How to Request Human Review of AI Automated Decision That Affects You Legally

# Python FastAPI example for human review requests
from fastapi import FastAPI, Request, HTTPException
from pydantic import BaseModel
from datetime import datetime
import logging

app = FastAPI()

class HumanReviewRequest(BaseModel):
    decision_type: str  # e.g., "credit_decision", "employment_decision"
    decision_date: datetime
    user_id: str
    description: str
    requester_email: str

@app.post("/api/v1/human-review-request")
async def submit_human_review_request(request: HumanReviewRequest):
    """
    Endpoint for users to request human review of automated decisions.
    Implements GDPR Article 22 requirements.
    """
    # Validate request contains required information
    if not request.decision_type or not request.description:
        raise HTTPException(
            status_code=400,
            detail="decision_type and description are required"
        )

    # Log the request for tracking
    request_id = f"HRR-{datetime.utcnow().timestamp()}"
    logging.info(
        f"Human review request {request_id}: "
        f"type={request.decision_type}, user={request.user_id}"
    )

    # Create ticket in review queue
    review_ticket = {
        "request_id": request_id,
        "user_id": request.user_id,
        "decision_type": request.decision_type,
        "decision_date": request.decision_date,
        "description": request.description,
        "status": "pending_human_review",
        "created_at": datetime.utcnow(),
        "required_response_deadline": datetime.utcnow()  # Set based on regulation
    }

    # Store in database (implementation depends on your stack)
    # await db.human_review_requests.insert(review_ticket)

    return {
        "request_id": request_id,
        "status": "submitted",
        "message": "Your request for human review has been received"
    }

import hashlib
from datetime import datetime

class DecisionAuditLogger:
    """Audit log for automated decisions - GDPR Article 22 compliance"""

    def log_decision(self, user_id: str, decision_type: str,
                     outcome: str, factors: list):
        audit_entry = {
            "timestamp": datetime.utcnow().isoformat(),
            "user_id": self._hash_identifier(user_id),
            "decision_type": decision_type,
            "outcome": outcome,
            "factors_used": factors,
            "human_review_requested": False,
            "human_review_outcome": None,
            "request_id": None
        }

        # Store audit entry
        # This supports demonstrating compliance during regulatory inquiries

        return audit_entry["request_id"]  # Returns reference ID

    def log_human_review_request(self, user_id: str, request_id: str):
        """Record when a user requests human review"""
        # Update the original decision audit entry
        # Mark that human review was requested and processed

    def _hash_identifier(self, user_id: str) -> str:
        """Hash user identifiers for audit log privacy"""
        return hashlib.sha256(user_id.encode()).hexdigest()[:16]

# Example: User-facing notification about automated decisions
def notify_user_of_decision(user_email: str, decision: dict):
    """
    Notify users when an automated decision is made,
    including their right to human review.
    """
    email_content = f"""
    A decision has been made regarding your application.

    Decision: {decision['outcome']}
    Date: {decision['timestamp']}

    You have the right to request human review of this decision.
    To request review, visit: {config.HUMAN_REVIEW_URL}

    You may also request:
    - Explanation of the decision logic
    - Access to data used in the decision
    - Correction of inaccurate data

    Response timeline: 30 days per GDPR Article 22
    """
    send_email(user_email, "Decision Notification", email_content)