Cheap to Make, Costly to Check · Volume One
Law
The legal position in this book was current when it was written. This page says which instruments it rests on and records what has moved since.
Nothing here is legal advice.
Chapter 4 · What the Machine Can’t See
- Legal sourceConsumer Financial Protection Bureau. Circular 2022-03, “Adverse Action Notification Requirements in Connection with Credit Decisions Based on Complex Algorithms,” May 2022; and Circular 2023-03, “Adverse Action Notification Requirements and Proper Use of Sample Forms.” The position: a creditor cannot justify noncompliance with ECOA and Regulation B on the grounds that its technology is too complicated or opaque to understand, and may not fall back on sample reasons that do not specifically and accurately state what the decision turned on.
- Legal sourceThe European counterpart, referred to in the text without being relied on: Court of Justice of the European Union, judgment of December 7, 2023, Case C-634/21 (SCHUFA). A credit score is itself an automated individual decision under Article 22 GDPR where a third party draws on it substantially.
Chapter 5 · Where the Bill Lands
- Legal sourceWells Fargo. Consumer Financial Protection Bureau penalty decision, 2016 ($185 million).
Chapter 6 · Whose Bill Is This
- Legal sourceSmith v. Van Gorkom, 488 A.2d 858 (Del. 1985). The board approved a merger on a few hours of discussion, without adequate financial data and without a fairness opinion; the Delaware Supreme Court held that failing to inform oneself of the material information reasonably available is gross negligence, which removes the protection of the business judgment rule. [limit] The case concerns a board and a merger. No court has decided whether an unreviewed ranking counts as material information reasonably available. The transfer is this book’s reading, and the text says so.
Chapter 9 · Writing It Down
- Legal sourceAnthropic PBC v. U.S. Department of War et al., No. 3:26-cv-01996-RFL (N.D. Cal.), Judge Rita F. Lin. Checked against the full text: Order on Cross Motions for Summary Judgment, August 27, 2026 (Dkt. 250); Order of Final Relief (Dkt. 251); Judgment (Dkt. 252). Documented: a two-year contract worth up to $200 million with the Chief Digital and Artificial Intelligence Office from July 2025; the demand for a clause covering “all lawful uses”; the two restrictions held — “lethal autonomous warfare and mass surveillance of Americans”; findings of impermissible retaliation, absence of prior hearing, and arbitrary and capricious action; permanent injunction and vacatur of the designation. The sentence on the contractual limit, verbatim: “The usage policy applicable to DoW work is a purely contractual limit; Anthropic is incapable of enforcing it technologically, and does not have direct visibility into how DoW uses its model.” [limit] A first-instance decision under U.S. law, with an appeal window running into late October 2026. The chapter’s argument hangs on the contractual limit and the two held restrictions, not on the survival of the judgment.
- Legal sourceBoard of Governors of the Federal Reserve System. Supervisory Guidance on Model Risk Management, SR 11-7, April 4, 2011 (issued jointly with the OCC as Bulletin 2011-12; adopted by the FDIC in 2017 as FIL-22-2017). Verbatim: “Effective challenge depends on a combination of incentives, competence, and influence.” Checked against the full text. [limit] A supervisory standard for banks’ quantitative models; its transfer to AI-assisted decisions outside banking is this book’s reading.
Chapter 11 · Ninety Seconds Per Case
- Legal sourceThe lapsing approval as a legal device. Deemed-approval provisions are long established in administrative law; the recurring criticism cited in the text — that the fiction accelerates no review and creates no capacity — comes from the submissions of affected professional bodies. [limit] Not a scientific evaluation.
Chapter 12 · Faster, Not Easier
- Legal sourceThe American position on psychosocial hazards at work: OSHA has no standalone standard; whether the general duty clause reaches psychological hazards is contested and unsettled. NIOSH, “An Urgent Call to Address Work-Related Psychosocial Hazards and Improve Worker Well-Being,” 2024. Office of the Surgeon General, Framework for Workplace Mental Health & Well-Being, 2022 — five essentials, beginning with protection from harm. All of it is guidance.
Chapter 15 · Where the Two Orders Meet
- Legal sourceThe claim that current AI rulebooks order decision rights and none of them names a number for inflow or review time: checked against two full texts. NIST AI RMF 1.0 contains no reference to workload, throughput, time pressure, case volume, fatigue, or review capacity. The European AI regulation’s Article 14 requires understanding, monitoring, and the ability to override, and measures “proportionate to the risks, level of autonomy and context of use” — naming no quantity, no frequency, and no time per case. [limit] A negative finding from two checked frameworks, not a claim of priority. Other frameworks were not checked in full text, and the text is limited accordingly.
- Legal sourceThe one order that names time and workload: Global Privacy Assembly, 47th closed session, Seoul, September 2025, Resolution on Meaningful Human Oversight of Decisions Involving AI Systems. The Resources section, verbatim: “The organization should provide the overseer with the resources necessary to adequately oversee a decision. This should include sufficient time to undertake the oversight and a reasonable workload […].” [limit] A resolution, not law. It binds nobody, and it names no number either.
Chapter 16 · The Price of the Objection
- Legal sourceThe safeguards around external audit: Sarbanes-Oxley Act of 2002, Section 301 (the audit committee is directly responsible for appointing, compensating, and overseeing the auditor) and Section 201 (prohibited non-audit services, resting on the test that a service is barred where it would have the auditor auditing its own work or performing management functions); and the SEC auditor independence rules on partner rotation, under which the lead and concurring partners may not serve the same audit client beyond five consecutive years. [limit] These provisions govern the statutory audit of public companies and say nothing about reviewing AI output. This chapter transfers a construction; it asserts no legal duty, and the text says so.
Changes since publication
Corrections and legal developments are recorded here with a date. They are not folded into the text silently — a book about accountability cannot quietly rewrite its own record.
- Companion site published The site goes live with the book. Every source in the volume is listed with its type, every claim with what would refute it, and every legal instrument with the date it was last checked. The legal position described in the book was current at the time of writing. Where it moves, the change is recorded here with a date rather than folded into the text.