A person applies for credit, a public benefit, a job, health care, or an administrative authorization. The person provides data and receives an answer: denied. No public official may have personally examined the individual circumstances. The outcome may instead derive from a score, a predictive classification, an automated model, or an artificial intelligence tool that assigned a risk level or recommended a decision.

From the citizen's perspective, the difference between a fully automated decision and a human decision based almost entirely on an automated recommendation may be minimal. In both situations, the outcome changes opportunities, rights, or material conditions of life. The constitutionally relevant issue is not merely whether a person presses the final button, but who actually exercises decision-making power, who can explain its exercise, and who is accountable when the outcome violates a right.

Not every use of AI presents the same problem. A system that organizes files, corrects formal errors, or summarizes documents does not occupy the same position as a system whose output determines, conditions, or carries decisive weight in a decision concerning a person. The boundary appears when technology ceases merely to assist an activity and begins to participate materially in the exercise of power.

Article 22 of the General Data Protection Regulation (GDPR) provides one of the clearest starting points. Subject to the exceptions and safeguards established by the Regulation itself, it provides protection against decisions based solely on automated processing that produce legal effects or similarly and significantly affect the individual. The case law of the Court of Justice has also shown that the formal structure of the procedure is not enough. In SCHUFA Holding (Scoring), C-634/21, the Court held that an automatically generated score may constitute a relevant decision for purposes of Article 22 when the third party receiving it assigns the score a determining role in the final outcome.

Algorithmic opacity becomes a constitutional problem when it prevents the exercise of rights. A person who does not know which system intervened, what information was decisive, what criterion led to the outcome, or which authority assumed responsibility for the decision may be materially unable to challenge it. In Dun & Bradstreet Austria, C-203/22, the Court of Justice connected information about the logic of the decision to the practical ability to understand and contest it.

The U.S. experience illustrates another dimension of the problem. OMB Memorandum M-25-21 defines certain federal uses as high-impact AI when AI output serves as a principal basis for decisions with legal, material, binding, or significant effects on rights or safety. The memorandum makes clear that a use may be high-impact whether or not human oversight exists. For such uses, it requires, among other measures, appropriate human oversight and accountability and, where appropriate, access to human review or appeal mechanisms.

In Latin America, Judgment T-323 of 2024 of the Constitutional Court of Colombia offers an especially powerful formulation. The Court accepted auxiliary uses of AI in the administration of justice but held that technology cannot replace the judge in functions requiring the interpretation of facts and evidence, the giving of reasons, and the adoption of the decision. The case shows that certain legal competences are not merely tasks susceptible to optimization: they are attached to an officeholder who must retain responsibility.

This paper therefore begins with a question: who is responsible when an algorithm makes a decision about a citizen? The developer, the provider, the institution that acquired the technology, the official who accepted its recommendation, or all of them within different spheres? Fragmentation of the technological chain cannot produce an accountability vacuum vis-a-vis the affected person.

The central hypothesis is that constitutional accountability cannot be delegated to a machine. AI may assist, recommend, classify, and automate analysis. But when a decision affects fundamental rights or legally protected interests, an identifiable person or institution must remain capable of explaining, reviewing, correcting, and answering for the outcome.

2.1. What does it really mean to decide?

For purposes of this study, three levels should be distinguished. In algorithmic assistance, AI organizes information or provides support while the person conducts an independent assessment. In algorithmic recommendation, the system proposes a score, classification, or outcome that influences the human decision. In algorithmic determination, the system's output directly produces the result or carries such dominant weight that human intervention is reduced to ratification.

The distinction is not merely terminological. The greater the system's material influence, the greater the need for safeguards. SCHUFA is important precisely because it prevents an organization from converting a materially automated decision into a formally human one merely by inserting a third party at the end of the chain. The legally relevant question is how much real decision-making power the human retains.

2.2. A human signature does not eliminate an algorithmic decision.

One of the most common risks is rubber-stamping: an official, employee, or professional receives an automated recommendation and accepts it almost automatically. The signature exists, but independent judgment may not. Constitutionally meaningful human intervention requires sufficient understanding of the result, effective authority to depart from it, and accountability for the final decision.

