offers pre-configured templates (credit scoring, anti-fraud, recommendation, marketing targeting) you can instantiate to avoid starting from scratch. Each template includes the Law 25 mandatory fields and recommended controls.
Notice to individuals and right to intervention
For each ADS, Conformaze generates the wording to insert in your privacy policy and forms: type of automated decision, main factors considered, consequences for the individual, and procedure to request a human review. Human-intervention requests are handled as a special category in the DSAR module — 30-day statutory deadline, full traceability, reasoned reply.
Important
An undocumented automated decision system exposes your organization to direct sanctions (Law 25, Art. 90.1). Inventory them as soon as they go live, even in pilot phase.