How a determination is made.

Whether a human actually reviews it — and how consistently

There are three possible answers: a person reviews or can override every time; review happens sometimes but not consistently; or the system acts without human review. The middle answer matters most, and a yes/no question cannot record it.

Whether the decision is made on a solely automated basis

This is a separate fact from whether a human is present. Different provisions turn on each, and treating them as one is one of the more costly mistakes.

Which consequential decisions it touches

Employment, credit, housing, healthcare, insurance and education are each asked about directly, not inferred from a description. Obligations concentrate on these decisions, and a narrative summary can omit them.

Whether the affected people are vulnerable, and in which way

Children, patients, employees, elderly people, people with disabilities and people in financial vulnerability. Each category is recorded, not reduced to a single flag, because different statutes attach to different groups.

Profiling, monitoring, scale, and combined sources

Whether the system profiles people, whether it systematically monitors a publicly accessible area, whether processing is large-scale, and whether it combines several data sources. Each appears as a trigger in real provisions.

Entity thresholds, per statute

Revenue and consumer-volume thresholds, per-state controller thresholds and small-business status. These answers often decide the outcome, because many statutes do not apply below a threshold.

The agreements

A signed data processing agreement with the vendor; a Business Associate Agreement where health data is involved; and the safeguard you rely on to send EU or UK personal data outside that region.

The notices and the grounds

A privacy notice that tells people about this AI use, and documented legal grounds for using sensitive personal data. They are asked separately, because having one is not the same as having the other.

Documented retention

Documented rules for how long this data is kept, and the retention position on inputs and prompts in particular. That position often differs from the organization’s general policy and is often undocumented.

Named oversight

A named owner for human oversight of this system, a documented escalation path for incidents or serious risks, and AI literacy training for the employees who use or oversee it. Deployer obligations attach to these arrangements more often than to the technology itself.

Existing documentation

Whether an impact assessment has been completed or is in progress, and whether an AI risk classification has been documented. If you have already done the work, the determination should not tell you to do it again.

What the vendor does with your data

Whether the vendor trains on your data, and whether a training opt-out has actually been activated, not merely offered.

Decide which laws apply

Applicability is decided by rule. A model asked which statutes are relevant to an AI use case gives a fluent, confident answer that cannot be tested. That makes it unsuitable for this question.

Write an obligation

The text of each obligation comes from curated templates tied to the provision it comes from. Analysis written by a model is dropped when the record is saved, not labeled and shown.

Create a citation

A citation comes from the Meridian or does not appear. A model that can generate a plausible article number will eventually generate one that does not exist, and it will look like the real ones.

Fill a gap

Where the Meridian cannot support a claim, the determination says so. An omission can be recovered later; a confident error cannot.