Law

The Same Two Questions, Five Legal Systems

This book asks two questions of every arrangement: who carries the checking load, and whether they can carry it. Law answers both in places, and the answers differ sharply depending on where the desk stands. This section says how sharply, in outline, because the alternative was to write as though one legal system were the world.

What follows is a sketch with a date on it — everything here was last checked on September 13, 2026, and several of these positions moved while the book was being written — two of the American ones after this book had first described them. It names no duty that applies to you, and a sketch of five systems is advice about none of them. It is useful for one thing: if the answer to either question in your organization is the law will tell us, this is how wide the range is that you are relying on.

Who has to be able to explain the decision

The United States answers by sector rather than across the board, and even there the ground moves. In lending the duty sits in the regulation: a creditor who takes adverse action owes the applicant the specific principal reasons. The Consumer Financial Protection Bureau twice said that a complex model does not soften that duty and that generic sample reasons do not discharge it; in May 2025 it withdrew both statements, along with dozens of other guidance documents. The regulation itself did not change. Banking supervision spent fifteen years under model risk guidance built on effective challenge; its replacement of April 2026 leaves generative and agentic AI out of scope. Outside such fields there is no general federal statute on the use of AI.

The states filled that gap, and are now being pushed back out of it. Colorado passed the first broad state AI act in 2024 with duties of care and impact assessments attached. Its start was postponed, enforcement was suspended in April 2026 by agreement between the state and xAI, which had sued, with the Justice Department intervening, and a replacement signed in May 2026 removed the duty of care and the impact assessments and set a new start date of January 1, 2027. A federal executive order of December 2025 directs the Justice Department to challenge state AI laws and makes states with “onerous” AI laws ineligible for part of the federal broadband money. What to take from this is the volatility; the outcome is unsettled.

The European Union takes a broader and more upstream approach. Its data protection law treats the production of a score as the decision itself where a decision is substantially based on it, which places the duty before the desk rather than at it. The AI Act adds a requirement of human oversight for high-risk uses. That requirement is not yet the one anyone is measured against: an amending regulation adopted in July 2026 deferred the obligations for stand-alone high-risk systems to December 2, 2027, and for AI embedded in regulated products to August 2028.

The United Kingdom began from the European text and moved the other way. Reforms in force since February 2026 permit solely automated decisions on legal bases beyond consent, with safeguards after the fact: the person must be told, may make representations, and may demand human intervention. The hinge of the new rule is whether there was meaningful human involvement — which is this book’s subject written as a legal test, and which nobody has yet had to defend at volume.

Germany answers a different question altogether. Its explanation duties come from the same European source, but the distinctive instrument is procedural. A system capable of monitoring behavior or performance cannot be introduced without the agreement of the works council; guidelines for selecting people need its consent, including where AI is used to draw them up; and it has to be informed while the system is still being planned. Instead of a right to an explanation, it is a veto before the system arrives, and among the five sketched here the clearest case of reaching the decision at the point where it is actually made.

Japan answers by encouragement. Its first AI statute, passed in 2025, promotes research and use and carries no penalties; binding force is left to the general laws on personal data, competition, and product safety. Its data protection law has no counterpart to the European right against automated decisions. An organization operating there and in Frankfurt runs the same system under two regimes that do not resemble each other.

Whether whoever checks can carry it

Germany puts a floor under the second question. Assessing workload includes assessing psychological load, the duty applies to every employer regardless of size, and since 2024 the interaction between people and AI systems is on the inspectors’ checklist.

Japan goes at it from the individual end. Employers with fifty or more workers have owed an annual stress check since 2015; an amendment promulgated in May 2025 extends the obligation to workplaces of every size from April 1, 2028.

The United States has no such standard. The occupational safety agency has issued none for psychosocial hazards, and whether the general duty to keep a workplace free of recognized hazards reaches psychological ones is contested and unsettled. The national health institute called these hazards a major threat in 2024 and issued an urgent call; the Surgeon General published a framework in 2022. Both are guidance.

The United Kingdom sits between. Its management standards for work-related stress are guidance, but the underlying duty to assess risk is not, and the regulator holds that stress falls within it.

The European Union requires that oversight of a high-risk system be proportionate to its risk and autonomy, and that deployers assign it to people with the necessary competence, training, and authority, and give them the necessary support. Its directive on platform work goes one step further and requires sufficient human resources for oversight. None of it names a quantity, a frequency, or a time per case.

