AI Control Library / CF-10: Recourse & Incident Response
Designation: Core | Control types represented: Operational and Contextual
Control requirement
Provide an accessible mechanism for people to challenge consequential AI-supported outcomes and obtain meaningful authorized review, correction or explanation as appropriate. Track cases through a reasoned disposition.
Why this matters
A complaint form is insufficient if it leads only to the same automated decision again. Recourse needs an accountable person with evidence and authority to consider the challenge.
How the control types work together
Operational controls establish ownership, review and handling procedures. Contextual controls shape the information, expectations and operating environment that guide how people interpret and use the system.
When it applies
People materially affected by AI-supported decisions, with qualified review determining applicable rights and response duties.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The business decision owner maintains recourse with customer support, domain reviewers and privacy or legal functions.
Implementation guidance
- Define who can raise a challenge, accessible intake channels, relevant timing and the authority needed for review.
- Explain the route clearly and collect proportionate case information, offering support where the normal channel is unsuitable.
- Provide qualified review of relevant evidence and disputed facts, avoiding automatic deference to the model.
- Communicate the disposition and any further review route, verifying corrections and feeding systemic findings into remediation.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Submit a representative challenge | It reaches an authorized reviewer rather than only automated reprocessing. |
| Dispute an incorrect input | The process can assess and correct it where appropriate. |
| Trace a completed case | The person receives a meaningful outcome and required follow-up occurs. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Recourse procedure and communications
- Reviewer authority and evidence
- Case decisions and response
- Correction and systemic-finding records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate inaccessible review, unresolved material harm or disputed obligations to business and legal authorities. Use appropriate interim protection while substantive review proceeds.
Example in practice
Hypothetical example: A customer challenges a service restriction. A reviewer examines the actual decision record, corrects a relevant error and checks related cases instead of merely rerunning the same score.
Related controls
- CF06-011: Automated Decision Explanation Rights
- CF04-014: AI Decision Record & Traceability
- CF10-011: AI Harm Remediation
Framework mappings
- NIST AI RMF (MANAGE 3.2)
- EU AI Act (Art. 26, GDPR Art. 22)
- ISO 42001 (Cl. 10.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Recourse & Incident Response
Version 1.0