The mere presence of a person is not control. Oversight is meaningful only when the human can disagree with the machine. If rejecting the recommendation requires extraordinary authorization, triggers internal penalties, is undertaken without sufficient information, or never occurs in practice, the decision architecture may remain algorithmic in substance.

2.3. Who is responsible: developer, provider, institution, or official?

In practice, there is a chain: developer, provider, deployer or user entity, decision-making official, and affected person. The solution is not to attribute everything to a single actor, but to prevent the distribution of functions from producing an absence of responsibility.

The developer may have duties connected to design, evaluation, and documentation. The provider may be responsible for market-placement and support obligations. The organization deploying the system has its own duties of selection, governance, and oversight. The official or professional retains the obligations inherent in the legal authority that he or she exercises. Technological outsourcing does not automatically make constitutional accountability outsourceable.

The European AI Act reflects a distribution of obligations between providers and deployers. For high-risk systems, the regulation requires human-oversight measures and, when the relevant provisions apply, imposes governance and use obligations on deployers. Similarly, OMB M-25-21 assigns organizational responsibilities to federal agencies and requires responsible officials to accept and manage the risks of high-impact uses.

A criterion of proximity to decision-making power follows from this: the closer an actor is to the effective exercise of power over the person, the greater that actor's duty to ensure that the result is lawful, reviewable, and attributable. The citizen should not have to reconstruct an entire contractual and technical chain in order to discover who is responsible for the decision that affected him or her.

2.4. Principle of Non-Delegable Constitutional Accountability.

This paper proposes the following formulation: when an automated or artificial intelligence system materially participates in a decision affecting fundamental rights, legally protected interests, or essential conditions of a person's life, an identifiable natural person or legal institution must remain vested with effective authority to explain, review, correct, and answer for that decision.

The principle requires four minimum capacities: to explain the system's intervention in a legally useful manner; to review the individual case; to correct or set aside an inappropriate outcome; and to answer within an administrative or judicial remedial mechanism. It does not require a single entity to bear every technical or contractual responsibility. It requires that, from the citizen's perspective, the architecture not end in a machine.

A practical test helps identify an accountability vacuum. Five questions should be answerable whenever a high-impact automated decision is involved: who decided to use the system; who can explain the role of AI; who can depart from its output; who can review and correct the decision; and who is legally answerable to the affected person. If those answers are indeterminate, the problem ceases to be purely technological and becomes a constitutional problem.

3.1. Article 22 of the GDPR as a starting point.

European law recognizes specific protection against certain decisions based solely on automated processing that produce legal effects or similarly and significantly affect a person. Article 22 does not establish an absolute prohibition: it allows situations connected with contracts, legal authorization, or explicit consent, but requires safeguards in the cases provided for by the Regulation.

Those safeguards include, in certain circumstances, the possibility of obtaining human intervention, expressing one's point of view, and contesting the decision. Article 15(1)(h), together with the GDPR's information duties, also provides access to meaningful information about the logic involved, as well as the significance and envisaged consequences of the automated processing.

3.2. SCHUFA: looking at functional reality.

In C-634/21, the Court of Justice examined an automatically generated creditworthiness score used by third parties. The importance of the case lies in the Court's refusal to accept a purely formal separation between the entity generating the score and the entity adopting the contractual decision. When the score plays a determining role, it may fall within the regime governing automated decisions.

This reasoning supports a comparative rule: it is not enough to ask who signed the decision. One must identify what element actually determined the outcome. The existence of a human interface or final approval does not, by itself, make the process genuinely human.

3.3. Dun & Bradstreet: explanation as a condition for challenge.

In C-203/22, decided on 27 February 2025, the Court of Justice developed the content of the right to meaningful information concerning automated decisions. The explanation must be understandable and must enable the person to know, in a useful way, how the result was reached and to challenge it. Technical complexity or the invocation of trade secrets cannot automatically empty the right of substance.

The constitutional relevance of this doctrine is direct. A remedy without sufficient information may be nominal but ineffective. Explanation does not necessarily require disclosure of source code or turning the citizen into a technical auditor; it requires reasons connecting the outcome to relevant factors in the case and enabling the detection of errors, inaccurate data, or legally questionable criteria.

