Skip to content
Stafflo.ai
Buy an audit
Stafflo.ai

AI process viability checker

Score your manual workflows to find out which processes are actually ready for automation.

Are the rules documented?
What is the data format?
Error tolerance
What does the process decide?

Decisions about people carry their own rules in most countries.

Sets the rules on automated decisions that apply.

Viability outcome

Highly Viable

Show the working

Rules 3 + Data 3 + Errors 2 = 8 of 9; 7 to 9 = Highly Viable

Your three answers, 3 points at most each; 7 to 9 is Highly Viable, 4 to 6 Requires Preparation and 0 to 3 Not Ready.

Prime target for automation.

Score: 8 / 9

Rules
3 / 3
Yes, step-by-step
Data
3 / 3
Structured (Forms, Databases)
Errors
2 / 3
Requires manual review before final action

This indicates how easily an AI system can replicate your process without breaking current operations.

What to fix first

  1. Errors, 2 / 3. Design the review step. Decide who approves each output, what they see, and how they change it.

Worth building? Work out what it saves with the AI automation payback calculator.

Highly Viable. Score 8 of 9.

A guide from published rules and terms, checked on 10 October 2026. Not legal advice.

On this page

What the result means

This indicates how easily an AI system can replicate your process without breaking current operations.

  • The score adds the three answers: up to 3 each for documented rules, the data format and how forgiving errors are.
  • 7 to 9 is Highly Viable, 4 to 6 Requires Preparation, with a person approving each output, and 0 to 3 Not Ready.
  • What to fix first lists each dimension below full marks, lowest first, with the work that raises it.
  • Where the process decides something about a person, the tool shows what the law in your country asks a person to do: make the final decision, offer a review, explain it, or tell people.

How it works

The tool scores your process against the three main constraints of AI automation: rule clarity, data format, and error tolerance. Processes that score high are mathematically and structurally ready for machines. Processes that score low require human intuition that models cannot reliably replace yet.

A process that decides something about a person, such as a hire, a loan, an insurance claim or care, also has to meet the law on automated decisions, which in many countries says what a person must still do.

  1. Total score = rules + data format + error tolerance, from 0 to 9.
  2. 7 to 9: Highly Viable. Prime target for automation.
  3. 4 to 6: Requires Preparation. Needs a human-in-the-loop step.
  4. 0 to 3: Not Ready. Fix the underlying process first.
  5. What to fix first lists every dimension below full marks, lowest first.
  6. What the law asks names the rule in force that asks most of a person, law before guidance, and any stricter rule that starts later.

Assumptions

  • The three dimensions count equally, as in the brief, so clean data and cheap errors can lift a process whose rules aren't written down.
  • The rules on automated decisions are about decisions concerning people. A process that only moves data between systems can still fall under privacy law.
  • Rules marked as guidance come from a regulator's guidance or recommendations: not law, but what the regulator expects.
  • In the US, the rules are federal where they exist, plus the states and the city named: Colorado, California and New York City.

Example

Example: structured forms with a review stage

Rules documented step by step, structured database forms, and a human review stage before final action:

A process with clear step-by-step documentation (3), operating on structured database forms (3), where errors can be caught in a human review stage (2), scores an 8 out of 9. It is highly viable for immediate automation.

Example: screening CVs in Germany

Screening criteria written down, CVs arriving as PDFs, and a recruiter reviewing each shortlist:

The score is 7 of 9, Highly Viable, but automated decisions need a route to a person under GDPR Article 22, and from 2 December 2027 the EU AI Act treats filtering job applicants as high-risk, with a trained person overseeing it. Where there's a works council, it agrees the selection guidelines first.

When this is wrong

This is a technical viability score, not a financial one. A highly viable process might still be a poor target if automating it only saves a few hundred dollars a year. Always calculate the ROI before building.

  • Decisions about people. A process can score 9 and still need a person to make the final call where the law says so; the country rules show where.
  • Exceptions. Score the process as it's really done, including the cases that don't follow the written rules.
  • Data quality. Structured data full of errors scores 3 and still breaks an automated process.
  • Volume. A process done a few times a month rarely repays the build, however viable it is.
  • The people who do the work. Their knowledge is often the real documentation; involve them before scoring the rules as written.

To work out the return, use the AI automation payback calculator.

What we couldn't confirm

  • Not final yet. The ICO's final guidance on automated decisions; the rules here follow its draft.
  • Not final yet. The GDPR changes in the EU's Digital Omnibus, which would amend Article 22.
  • Not final yet. Colorado's implementing rules for its automated-decision law, still in draft.
  • Official source unavailable. India's DPDP Rules as published: the ministry's page doesn't load, so the dates come from the government's press release.
  • Official source unavailable. Malaysia's national AI governance guidelines: the science ministry's site refuses visitors from outside Malaysia.

Rules by country

For each country in the tool: the rules on automated decisions about people, and the sector rules for hiring, credit, insurance and health, with what each asks a person to do and when it starts.

