Page 186 - CyberSecurityEssentialsEnglish

• Mistake to avoid: Saving a whole conversation with no structure, or treating it as a
substitute for documenting the decision.

4.11 High-Impact Decisions: When Do You Need an Expert or a Full Stop?
◆ Key idea: AI supports responsibility; it does not replace it.

In health, law, finance, employment, education, research, and public services, an output
may affect rights, health, or opportunities. A tool can help with organization, preliminary
research, and drafting, but the decision requires expertise, a source, an explanation, and
a route of appeal, in line with policy and law.

A high-impact domain is not entirely prohibited, but the manner of use differs. Summarizing
general information for a physician, a lawyer, or a professor is not the same as issuing a
diagnosis, a binding opinion, a grade, or an admission decision. The closer the output comes

to the final decision, the greater the need for a licensed expert or a responsible officer.

Administrative support must be separated from professional support. A tool can organize
appointments, turn notes into a draft, or extract clauses, while it should not replace a clinical
examination, a legal interpretation, or an independent academic assessment. International

health guidance stresses the protection of human autonomy, safety, transparency, and
accountability in the use of AI for health [14][15]. In education and research, guidance points
to the same logic: human responsibility, transparency, and the protection of learners and

their data when generative tools are used [7].

A meaningful explanation matters for the person affected by a decision. It is not enough for
the system to say “the risk score is high.” The responsible officer must be able to explain the

data, the factors, and the procedure, and must distinguish an explanation that genuinely
helps the user from a description that does not reflect how the result was actually produced.
Established principles of explainable AI require an explanation that is present, meaningful,

accurate, and accompanied by a statement of the system’s knowledge limits [16].

The right to object and to seek review matters in consequential decisions. There must be a
channel through which an affected person can correct wrong data or request human review.
This is not a full institutional policy question here, but it is a rule of use: do not make an

automated output the end of a discussion that cannot be reopened.

Apply the rule of stop and escalate when the data is insufficient, when sources conflict, when
the question exceeds your competence, when you cannot explain the decision, when there
is direct danger, or when the matter requires legal, medical, or security approval.

Recognizing a limit is a professional decision, not a failure.

185