3.4. The AI Act and regulation of the system.

Regulation (EU) 2024/1689 adds a layer of governance focused on AI systems themselves. Its architecture combines prohibited practices, transparency obligations, rules for general-purpose models, and a special regime for high-risk systems. Regulation (EU) 2026/1744 modified the application timetable for Sections 1, 2, and 3 of Chapter III concerning high-risk systems: 2 December 2027 for systems classified under Article 6(2) and Annex III, and 2 August 2028 for systems linked to Article 6(1) and Annex I.

The timing change matters because it prevents an inaccurate statement: as of this study's cutoff date, much of the AI Act is applicable, but several structural obligations concerning high-risk systems remain in transition. The existence of a regulation already in force does not mean that every obligation is already enforceable for every category of system.

Article 14 articulates a strong concept of human oversight for high-risk systems: the design must allow natural persons to oversee them effectively, understand their capabilities and limitations, guard against automatic reliance on the output, and, where appropriate, disregard, override, or reverse the result. The logic aligns with the idea developed in this paper: oversight requires a real capacity to disagree.

Article 26 assigns obligations to deployers of high-risk systems, including the assignment of oversight to persons with appropriate competence, training, and authority when the relevant provisions apply. The word authority is essential: knowledge without institutional power to depart from the output does not constitute effective control.

Article 27 introduces fundamental-rights impact assessments for certain deployers and high-risk uses. Article 86 recognizes a right to obtain clear and meaningful explanations of the role of the system and the main elements of certain individual decisions based on the output of high-risk systems listed in Annex III. Article 85, in turn, provides for complaints to market-surveillance authorities concerning infringements of the Regulation.

3.5. Toward a European algorithmic due process.

Taken together, the GDPR, SCHUFA, Dun & Bradstreet, the Charter of Fundamental Rights, and the AI Act reveal elements that functionally approximate an algorithmic due process: knowledge that automation is involved; sufficient information about its role; the ability to challenge; meaningful human intervention where appropriate; control of risks to fundamental rights; and access to an authority capable of providing a remedy.

This is not to claim that Union law has codified a single constitutional doctrine under that name. Rather, it is to observe a normative convergence. As a system's capacity to produce significant consequences increases, so too does the demand for traceability, explanation, oversight, and review.

3.6. The European limitation: regulatory complexity and phased application.

The European model is advanced, but it does not eliminate every problem. The coexistence of the GDPR, AI Act, sectoral legislation, trade secrecy, and transitional timetables may make it difficult for an individual to identify the precise right that applies. Moreover, not every algorithmic recommendation falls within Article 22 of the GDPR, and not every automated tool is a high-risk AI system under the AI Act. The comparative value of the European model therefore lies not in offering an automatic answer to every case, but in having legally normalized the idea that high-impact automation requires additional safeguards.

4.1. A fragmented model.

The United States does not have a general federal equivalent of the European AI Act establishing a single regime of individual rights against automated decisions. Protection arises from several sources: constitutional due process and equal protection guarantees when state action is present; sectoral legislation; civil-rights and consumer-protection rules; federal administrative policies; and state and local regulation.

This fragmentation has a methodological consequence. It cannot be said that every private automated decision is directly subject to the Fifth or Fourteenth Amendment. Constitutional analysis is triggered principally by decisions of federal, state, or local government and other situations involving state action. In the private sector, protection depends on the substantive field: credit, employment, housing, privacy, health, or other applicable law.

4.2. Due process and opaque systems.

U.S. cases show that the algorithmic problem can arise even when legislation does not use the term artificial intelligence. In K.W. v. Armstrong, 789 F.3d 962 (9th Cir. 2015), litigation concerning Medicaid service budgets calculated through an automated methodology, the court emphasized the need for notices sufficient to allow beneficiaries to understand the basis for a reduction and challenge it. The case is useful as a functional precedent concerning reasons, contestability, and public benefits.

