When regulatory language is ambiguous, it can lead to significant compliance challenges. The phrases "commercially reasonable" and "technically feasible" illustrate this issue. Businesses and consumer advocates often interpret these terms differently, leading to uncertainty. When both sides object to a standard, it's usually underspecified, and these standards will end up on your compliance desk.
Understanding the Impact
Proposed AI rules suggest human review is required only when it is "commercially reasonable." Companies worry this will lead to frequent reassessments, while consumer groups fear it will allow businesses to skip reviews. Kara Williams from the Electronic Privacy Information Center argues that terms like "commercially reasonable" and "technically feasible" reduce transparency and limit human reviews.
The specifics of these rules, including jurisdiction and final text, remain unclear. However, the pattern is evident: vague language replaces clear requirements, creating compliance challenges.
Key Findings
1. One Phrase, Two Fears. Industry sees "commercially reasonable" as a duty to reassess, while advocates view it as a loophole. This means enforcement could be unpredictable. Regulators might interpret it strictly, or courts could take a lenient approach.
2. Qualifiers and Human Oversight. Human review ensures automated decisions can be contested. If oversight is based on a cost-benefit analysis, it relies on the company's accounting, which is a governance weakness.
3. "Technically Feasible" Limits Transparency. Williams warns that feasibility carve-outs reduce transparency. If the team that built the system decides feasibility, there's a conflict of interest in compliance determinations.
4. Repetition Increases Ambiguity. Repeated use of vague terms is a design choice that shifts the interpretive burden to the regulated entity.
5. Ambiguity Risks for All. Companies that over-review due to fear of strict interpretation incur costs, while those that under-review face enforcement risks. Only a documented, defensible interpretation can mitigate these risks.
Implications for Your Team
The risk isn't just unclear rules; it's having to justify decisions without a record. Treat each qualifier as a decision point needing an owner, criteria, and evidence. Compare with mature frameworks like ISO/IEC 42001, which emphasizes documented, repeatable processes, and NIST AI RMF that organizes work into Govern, Map, Measure, and Manage functions. SR 11-7 expects effective challenge, meaning an independent party tests assumptions. These frameworks help convert subjective calls into auditable ones.
Focus on who judges feasibility. Under the EU AI Act's human oversight provisions for high-risk systems, oversight is required, not cost-dependent. If operating across jurisdictions, the stricter regime often becomes your default standard.
Action Items by Priority
Priority 1: Build an Interpretation Memo for Each Qualifier. Document your interpretation of "commercially reasonable," "technically feasible," and similar terms. Include the factors considered and the approval process. This is your defense if challenged.
Priority 2: Define Human-Review Triggers by Risk. Use Risk Tiering to determine which decisions always require human review, regardless of cost. Reserve cost-based judgments for low-risk cases, and document the thresholds.
Priority 3: Separate Feasibility Determination from the Build Team. Ensure any "not technically feasible" conclusion is reviewed independently, similar to SR 11-7's effective challenge. Record what was attempted and the engineering constraints.
Priority 4: Capture Validation Evidence for Every Review Decision. Log when human review occurs, when it's skipped, and why. A pattern of skipped reviews with weak justifications can be damaging if standards are tested.
Priority 5: Monitor and Engage. Stay informed about comment periods, guidance, and enforcement signals. If you're part of a trade group, advocate for clearer standards. Both industry and consumer advocates benefit from clearer language.
