AI can make the decision. But your company may have to explain it.
AI can make the decision. But your company may have to explain it.
Are you using AI to screen job applicants, assess loan applications, or evaluate employee performance? What if someone challenges the result?
Can you explain what information the system considered, why it reached that outcome, and who can review it?
Under Philippine law, these questions matter.
Section 16(c)(6) of the Data Privacy Act gives individuals a right to access information about automated processes where their personal data will be, or is likely to be, the sole basis for a decision significantly affecting them.
NPC Advisory No. 2024-04 provides further guidance for AI systems processing personal data. Organizations must be able to explain relevant inputs, expected outputs, risks, and available dispute mechanisms. Where automated decisions pose significant risks to individuals' rights, meaningful human intervention is required.
The business implication is this: using AI does not relieve you of accountability.
Four questions every company using AI should ask:
1. Which decisions about people does our AI make or influence?
2. Can we explain how the system reaches its outputs?
3. Who has the authority to review or challenge those outputs?
4. Can our AI vendors provide the information we need?
These are practical governance questions, not a checklist of statutory requirements.
The National Privacy Commission is also consulting on proposed rules concerning data subject rights, including automated decision-making.
AI governance begins with a question every business leader should be able to answer: Can we stand behind the decisions our systems make?
Read more about AI governance at privalex.com.ph.
Follow PrivaLex for practical insights on privacy, AI governance, and regulatory developments affecting Philippine businesses.
Sources: RA 10173, Sec. 16(c)(6); NPC Advisory No. 2024-04; NPC Draft Circular on Data Subject Rights (proposed).
