Technology that makes or substantially influences decisions about people without meaningful human intervention. In privacy governance, ADMT matters because it can combine data collection, profiling, and decision output in ways that trigger notice, opt-out, and explanation obligations.
Expanded Definition
Automated Decisionmaking Technology, or ADMT, is broader than simple automation. It covers systems that evaluate data and produce outcomes about a person, or materially shape those outcomes, with little or no meaningful human intervention. In privacy and governance work, the key question is not whether a human approved the final step, but whether the system’s logic, scoring, ranking, or recommendation effectively drove the result. Definitions vary across vendors and regulators, so organisations should treat ADMT as a governance concept rather than a single product category.
ADMT can include rule-based engines, statistical models, machine learning systems, and agentic workflows that influence access, eligibility, pricing, prioritisation, or content moderation. NIST control families such as the NIST SP 800-53 Rev 5 Security and Privacy Controls help frame the surrounding obligations, but they do not by themselves define ADMT. The distinction that matters is whether the technology meaningfully shapes the decision path about an individual. The most common misapplication is treating a human rubber stamp as meaningful review when the system has already predetermined the outcome.
Examples and Use Cases
Implementing ADMT rigorously often introduces review overhead and documentation burden, requiring organisations to weigh speed and scale against transparency, contestability, and accountability.
- Loan pre-screening systems that rank applicants and push borderline cases into manual review, where the model still drives the initial eligibility outcome.
- Hiring tools that score resumes or video interviews, creating a decision path where the human reviewer mostly confirms a machine-generated shortlist.
- Fraud and trust systems that auto-approve, throttle, or block accounts based on patterns, especially when the decision affects a person’s access or rights.
- Personalisation engines that shape what a user sees next, when the ranking logic materially influences a person’s opportunities, exposure, or treatment.
- Identity and access workflows where automated risk signals trigger step-up checks or denial, intersecting with identity governance and NHI controls when machine-driven approvals affect privileged actions.
For privacy and security teams, the practical issue is not whether automation exists, but whether the decision is consequential and explainable enough to support notice, opt-out, appeal, or human review obligations. This is where AI governance guidance from NIST AI Risk Management Framework can complement privacy controls, particularly when organisations use models to rank or filter people at scale.
Why It Matters for Security Teams
ADMT changes the risk model because decisions can become opaque, difficult to contest, and hard to audit after the fact. If a system is tuned for speed or efficiency without guardrails, it can amplify bias, misclassify users, or create inconsistent outcomes that are difficult to explain to regulators and affected individuals. Security teams need to understand ADMT because it often sits at the intersection of privacy, application security, model governance, and identity workflows.
This intersection becomes especially important where ADMT uses sensitive attributes, inferred attributes, or identity-linked data to make access or eligibility decisions. In those environments, control expectations often map to monitoring, logging, review, and separation of duties. CISA AI security guidance is useful here as a practical reminder that AI-enabled systems require lifecycle oversight, not just deployment approval. Organisations typically encounter the real impact only after a denied application, blocked account, or disputed outcome triggers a complaint or incident review, at which point ADMT becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | NIST AI RMF addresses governance and accountability for AI systems that shape decisions. | |
| NIST CSF 2.0 | GV.RM | NIST CSF 2.0 risk management governance supports oversight for technology-driven decisions. |
| NIST SP 800-53 Rev 5 | AU-2 | NIST 800-53 logging controls are relevant where ADMT decisions must be traceable. |
| NIST SP 800-63 | IAL2 | Identity assurance becomes relevant when ADMT makes access or eligibility decisions. |
| OWASP Agentic AI Top 10 | Agentic AI guidance is relevant when autonomous workflows influence decisions about people. |
Apply governance, mapping, and measurement practices to document how automated decisions affect people.
Related resources from NHI Mgmt Group
- How does automated secret rotation change the operational model?
- What is the difference between manual access administration and automated lifecycle governance?
- When should security teams avoid automated approval for access requests?
- When does automated remediation make more sense than manual review in SaaS security?