In Houston Federation of Teachers, Local 2415 v. Houston Independent School District, 251 F. Supp. 3d 1168 (S.D. Tex. 2017), teachers challenged a proprietary value-added evaluation system used in employment decisions. The court held that a due-process claim could proceed where affected persons could not adequately verify or reproduce the score influencing employment consequences. Although the litigation ended in settlement and its scope must be read cautiously, the case illustrates the conflict between high-impact public decisions and models whose operation cannot be effectively challenged by the person bearing the result.

State v. Loomis, 2016 WI 68, 881 N.W.2d 749, offers another angle. The Wisconsin Supreme Court allowed the use of a COMPAS assessment in criminal sentencing subject to limitations and warnings, rejecting the claim that this particular use, by itself, violated due process. The case does not legitimate automatic delegation to proprietary software; rather, it shows the need to delimit the weight of the instrument and acknowledge its limitations before integrating it into a decision affecting liberty.

These cases do not create a general federal right to algorithmic explanation. Taken together, however, they reveal a recognizable procedural principle: when the State uses an opaque tool as an important basis for an adverse decision, inability to understand or challenge that basis may acquire due-process significance.

4.3. Credit as a laboratory of explainability.

The Equal Credit Opportunity Act (ECOA), 15 U.S.C. § 1691(d), requires communication of specific reasons for certain adverse actions. Regulation B, 12 C.F.R. § 1002.9, rejects generic explanations that merely state that an applicant failed to meet internal standards or a score.

The CFPB has applied this principle to complex models. In Circular 2022-03 it stated that the complexity of an algorithm does not excuse compliance with adverse-action notice requirements. The regulatory message is particularly useful for this paper's thesis: the black box may be a technical problem, but it should not become a legal defense for omitting reasons when the law requires reasons.

4.4. M-25-21 and the federal concept of high-impact AI.

OMB Memorandum M-25-21, dated 3 April 2025, replaced M-24-10 and established a governance framework for AI uses by Executive Branch agencies. It defines high-impact AI when system output serves as a principal basis for decisions or actions having legal, material, binding, or significant effects on rights or safety. The memorandum expressly states that a use may be high-impact whether or not human oversight is present.

For high-impact uses, agencies must conduct pre-deployment testing, impact assessments, monitoring, training, and governance measures. The memorandum requires appropriate human oversight, intervention, and accountability and, where appropriate, access to human review or an opportunity to appeal. It also requires consideration of impacts on privacy, civil rights, and civil liberties.

M-25-21 is not a constitutional amendment and does not itself create a general private right equivalent to Article 22 of the GDPR. Its comparative importance is institutional: the federal government itself recognizes that AI uses serving as a principal basis for significant decisions require enhanced governance and do not cease to be high-impact merely because a human is in the loop.

4.5. States and cities as regulatory laboratories.

New York City applies Local Law 144 to certain automated employment decision tools, requiring a bias audit, publication of results, and notices to candidates or employees. It is a specific protection limited to the covered field, but it demonstrates how concerns about algorithmic discrimination are translated into ex ante obligations.

California adopted privacy regulations concerning automated decisionmaking technology. The regulations took effect on 1 January 2026, but specific obligations relating to significant decisions using ADMT begin on 1 January 2027. The California Privacy Protection Agency describes rights to notice, opt-out where applicable, and access to meaningful information about the operation and effect of ADMT. Temporal precision is essential: as of this study's cutoff date, a significant portion of the regime remains prospective.

Colorado enacted SB26-189, providing protections for certain consequential decisions and a right to request meaningful human review and reconsideration following adverse outcomes from covered systems, with principal provisions taking effect in 2027. Texas, through HB 149, established as of 1 January 2026 a state AI-governance framework that includes prohibitions on certain discriminatory uses or uses intended to infringe protected rights.

4.6. The U.S. conclusion.

U.S. law does not converge in a single clause of algorithmic rights. Several lines nevertheless point in the same direction: government remains accountable for its decisions even when it uses software; certain sectors require specific reasons; opacity can aggravate due-process concerns; and high-impact AI policies require oversight, evaluation, and avenues for review. The U.S. model is less uniform than the European one, but it does not necessarily accept the proposition that an algorithm breaks the legal chain of accountability.

