A Second Opinion for Automated Public Decisions

Public authorities increasingly decide by algorithm, and European law now requires that those decisions be overseen. The oversight our rules assume, a human in the loop, is weaker than it sounds, and the rules a decision must satisfy are rarely a single set. This piece argues for a different mechanism: an independent second opinion that checks each automated decision against the specific provision it turns on, and names that provision.

As public and private organizations adopt AI-based systems more widely, automated public decisions will only become more common. The real question is whether they will be checkable, and against which rule. I argue that they need a second opinion that is independent of the system that made the decision.

Across the Nordic public sector, decisions that affect people’s rights are increasingly prepared or made by automated systems: who is flagged for a benefits control, how an application is prioritized, which cases a caseworker sees first. Existing law already responds to this. The EU AI Act places human oversight at the center of its high-risk regime (Article 14), the GDPR restricts solely automated decisions (Article 22), and Finland added a chapter on automated decision-making to its Administrative Procedure Act in 2023 (hallintolaki / förvaltningslag 434/2003, chapter 8 b, sections 53 e–53 g). In September 2026, Finland’s Deputy Parliamentary Ombudsman opened an own-initiative inquiry into how municipalities use AI, after the municipality of Humppila handed the work of two directors to it; among the inquiry’s questions is how AI use affects an authority’s responsibilities (Helsingin Sanomat, “Apulaisoikeusasiamies selvittää, miten kunta voi käyttää tekoälyä”, 28 September 2026). In Sweden, some municipalities have created binding AI policies that require continuous verification, human approval of rights-affecting decisions, and traceability to a named legal basis. Piteå’s AI policy, adopted by its council in April 2026, requires that decisions affecting individuals be reviewed and approved by a human, and that AI systems be subject to continuous review and verification.

The AI Act’s obligations for high-risk systems were due to apply from 2 August 2026. In July, the Digital Omnibus on AI moved that date to 2 December 2027 for stand-alone high-risk systems such as these. The duty itself did not change, only when it starts to apply. That gives authorities until December 2027 to work out what will actually discharge it. The problem is that the oversight we assume is weaker than it sounds, and that what is being complied with is rarely one thing.

Human oversight is a duty, not yet a mechanism

Human-in-the-loop is the regulatory centerpiece, but it rests on an untested premise: that a person can effectively oversee an algorithm. Ben Green has shown how often that premise fails in practice. When it fails, the benefit and the blame land in different places. The institution keeps the time that automation saves, while the caseworker who signs off answers for errors buried in a system they could not see into. That is a responsibility gap. Nacka municipality’s own AI handbook describes exactly this tension.

There is a more precise way to put the problem, and it is a legal question rather than an empirical complaint. Article 14 fixes a duty. A high-risk system must be designed and developed so that it “can be effectively overseen by natural persons” while it is in use, and Article 26 requires the deployer to assign that oversight to people with the necessary competence, training and authority. What neither fixes is what actually discharges that duty in a given office, for a given decision, under local conditions. That gap between a duty that binds and a practice that satisfies it is where oversight is currently decided by default rather than by design.

The obvious fallback, letting the deploying institution judge its own compliance, is not much better. Internal self-assessment tends toward safety-washing, and a growing literature argues that credible accountability needs oversight from outside the body that built or bought the system. The AI Act itself leans the other way: for high-risk systems such as those deciding eligibility for public benefits, conformity assessment is the provider’s own internal control, with no notified body involved (Article 43(2)). For comparison, the EU’s Digital Services Act reaches for independent, third-party audits of the largest platforms rather than trusting their own reports.

There is no single rulebook

A further difficulty is usually skipped. We speak of compliance as though a decision faced one authoritative set of rules. It does not. A single automated decision in a Finnish or Swedish municipality sits simultaneously under the AI Act, the GDPR, national administrative law, the municipality’s own AI policy, and whatever internal guidance the caseworkers follow. As in any area of law, these orders overlap and leave room for interpretation. Binding law takes priority, but it leaves much of the detail, such as what counts as effective oversight, to the authority applying it.

That plurality is not a defect to be tidied away. Nor is the problem that the instruments collide; mostly they do not. It is the ordinary condition of public administration, and it has a consequence for oversight: a verdict of “compliant” is close to meaningless unless it says compliant with what. The useful question is narrower and answerable. Which provision does this decision turn on, and does it hold against that provision?

A second opinion, attributed to a source

This is the gap the AICRIT research-to-business project at the University of Turku works on, in collaboration with colleagues at Stockholm University and Turku: Harko Verhagen, Jari Ala-Ruona, Claes Granmar and Outi Korhonen, with whom we set out the underlying architecture at the Agents for Societal Impact workshop at AAMAS 2026.

A second opinion, as we use the term, could be an independent layer that takes a decision the primary system has produced, checks it against the specific rules it must satisfy, and attributes every finding to a named source: the exact provision, policy or criterion it turns on. It would not choose between the rules or rank them; that stays with the law and the human overseer. Where two provisions point in different directions, it would say so and leave the call to a person. It would not replace the human overseer or the primary system. Instead, it would give both something they currently lack: an external check that leaves an audit trail, and a concrete thing for the Article 14 duty to point at. Because every finding names its source, the human overseer could also check the reasoning against that source and agree or disagree with it.

It is worth being honest about what such a layer can and cannot claim. A probabilistic AI system cannot be made provably compliant, and promising otherwise would repeat the mistake the literature warns against. What it can be is compliance-aware. Where a rule can be checked mechanically, it checks it. Where no firm answer is possible, it says so, hands the case to a person if the stakes warrant it, and keeps a record of what was checked and what was left open. The aim is to restore, for each automated decision, the reasoning administrative law already requires of a human decision-maker: a justification against named provisions, which is what makes a decision genuinely contestable.

Nor is this a shortage of principles. Frameworks and impact-assessment templates are abundant. What is scarce is a built, evaluated, independently verifiable system that does the checking. Recent work on AI certification makes the same point from the practitioner side: the theory is plentiful, the working third-party mechanisms are not.

Why independence is the point

The value is in the independence from the system it reviews and from whoever built or deployed it. A system that checks itself inherits its own blind spots. A second opinion earns its name only when it is external to the decision it reviews, diverse in how it reasons, and measured rather than assumed to be reliable. The rules it checks against are the same; what is independent is the reasoning and the evidence. Those are design requirements, and testing whether an oversight layer actually meets them is part of the research.

None of this removes the human from public administration. It does the opposite. It gives the human overseer, and the citizen on the other side of the decision, a reason to trust that the rules were applied, and a record to point to when they were not. A source-attributed second opinion is one way to make automated decisions checkable against a named rule.

About the Author

Joakim Hedenstedt is Head of Development (Commercialization) in the AICRIT research-to-business project at the University of Turku, Faculty of Law, where his work focuses on independent, architecture-level oversight of automated decisions. He comes to the question as a technologist and founder rather than a lawyer.

Heading image by Gerd Altmann from Pixabay.