No US Law Gives Candidates a Right to a Human Reviewer. Europe Does.

Which candidates can actually demand a person?

Candidates covered by EU data protection law. Article 22 of the GDPR gives a person the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects, and Recital 71 names e-recruiting practices without human intervention as an example. Where contract or consent permits such a decision, the safeguards include obtaining human intervention, expressing a point of view and contesting the outcome ¹.

Everything turns on the word solely, and the word is doing more work than it looks. In the SCHUFA case the Court of Justice held that a credit agency's automated establishment of a probability value is itself automated individual decision-making where a third party receiving it draws strongly on that value ². The case is about credit scoring, and no court has applied it to a candidate. What travels is the structural point: a formally human decider does not automatically move an automated output outside Article 22.

Nobody gets a right to be assessed by a person in the first instance. The right arises only after a decision that was already solely automated, and it attaches to that decision rather than to the tool, so publishing an explanation of how the system works does not answer it.

So the operative test is behavioral. A reviewer who has authority to reach a different answer, who occasionally does, and whose reasoning is written down looks like intervention. A reviewer who confirms the ordering every time is closer to ratification, whatever the process diagram says.

What does US law actually require?

Notice in a few places, and review nowhere. New York City's rule requires a bias audit within the prior year, a published summary and candidate notice at least 10 business days before an automated employment decision tool is used ³. The notice must say how to request an alternative selection process where one is available ⁷. No US statute in force requires you to have one, or to re-decide anything by hand.

That is the gap compliance templates get wrong. Candidate appeal turns up as a line item in policy drafts and vendor decks, sourced to nothing, and once it is written into a careers page it stops being optional in the only way that matters.

One state changes this, and not yet. Colorado's replacement law takes effect January 1, 2027 and requires notice at the point of interaction, a plain-language description of the technology's role after an adverse outcome, and a right to request meaningful human review ⁴. Read the verb: request. Note also that this law replaced an earlier act that was repealed before it ever applied, so a 2025 compliance memo about Colorado is describing a statute that never bound anyone. Confirm which rules reach you before building to any of them, because the map of what applies today has changed twice in two years.

Why offer a review nobody requires?

Three reasons, none of them a statute. A human who genuinely re-decides is the fact pattern that keeps a tool clear of the substantially-assist trigger in New York City's rule. A person on the other end is how a request for an accommodation on an assessment gets received at all. And the review produces the record a challenge asks for: a named person, a date, a reason.

There is a fourth if you hire into Europe. Article 86 of the EU AI Act gives a person affected by a decision taken on the basis of an Annex III high-risk system, where the decision significantly affects them adversely, the right to obtain clear and meaningful explanations of the system's role in the decision and the main elements of the decision taken ⁵. That right runs against the deployer, which is the employer, not the vendor. The substantive high-risk obligations for recruitment systems apply from 2 December 2027 after the Digital Omnibus moved the date ⁶, so this is a build-now, owe-later item rather than a live duty.

The thing being asked for is modest, which is easy to miss when it is described as a right. Article 86 covers the role of the system and the main elements of the decision, not the model, the weights or the training data. Most of it is answerable from records you should already hold. That is also most of what a candidate wants when they ask why the automated screen rejected them.

Write the promise you can actually keep

Write the sentence last, after the workflow exists. Decide who receives a request, what they re-read, how long they have, and what a reversal does to a requisition that may already be closed. Then write one line of notice describing exactly that. A published appeal route with no owner is worse than silence, because it is a written statement about a process nobody runs.

The spec fits on one page:

• Owner. A named role, not a shared inbox, with a backup.
• Window. A stated number of business days, short enough that the requisition is still open.
• Scope. What the reviewer reads: the application, the output, the stage it failed, and the reason recorded at the time.
• Authority. What the reviewer may change, and who signs off if the outcome moves.
• Record. Who looked, what they saw, what they decided, kept on the same schedule as the original decision.

Set the window against your own calendar, because the requisition is the thing that closes. If requests routinely arrive after the role is filled, the honest promise is a re-read against the next opening instead of a reversal, and saying that plainly beats implying a door that has already closed.

And write down what you are not promising: a different outcome, a phone call, or an account of how the system works internally. A short, accurate description of a real process survives scrutiny. An expansive one drafted by somebody who has never run it becomes the first exhibit. This belongs in the same document as the rest of it, which is what an AI hiring policy needs to contain.

Read the evidence >