5.1. A heterogeneous region with powerful constitutional tools.

Latin America does not present a single regulatory model. The region combines data-protection laws influenced by European traditions, rapid constitutional remedies, constitutional courts with strong involvement in fundamental-rights adjudication, and recent AI reforms. This combination makes the region especially relevant for constructing safeguards against automated decisions.

5.2. Brazil: review and transparency under the LGPD.

Article 20 of the Lei Geral de Proteção de Dados Pessoais recognizes the data subject's right to request review of decisions made solely on the basis of automated processing of personal data that affect the subject's interests, including decisions concerning personal, professional, consumer, and credit profiles. Paragraph 1 requires the controller, upon request, to provide clear and adequate information about the criteria and procedures used, while respecting trade and industrial secrets.

The current text requires an important clarification. An earlier version of Article 20 expressly referred to review by a natural person, but the current wording, as amended by Law 13.853/2019, no longer contains that literal requirement. It would therefore be inaccurate to present the current LGPD as always guaranteeing human review. It does guarantee a request for review and transparency regarding criteria and procedures, and paragraph 2 allows the national authority to conduct audits to verify discriminatory aspects when information is withheld on grounds of trade or industrial secrecy.

Brazil is also debating a general AI framework through PL 2338/2023. The Senate approved a substitute text in December 2024 and sent it to the Chamber of Deputies. As of August 2026, it remained pending a vote in the Chamber and was under consideration by a special committee. It must therefore be treated as a legislative proposal, not as law currently in force.

5.3. Colombia: non-substitution of the judge.

Judgment T-323/24 of the Constitutional Court is one of the decisions most directly connected to this study's thesis. In reviewing a tutela judge's use of ChatGPT, the Court distinguished technological assistance from substitution of judicial reasoning. AI may support certain tasks, but it cannot replace the judge in evaluating facts and evidence, giving reasons, or adopting the decision.

The Court articulated principles of transparency, responsibility, privacy, non-substitution, risk prevention, equality, and human control. Its importance goes beyond the use of a particular chatbot. The judgment expresses a generalizable constitutional intuition: a competence legally assigned to a human organ cannot be emptied through technological delegation that causes the officeholder's reasoning and responsibility to disappear.

In 2026, Colombian constitutional case law continued to debate the scope of T-323/24 in other contexts involving AI. That development confirms that the precedent must be read precisely according to the context of each case, while also showing that the automation of public functions has already become part of Colombian constitutional discourse.

5.4. Chile: a new-generation right still in transition.

Law 21.719 reformed Chilean personal-data legislation and introduced a new Article 8 bis concerning individual automated decisions, including profiling. The reform recognizes information and transparency safeguards and provides mechanisms relating to explanation, human intervention, expression of the individual's point of view, and review in the circumstances specified by law.

The relevant reforms, however, enter into force on 1 December 2026. At the research cutoff date they had been enacted but were not yet operational. Chile therefore illustrates how rights associated with automated decisions are migrating from general data-protection principles toward more explicit rules of contestability and human control.

5.5. Uruguay: a precedent predating the current AI wave.

Article 16 of Law 18.331 protects against decisions producing legal effects or significantly adverse effects when based on automated processing intended to evaluate aspects of personality, such as work performance, credit, reliability, or conduct. The affected person may challenge administrative acts or private decisions and obtain information about the evaluation criteria and the program used.

Uruguay's importance is historical and doctrinal. It shows that the problem of automated decision-making did not begin with generative models. Even before the current AI boom, law was already concerned with automated evaluation systems capable of significantly affecting individuals.

5.6. Peru: responsible-AI principles and regulatory development.

Law 31814 promotes the use of artificial intelligence for economic and social development under human-centered principles of ethics, transparency, accountability, and respect for rights. Supreme Decree 115-2025-PCM approved its implementing regulation and develops a framework of risk management, transparency, and human oversight for certain uses.

The Peruvian model is relevant as a governance architecture, but it should not automatically be equated with the individual regime of Article 22 of the GDPR. Its contribution to the analysis lies in showing the progressive incorporation of the language of risk, accountability, and human control into the region's digital public law.