What survives the comparison

The range is the finding. Two organizations doing identical work with an identical system can sit under a duty to consult before installing it, a duty to explain afterward, a duty to measure what it does to the people at the desk, or under none of these. Any arrangement that holds only because a rule requires it holds only in one of those places.

That is why the proposals here wait on no statute. The assignment of the checking load, the zones, the duty to challenge, the counted minute — each of them is defensible on its own, and each of them survives a change of jurisdiction, which the rules above demonstrably do not.

Across the provisions compared here, one omission stands out. Not one of them names a number: how many cases may arrive at a position, how long a review may take, how much may be assigned to one desk. Every system above settles who decides. A few require that whoever checks be equipped to do it. None of them says what that takes in hours.

Sources

• Editorial noteEvery position in that section was checked on September 13, 2026, and the section says so. Changes after that date are recorded, with dates, at organization-under-ai.com/cheap-to-make-costly-to-check/law.
• Legal sourceUnited States. Equal Credit Opportunity Act and Regulation B (12 CFR 1002.9); CFPB Circulars 2022-03 and 2023-03, withdrawn May 12, 2025, as above under Chapter 4. Federal Reserve SR 11-7, replaced by SR 26-2 on April 17, 2026, as under Chapter 9. Colorado: SB 24-205 (2024); SB 25B-004, signed August 28, 2025, postponing the start to June 30, 2026; x.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), order of April 27, 2026 granting the joint motion to stay enforcement, the Justice Department having intervened; SB 26-189, signed May 14, 2026, removing the duty of care, the risk management program, and the deployer impact assessments and setting a start date of January 1, 2027. Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence,” December 11, 2025, establishing a Justice Department AI litigation task force and making states with onerous AI laws ineligible for non-deployment funds under the BEAD broadband program.
• Legal sourceEuropean Union. Article 22 GDPR and Case C-634/21 (SCHUFA), as under Chapter 4. Articles 14 and 26(2) of the AI Act; Directive (EU) 2024/2831 on platform work, Article 10(2). The deferral: the amending regulation of July 2026, published July 24 and in force July 27, 2026, moving the obligations for stand-alone high-risk systems to December 2, 2027 and for AI in regulated products to August 2, 2028. Audit firm rotation: Regulation (EU) No 537/2014, Article 17 — ten years, extendable to twenty after a public bidding process, with key audit partners limited to seven.
• Legal sourceUnited Kingdom. Data (Use and Access) Act 2025, section 80, replacing Article 22 of the UK GDPR with Articles 22A to 22D; in force February 5, 2026. Solely automated significant decisions become permissible on legal bases beyond consent, subject to notification, representations, and a right to human intervention; the operative test is meaningful human involvement. Work-related stress: the Health and Safety Executive’s management standards are guidance; the duty to assess risk under which the regulator places stress is not.
• Legal sourceGermany. § 87 (1) no. 6 BetrVG for co-determination on systems capable of monitoring behavior or performance; § 90 (1) no. 3 and § 95 (2a) BetrVG for information during planning and consent to selection guidelines, with AI named expressly since the amendment of June 18, 2021. § 5 ArbSchG for the assessment of working conditions including psychological load, without a size threshold.
• Legal sourceJapan. Act on the Promotion of Research, Development and Utilization of AI-Related Technologies, passed May 28, 2025 — promotion-oriented, without penalties, leaving binding force to the general laws. The Act on the Protection of Personal Information contains no counterpart to Article 22 GDPR. Industrial Safety and Health Act: annual stress check for workplaces of fifty or more, in force since December 2015; amendment promulgated May 14, 2025 extending it to workplaces of any size, with a commencement set by Cabinet Order for April 1, 2028.
• Editorial note[limit] This is the one part of the book built on a survey rather than on sources read in full. The American, European, and German instruments named here were checked against their own texts; the British, Japanese, and state-level American positions were checked against the enacting instrument and professional commentary, not against every implementing measure. The section is written coarsely for that reason, and it draws no conclusion that depends on a fine reading of any single one of them. Anyone acting on a specific duty should ask a lawyer admitted where the duty applies.

Changes since publication

Corrections and legal developments are recorded here with a date. They are not folded into the text silently — a book about accountability cannot quietly rewrite its own record.

