MediumNo Recourse●Realized

Lack of contestability / recourse

Description

Affected individuals have no clear way to contest or appeal an AI-influenced outcome.

Example scenario

A customer disputes an AI-flagged transaction but there is no defined appeal path.

Real-world evidence●Realized

Multiple documented production incidents confirm AI credit and insurance decisions that regulators and courts found inadequately explainable, including gender-discriminatory credit limits and discriminatory insurance pricing. Regulatory investigations and court rulings have confirmed real consumer harm in live deployments.

Apple Card / Goldman Sachs Gender Discrimination InvestigationBloomberg / New York DFS · 2019 Amazon Scraps Secret AI Recruiting Tool That Showed Bias Against WomenReuters · 2018 Dutch SyRI Welfare Fraud Algorithm Ruled Illegal for Lack of TransparencyDistrict Court of The Hague · 2020

Primary mitigations

Appeal/override workflows
human review on contest
documented recourse
decision traceability.

Detection signals

Appeal-rate & resolution monitoring; recourse-availability audits.

Mitigating controls

Non-agentic controls

ZYC-XAI-001Non-Agentic

Field Justification

Explainability (XAI)

ZYC-TRANS-001Non-Agentic

Documentation

Transparency

ZYC-ACCT-001Non-Agentic

Human-in-the-Loop

Accountability & Oversight

ZYC-AUDIT-003Non-Agentic

Log Immutability

Auditability

ZYC-AUDIT-004Non-Agentic

Audit Access

Auditability

ZYC-XAI-004Non-Agentic

Counterfactuals

Explainability (XAI)

Risk scoring

Severity

High

score 3

Likelihood

Medium

score 2

Risk

Medium

Control depth

6 mapped (above avg 5.2)

Framework refs

3/8 taxonomies

Framework mappings

Regulatory4/5

EU AI Act: Annex III (high-risk systems: credit scoring pt.5b, employment pt.4, insurance pt.5a); Art. 13 (Transparency and provision of information to deployers); Art. 14 (Human oversight); Art. 86 (Right to explanation for decisions made by high-risk AI systems)
DORA: — Not covered by DORA. Explainability and interpretability of AI decisions are not ICT operational resilience matters under DORA 2022/2554.
RBI: Conduct and Customer Protection
NIST AI RMF: GOVERN 5.1
ISO/IEC 42001: Clause 9.1

Risk taxonomies3/4

MIT AI Risk Repository: Domain 6 – Socioeconomic
IBM AI Risk Atlas: Accountability
NIST ARIA: Human-AI Configuration
MAESTRO: — Not mapped

Security0/4

OWASP: — Not covered by OWASP LLM 2025
MITRE ATLAS: — Not covered by MITRE ATLAS
Cisco AI Risk: — Not covered by Cisco AI Defense
Palo Alto AI Risk: — Not covered by Palo Alto Prisma AIRS

Capability‑pattern applicability

Classification

GenAI‑specific

Capability pattern

Chat

Pattern scope

Pattern-agnostic (GenAI)

Why

Generative-AI risk realised without agency/tool-use — applies to chat, RAG, summarization, classification, and content-generation deployments.

Ownership & threshold

Owner (RACI)

Model Governance [A]

Threshold

Explanation / disclosure coverage 100%

Inherent vs residual

Inherent

Medium

Residual

3.6

Low

Mapped controls: 5
Assumed control effectiveness: 40%

Modeled, not measured — design-stage; controls not yet tested (reduction capped 40%). Residual applies a uniform assumed reduction to the inherent score; it is not evidence of tested control performance.

Related risks in Transparency & Explainability

ZNR-TE-001High

Black-box unexplainable output

ZNR-TE-003Medium

Missing content provenance / watermarking

ZNR-TE-004Medium

Undisclosed AI interaction

ZNR-TE-005Medium

Inadequate model documentation / model cards

Search the Atlas

Lack of contestability / recourse

Description

Primary mitigations

Detection signals

Mitigating controls

Related risks in Transparency & Explainability