5.7. The Inter-American system.

The American Convention on Human Rights provides general anchors: Article 8 on judicial guarantees, Article 24 on equality before the law, and Article 25 on effective judicial protection. These provisions were not drafted with algorithms in mind, but their functions remain relevant when a public authority uses technology to adopt decisions concerning rights and obligations.

In March 2026, the Inter-American Commission on Human Rights called on States to prevent algorithmic discrimination and emphasized the need for human-rights-based frameworks, transparency, explainability, access to information about automated decisions, challenge mechanisms with meaningful human review, remedies, monitoring, and impact assessments. Because this is regional guidance rather than a judgment that by itself creates identical obligations for every State, it should be presented as evidence of an emerging interpretive direction.

5.8. A possible regional convergence.

Brazil contributes review and transparency; Colombia, non-substitution and human control in the judicial function; Chile, explicit new-generation safeguards; Uruguay, contestability through older legislation; Peru, responsible-AI governance; and the Inter-American system, a regional language of explanation, non-discrimination, and remedy. A uniform Latin American code does not yet exist, but there are enough elements to identify a movement toward legal control of algorithmic power.

The comparison makes it possible to construct a functional standard composed of six safeguards. They do not appear with equal force or under the same name in every jurisdiction. Their value lies in identifying the conditions that a high-impact automated decision should satisfy in order to remain within a rule-of-law structure.

6.1. Legality.

The first question is whether the public authority or entity has a legal basis to use the system in that context and to process the data or produce the type of output being used. In the public sector, technology does not create new legal competence. The administration must act within existing statutory authority and respect applicable constitutional limits.

Legality also includes regulatory timing. A regime that has been enacted but is not yet applicable cannot be presented as a current obligation. The timetables of the European AI Act, the Chilean reform, California, and Colorado show that algorithmic governance requires precision not only about what rule exists, but also about when it becomes enforceable.

6.2. Transparency and explanation.

The person needs to know that automation materially intervened and must receive a legally useful explanation. Explanation does not necessarily mean disclosure of source code or trade secrets. It means providing reasons sufficient to understand the role of the technology, the relevant factors, and the connection between those factors and the outcome.

Dun & Bradstreet, ECOA/Regulation B, Brazil's LGPD, Uruguayan law, and the Chilean reforms express this requirement in different ways. The functional rule can be stated as follows: if a person cannot sufficiently understand why a result was received, that person's ability to challenge it is diminished.

6.3. Equality and non-discrimination.

Automated systems can reproduce inequality through historical data, proxy variables, design choices, or deployment contexts. Equality is not satisfied by asserting that an algorithm treats everyone mathematically. It must be examined whether the system produces legally prohibited distinctions, disproportionate impacts, or errors concentrated among protected groups.

The EU Charter of Fundamental Rights, the Equal Protection Clause where state action exists, civil-rights rules, New York City's bias-audit requirements, the LGPD, and Inter-American guidance provide different instruments for the same problem: automation does not neutralize the prohibition of discrimination.

6.4. Meaningful human intervention.

Oversight must be real. The reviewer needs knowledge, time, access to sufficient information, and authority to depart from the output. A human who merely confirms what the interface displays does not add a substantive safeguard.

The European AI Act develops this idea through oversight that allows a human to disregard, override, or reverse outputs. OMB M-25-21 requires appropriate oversight and intervention for high-impact AI. Colorado defines meaningful human review in which the reviewer has authority to approve, modify, or overturn the automated decision. Colombia emphasizes non-substitution of the judge.

6.5. Effective challenge and review.

An affected person must have a channel through which to challenge data, inferences, procedure, and outcome. That channel must be accessible and must lead to a review capable of changing the decision. A form that merely sends the case back to the same algorithm does not constitute effective review.

The GDPR provides for contestation and human intervention in circumstances covered by Article 22; OMB M-25-21 provides for review and appeal where appropriate; Uruguayan legislation allows challenge; and the American Convention protects access to effective remedies. Institutional forms may vary, but the function is common: to make the decision contestable.

6.6. Accountability and remedy.

Finally, someone must be answerable. The person needs to know against which institution a complaint can be filed, who can correct the harm, and which authority can review the conduct. Without attribution of responsibility, transparency and oversight lose part of their effectiveness.