• 2026-09-14Second review: the case made consistent, claims made precise A final pass held the English text against the corrections made to the German edition the day before. What changed, in substance: The case made consistent. Thirty-two more bids arrived than four years earlier, not thirty-one. Frank Ostrowski’s company was a bidder in the process. Five names, not five signatures, lie between the Tuesday in March and the release. The buyer had eighteen minutes per bid in Chapter 16 as everywhere else. The closing chapter now says that each of the two repairs explains half the case rather than preventing it; the pre-selection, not the award, lacked an owner; and Ines Kessler had access to all forty-one bids but not the time to read them. Claims made precise. Challenger counts announced job cuts. The claim that organizations have treated effort as a proxy for care “for centuries” is gone. The study in Chapter 11 measured heart rate variability. An update that adds a scoring or recommending function is a good reason to repeat the review, not proof that the earlier review is void. A reviewer who contradicts the system owes no more justification than one who agrees. One of the five requirements was met, and only half. The toolkit. The survey promise is an assurance of protection, not an amnesty, and it carries a note that it is an example to adapt to local law. Working without an additional mandate is possible only as far as existing access and analysis rights allow. A difference found in a pattern review is a reason to look closer, not proof of cause or discrimination. Chapter 11 now contains the handhold its table row referred to; the list of things to do has twenty-seven entries. Terms. The two halves of the argument are now called the ownership framework and the capacity framework; “order” and “construction” were German loan structures that read as sequence, purchase order, or building work. Chapter 15 is titled Where Ownership Meets Capacity, the assignment of processes to paces is a pace map, and the handholds in the tables are diagnostics. Several statements were narrowed: an event-triggered review means you no longer depend on an annual one, the effort is a few minutes per update, a forty-person company often has no independent position, the minimal start needs no project of its own, and the legal comparison speaks only of the provisions it compares. Copyright page. The author expressly reserves all rights in the work with respect to text and data mining under Article 4(3) of Directive (EU) 2019/790, and training AI systems on it requires permission except where applicable law provides otherwise; the e-book carries the reservation in machine-readable form.
• 2026-09-13Full review of the book: corrections, legal updates, cuts The whole text was checked again against its sources. What changed, in substance: Legal positions that had moved. The two CFPB circulars on adverse-action notices were withdrawn on May 12, 2025. The Federal Reserve’s SR 11-7 was replaced by SR 26-2 on April 17, 2026; the new guidance excludes generative and agentic AI. Enforcement of Colorado’s AI Act was stayed in April 2026 on a joint motion in x.AI v. Weiser, and SB 26-189, signed May 14, 2026, removed its core duties and moved the start to January 1, 2027. The legal comparison in the back of the book was rechecked line by line. Facts corrected. Goldratt’s method has five focusing steps, not three. In the Dutch childcare benefits case more than 43,000 parents have been recognized as affected, and the model used non-Dutch nationality as a feature. Amazon identified the bias in its recruiting tool by 2015; it became public in 2018. The METR trial is one field study among several, not the only one. The phrase “ratchet effect” comes from economics (Weitzman, 1980), not from the researcher previously credited. The University of Chicago rule applies to required first-year courses in a pilot year. The case made consistent. The night-time on-call service was known to the head of maintenance, not to purchasing, and he was shown only the top ten. The buyer had eighteen minutes per bid, not four. The award went to the second-ranked bid, 12 percent cheaper than the first. The five triggers were renamed where needed (“reversibility” instead of “stakes”) and now give the same result in every chapter that applies them. Counter-evidence added. Chapter 16 now takes up the strongest objection to the book: statistical rules often predict better than experts because they do not vary (Meehl; Kahneman, Sibony and Sunstein). Cut. Several passages that did not carry the argument: the interruption-figure detour, the scored ethics profile and the comment discussion around it, the Žižek reference, the Kipker quote, the Shopify, Duolingo and Box examples, and most of the Pentagon dispute. The case notes that stood in the book now appear on the Claims page.
• 2026-09-08Companion site published The site goes live with the book. Every source in the volume is listed with its type, every claim with what would refute it, and every legal instrument with the date it was last checked. The legal position described in the book was current at the time of writing. Where it moves, the change is recorded here with a date rather than folded into the text.