When AI gets it wrong, who can put it right?

Juan Antonio Lloret Egea, Director (BackGround) · AI and Society

A shopper walks into a pharmacy. A camera flags her and a member of staff follows her down the aisle. She has no idea whose photograph the system thinks it has matched, or who can put a mistake right. This is an imagined encounter, but the underlying question reached a real court. It is a better place to start judging a government’s AI policy than the number of pages in its strategy.

What is at stake?

Protection has a practical meaning. Can the shopper learn why she was stopped? Can somebody with authority reconsider the evidence, correct the record and prevent the same thing happening in the next branch? She should not have to become an expert in machine learning to ask those questions. Nor should she have to prove an error in a database she cannot see.

What does the evidence show?

Europe and Spain. The EU’s AI Act divides supervision between national authorities and the European AI Office. The Commission’s guide to enforcement matters to an individual because the right door depends on the activity and the provider. Some duties are already applicable; others follow the implementation timetable. A right that has yet to take effect is a poor answer to someone turned away today.

Spain presented Plan IA360 on 21 September 2026 as a twelve-month programme. A pilot may uncover a serious flaw and be worth every euro. Its completion alone does not show that anyone outside the pilot is better protected. Look for a named public service, its budget, an independent assessment and the number of wrong decisions reversed. It is equally misleading to say Europe produces no technology: France’s Mistral Small 3 and the Barcelona Supercomputing Center’s Salamandra are models readers can inspect. A European model and an enforceable European right are different achievements.

United States. The federal AI Action Plan makes industrial expansion a priority. Yet there is also a concrete answer in the pharmacy case. In 2024 a federal court entered an order in the FTC’s case against Rite Aid barring the company from using facial recognition for surveillance for five years. An order against one retailer has teeth; it does not give every shopper in every state the same remedy.

China and Russia. China’s rules for algorithmic recommendations require covered providers to offer a non-personalised option or a way to switch recommendations off (Article 17), and a complaints channel (Article 22). Whether the switch works, who can check it and what happens after a complaint are separate questions. In Russia one documented case shows why oversight matters: in Glukhin v. Russia, the European Court of Human Rights found violations of privacy and freedom of expression after the authorities used facial recognition against a peaceful solo demonstrator. The 2023 judgment concerns earlier events. It documents an abuse; it does not establish a present route of appeal for every Russian citizen or reveal the extent of military AI use.

Canada, India and Australia. Canada’s federal Directive on Automated Decision-Making covers specified administrative decisions, including systems that assist officials. Knowing whether the directive applies is a first step for a claimant; it does not govern every private employer. India’s AI Governance Guidelines set out principles and a sector-based approach. A principle about accountability still leaves a citizen needing the name of the official who can reopen a file. Australia’s Robodebt Royal Commission recommended plain-language explanations of automated decisions and a body able to audit them. Robodebt used income averaging, not generative AI. Its lesson is painfully relevant: a formula can shift the burden of disproving a debt onto the very person least able to do so.

Whose experience counts?

Public confidence varies considerably. In Pew Research Center’s spring 2025 survey, 89% of adults in India trusted their country at least somewhat to regulate AI effectively, compared with 22% in Greece. The median across the 25 countries surveyed was 55%. That figure gives each country equal weight. It is neither a world vote nor a score for the quality of a regulator. Question wording, results and methodology.

Public trust can coexist with unequal treatment. In Gender Shades, researchers tested commercial systems that classified gender from facial images and found striking differences in error rates across groups. They did not test the identification system in the pharmacy case. Their contribution is a question a regulator can take into any audit: whose errors disappear when the supplier reports only an average?

What would justify a decision?

International meetings can give smaller states and civil society a hearing. The UN Global Dialogue on AI Governance, UNESCO’s ethics recommendation and the New Delhi Declaration offer commitments against which governments can be questioned. None is a tribunal that can correct the shopper’s record. To judge the influence of large suppliers, ask who funded the meeting, who helped draft the text, whose objections were recorded and which proposals survived. A seat at the table is evidence of access. It is not, by itself, evidence that the holder dictated the outcome.

What should we watch next?

Every authority commissioning a consequential AI system could publish a short annual account: how many people were notified, how many asked for a review, how long they waited, how often the decision was changed and who paid for the remedy. Include the number of people affected, not just those who managed to complain. If nobody appealed, ask a citizen to find the form before declaring the system a success. The important result is whether a person who has been wronged can leave with an answer and a corrected record.