The six safeguards reinforce one another. Explanation enables challenge; challenge requires a reviewer with authority; the reviewer needs traceability; equality requires auditing and adequate data; and remedy requires a responsible institution. Algorithmic due process is not a single rule but an architecture of interconnected safeguards.

7.1. The value chain cannot become a chain of excuses.

Contemporary systems may involve model developers, infrastructure providers, integrators, consultants, entities deploying the tool, administrators, public officials, and professionals who adopt the final decision. Each actor controls a different part of the risk.

Technical responsibility may arise when the system presents foreseeable defects in design, training, validation, or documentation. Provider responsibility may relate to information, support, known limitations, or failure to comply with regulatory obligations. The deployer controls the context of use, operational data, the concrete purpose, and the degree of institutional dependence on the tool. The official or professional controls, at least in theory, the decision legally attributed to that person.

7.2. The provider does not replace the holder of public power.

When a public administration purchases a private system, procurement may outsource engineering, but it does not transform the technology company into the holder of public authority. If the law assigns an agency the decision concerning a benefit, license, or sanction, that agency remains responsible for ensuring that the procedure respects the citizen's rights.

This point is especially important for proprietary systems. An institution should not be able to answer a challenge by saying that it does not know the logic because the provider protects the model as a secret. If the system cannot be used consistently with the institution's legal obligations, the problem lies in the decision to acquire or deploy it, not in the citizen who complains.

7.3. The official cannot be a rubber stamp.

Conversely, it is not enough to keep a human name in the file if organizational design turns that person into an automatic ratifier. Individual responsibility requires effective authority and conditions that allow the exercise of independent judgment.

In contexts such as adjudication, the requirement may be especially demanding. T-323/24 shows that the judge's duty to give reasons and the judicial decision-making function cannot be transferred to a tool. In other fields the intensity may vary, but the principle is similar: a legally personal or institutional competence does not disappear because an automated recommendation appears objective.

7.4. Shared responsibility, single point of contact.

This paper proposes separating two planes. Internally, several entities may share or distribute contractual, technical, administrative, disciplinary, or civil responsibility. Externally, the affected person should have at least one clearly identifiable institution that receives the complaint and guarantees explanation, review, and remedy.

This solution avoids imposing on the citizen a forensic investigation of software contracts before rights can be exercised. The decision-making institution may later seek recourse against the provider, demand indemnification, initiate contractual proceedings, or allocate responsibility as appropriate. But the internal architecture should not obstruct initial access to justice or administrative review.

7.5. A responsibility matrix.

An indicative allocation can be formulated as follows: the developer is primarily responsible for design and documentation under applicable rules; the provider, for conformity, information, and support; the deployer, for selection, purpose, usage data, impact assessment, and governance; the decision-making institution, for legality, due process, equality, explanation, review, and remedy; and the official, for the duties inherent in the office where decision-making competence is retained.

This matrix is not intended to replace national liability regimes. Its function is to show that the question 'who is responsible?' may have multiple answers without accepting a null answer. The existence of several possible responsible actors must never end in an absence of responsibility toward the affected person.

8.1. Nature of the proposal.

The Principle of Non-Delegable Constitutional Accountability is not presented as a positive rule already recognized under that name in every jurisdiction studied. It is a doctrinal proposal constructed from converging elements of current law, case law, regulation, and public policy.

Its purpose is to offer a common tool for evaluating automated decisions without depending on a particular technology. The doctrine should work for a traditional scoring system, a machine-learning model, a generative system integrated into an administrative workflow, or a future tool performing an equivalent function.

8.2. Formulation.

When an automated or artificial intelligence system materially participates in a decision affecting fundamental rights, legally protected interests, or essential conditions of a person's life, an identifiable natural person or legal institution must remain vested with effective authority to explain, review, correct, and answer for that decision.

The word materially is important. The principle does not seek to impose the same level of control on a calculator as on a system recommending termination of a social benefit. The system's actual influence on the outcome, the seriousness of the consequences, the reversibility of the harm, the person's vulnerability, and the availability of alternative mechanisms should all be examined.

