A business uses a decision model to help sort a queue of applications. Someone outside the business compares two otherwise identical applications, changes a protected characteristic, and gets different recommendations. The business now has to explain the result and investigate what produced it.

The model didn't choose the application, the question, or the threshold. Those choices belong to the people operating the system for the business. When your business uses a decision model, you remain responsible for the decisions it informs and for mitigating the risks they create. An investigation needs the whole decision system: the model request, the returned score, the rule that converted it into an outcome, and the version active at the time.

Responsibility follows the deployed system

At a Reuters event in September 2026, FTC Chair Andrew Ferguson rejected treating AI agents as independent actors with their own intentions. Reuters reported that he pointed to the people instructing an agent and to audit trails showing systems carrying out those instructions. His remarks were a statement of position, rather than a new rule establishing liability for every developer.

Existing cases and agency positions give that distinction practical weight. The CFPB's 2022 circular said creditors must provide specific, accurate reasons for adverse credit decisions even when they use complex algorithms. The EEOC's 2024 Workday brief argued that screening and referral software could make its vendor an employment agency. That was an argument in litigation, not a final ruling that every hiring-software vendor has that status.

These examples concern different statutes and different actors. They establish a useful question for an engineering team: what role does our software actually perform, and which decisions have we given it authority to make? Whether an individual engineer, a vendor, or a customer faces liability depends on that role and the applicable law. A model's involvement doesn't settle it.

An outside finding can change the product

In the Justice Department's Meta case, a June 2022 settlement required changes to housing-ad delivery. Meta stopped using its Special Ad Audience tool for housing ads and developed a Variance Reduction System to address delivery disparities. HUD had investigated and issued a discrimination charge before referring the matter to DOJ. The outcome included changes to the software itself.

An advocacy complaint can also create pressure before enforcement. EPIC complained to the FTC about HireVue in 2019. HireVue subsequently said it removed visual analysis from new assessment models in early 2020, attributing the decision to predictive-value research. The record doesn't establish that the FTC ordered that removal. It shows why a team needs evidence for the features it asks customers to rely on.

Marketing claims create another route to scrutiny. In April 2025, the FTC announced a proposed Workado order over an AI detector advertised as 98% accurate. The agency alleged the claim lacked support; the proposed settlement required evidence for effectiveness claims. A result on a narrow dataset needs to stay a claim about that dataset.

Keep the choices and evidence together

Someone selected the model version, wrote the rubric, and chose which data the model could read. Someone set the confidence threshold, shortlist size, escalation path, and permission to act. Someone also decided how to respond when reviewers found mistakes.

Our Biased-Decisions benchmark compares otherwise identical inputs with a personal cue changed. It measures verdict changes, probability shifts, and selection rates. Those measurements can reveal a failure mode; they don't by themselves establish that a deployed system violated a law. The production test needs the actual rubric, population, and decision threshold.

Cyclotron records requests, responses, reviewer feedback, versions, and evaluation results around a decision model. That record helps a team inspect a decision and compare a proposed change with the version it would replace. Calibration and reviewer feedback have their own purposes, and neither establishes that a system is free of discrimination.

Before expanding automation, decide who investigates unexpected results, what evidence they need, and how the system can be restricted while they investigate. Preserve the input and version that produced each consequential decision. Run the paired tests against the complete workflow, and measure the effects of a proposed change before giving it the same authority. See how Cyclotron records and evaluates changes.