8.3. Five-step test.

Step one: identify the effect. Does the decision produce legal or significant consequences for rights, opportunities, essential services, liberty, employment, credit, health, education, or other protected interests? Step two: identify the influence of AI. Does the system merely assist, or does it serve as a principal, determining, or practically binding basis?

Step three: identify real human control. Is there a person who sufficiently understands the outcome and has practical authority to depart from it? Step four: identify contestability. Can the affected person know that technology intervened, obtain reasons, correct data, and request a review capable of changing the outcome? Step five: identify responsibility. Is there a clearly responsible institution or legal person against whom a claim can be brought and from whom a remedy can be obtained?

If all five questions receive satisfactory answers, automation has a greater chance of being integrated into a procedure compatible with constitutional safeguards. If the system has high influence, the reviewer lacks authority, explanation is impossible, and no entity assumes responsibility, there is a strong indication of constitutionally problematic delegation.

8.4. Intensity rule.

Safeguards should increase with impact. A system used to sort email does not require the same regime as one influencing detention, sentencing, eligibility for benefits, hiring, credit, or access to medical treatment. Proportionality helps avoid two opposite errors: regulating every form of automation as though it were a sovereign decision, or treating high-impact decisions as mere technological products.

8.5. Public procurement and the duty of explainability.

The principle has a practical consequence for procurement. Before contracting for a tool intended for high-impact decisions, an institution should verify whether it can satisfy its own legal obligations with that product. At a minimum, it should know the product's limitations, audit mechanisms, review possibilities, traceability, and the conditions under which reasons can be provided to the affected person.

A trade-secret clause should not be sufficient to nullify constitutional safeguards. If an institution cannot explain or review a decision because the technology contract prevents it from doing so, there is a governance defect that predates the individual outcome.

8.6. Institutional design.

For high-impact decisions, the institution should maintain a record of the system used, its purpose, the responsible person or unit, relevant categories of data, oversight measures, risk assessment, complaint channels, and correction procedures. These elements approximate obligations already present, with different scopes, in the AI Act, M-25-21, and various data-protection rules.

8.7. Comparative advantage of the principle.

The proposal does not depend on asserting that every legal system recognizes an identical right to explanation. Instead, it rests on a structural question that can travel across legal systems: can the legal order permit a decision affecting rights to exist without a subject capable of justifying it and answering for it? The answer of a constitutional state should be no.

Artificial intelligence changes the way decision-making power is produced. It does so not only when a machine automatically adopts an outcome, but also when a score or recommendation becomes such a dominant reference that human intervention loses substantive content.

The comparison reveals different paths. Europe combines data protection, case law on automated decisions, and risk-based AI regulation. The United States offers constitutional safeguards against government action, sectoral duties of explanation, and a growing ecosystem of federal policies and state rules. Latin America combines data protection, constitutional adjudication, and new AI frameworks with a particularly relevant capacity to translate the algorithmic problem into the language of fundamental rights.

None of the systems studied offers a perfect solution. There are exceptions, transitional timetables, institutional fragmentation, trade secrets, and areas still lacking specific regulation. Yet the absence of uniformity does not prevent recognition of a functional convergence: high-impact automated decisions require greater transparency, human control, contestability, and attribution of responsibility.

The principal conclusion of this paper is simple: the existence of an algorithm does not break the constitutional chain. A State cannot cease to be answerable because it purchased a model from a provider. A bank cannot replace a legally required reason with the phrase 'the model determined it.' An official does not exercise genuine control if he or she lacks authority to contradict the output. A judge does not retain the judicial function if the reasoning that the Constitution requires the judge to perform is delegated to a machine.

For that reason, this paper proposes the Principle of Non-Delegable Constitutional Accountability. Its core is not anti-technological. AI can increase administrative capacity, detect patterns, reduce repetitive tasks, and improve services. The limit appears when technological efficiency is used to make disappear the person or institution that must justify the exercise of power.

In a constitutional democracy, every significant decision must be capable of returning from the technological architecture to a legally responsible subject. Someone must explain. Someone must review. Someone must correct. And someone must answer.

Artificial intelligence can automate analysis. It can automate recommendations. It can even automate entire parts of a procedure. What it should not be able to automate is the disappearance of accountability.