United States
  • Reasons for a credit refusal. A lender refusing credit gives the specific principal reasons within 30 days of a completed application; "failed our score" isn't enough, whatever the model. Credit or lending. (Regulation B, 1002.9)
  • Medicare Advantage coverage. Coverage decisions rest on the patient's own history, physician recommendations and clinical notes, and an algorithm alone can't be the basis to deny care. Health or care. (42 CFR 422.101(c); CMS MA coverage FAQ)
  • Health plans in California. A health plan's or insurer's AI can't deny, delay or modify care on grounds of medical necessity; only a licensed physician or health care professional makes that call. Health or care. (California SB 1120)
  • Hiring tools in New York City. An automated hiring tool used on New York City candidates needs a bias audit within the past year, a public summary of it, and notice 10 business days before use. Hiring or managing staff. (NYC DCWP)
  • Consequential decisions in Colorado. From 1 January 2027, automated decisions on jobs, lending, insurance, health care, housing and education need notice, and meaningful human review and reconsideration on request after an adverse outcome. Any decision about a person. (Colorado SB 26-189; Colorado AG, ADMT rules)
  • Significant decisions in California. From 1 January 2027, a business covered by the CCPA gives notice before using automated decision technology for a significant decision, and offers an opt-out or an appeal to a person who can overturn it. Hiring or managing staff; Credit or lending; Health or care; Another decision about a person. (California ADMT regulations)
  • Clinical software. Software that a clinician relies on for a decision, or that is time-critical, is a regulated device unless the clinician can independently review the basis for each recommendation. Health or care. Guidance. (FDA CDS guidance)
Canada
  • Automated decisions in Quebec. A business that decides about a person solely by automated processing tells them no later than the decision, and lets them submit observations to someone who can review it. Any decision about a person. (CAI, Law 25 changes)
  • AI in Ontario job postings. An Ontario employer with 25 or more employees that uses AI to screen, assess or select applicants says so in each public job posting. Hiring or managing staff. (Ontario ESA, s. 8.4; O. Reg. 476/24)
  • No federal AI law. Outside Quebec there's no general rule on automated decisions: the Artificial Intelligence and Data Act, in Bill C-27, was still in committee when Parliament's session ended on 6 January 2025. Any decision about a person. (ISED, AIDA; LEGISinfo, C-27)
  • Banks and insurers. From 1 May 2027, federally regulated banks and insurers manage AI models under OSFI's model risk guideline, with controls that rise with a model's autonomy and customer impact. Credit or lending; Insurance. Guidance. (OSFI E-23)
United Kingdom
  • Significant automated decisions. Since 5 February 2026, a significant decision made solely by automation is allowed with four safeguards: information about it, a chance to make representations, human intervention and a way to contest it. Any decision about a person. (GOV.UK, DUAA commencement; ICO, ADM safeguards; DUAA 2025, s. 80; SI 2026/82)
  • What counts as human involvement. A person reviews each decision before it applies, can change it and understands the system; spot checks don't count. The guidance is still a draft. Any decision about a person. Guidance. (ICO draft ADM guidance; ICO ADM consultation)
  • Health data. A significant automated decision using health or other special category data needs explicit consent, or a contract or legal requirement plus a substantial public interest condition. Insurance; Health or care. (ICO, ADM and special category data)
Germany
  • Automated decisions. A significant decision based solely on automated processing is allowed only when needed for a contract, authorised by law or explicitly consented to, and then with the rights to human intervention, to give a view and to contest it. A person can ask for the procedure and principles actually applied to them, trade secrets or not, and an impact assessment comes first. Any decision about a person. (GDPR; Digital Omnibus procedure; CJEU, Dun & Bradstreet)
  • Credit scores. A score a lender relies on strongly counts as an automated decision in itself, even when a person signs off the loan. Credit or lending. (CJEU, SCHUFA)
  • Insurance claims. Insurers may decide claims automatically when they pay in full, or when applying binding medical fee rules with a route to a person for refusals. Insurance. (§ 37 BDSG)
  • Works councils. Where there's a works council, its consent is needed for selection guidelines for hiring, transfers and dismissals, including those drawn up with AI, and for systems that can monitor staff. Hiring or managing staff. (§ 95 BetrVG)
  • High-risk AI. From 2 December 2027, AI that filters job applicants, scores credit or prices life and health insurance is high-risk: a trained person with authority oversees it and can override it, logs are kept, the people affected are told, and credit and insurance pricing need a fundamental rights impact assessment first. Hiring or managing staff; Credit or lending; Insurance. (AI Act, Annex III; AI Act, Article 26; AI Act, Article 14; AI Act, Article 27; AI Omnibus, Regulation 2026/1744; European Commission, AI Act)
India
  • Accurate data for decisions. There's no right to object to automated decisions, but from 13 May 2027 data used for a decision about a person must be complete, accurate and consistent. Any decision about a person. (DPDP commencement; DPDP Act, s. 8(3))
  • Digital lending. A digital lender records the borrower's age, occupation and income behind each credit assessment for audit, and a complaint unanswered within 30 days can go to the RBI Ombudsman. Credit or lending. (RBI Digital Lending Directions; RBI Credit Facilities Directions 2025)
  • AI in banking. RBI's AI committee recommends human oversight for medium- and high-risk uses, the option to switch to a person, and human checks on a sample of AI decisions; these are recommendations, not directions. Credit or lending. Guidance. (RBI FREE-AI report)
  • AI in health care. Human oversight and a manual override are compulsory for AI that could cause severe or bodily harm, and patients may choose or refuse AI. Health or care. Guidance. (ICMR AI guidelines)
Singapore
  • Personal data in AI decisions. No law gives a right over automated decisions; the PDPC's advisory guidelines encourage telling people what data the system uses and, for higher-impact outcomes, how people oversee it. Any decision about a person. Guidance. (PDPC AI advisory guidelines)
  • Choosing the human's role. The framework sets the human's role by the probability and severity of harm: in the loop, over the loop, or out of it, as in its low-harm example. Any decision about a person. Guidance. (Model AI Governance Framework)
  • Clinical AI. Human oversight is mandatory for all clinical and clinical-operations AI, and decision software beyond lookups of established clinical guidelines is regulated as a medical device. Health or care. Guidance. (MOH AIHGle 2.0; HSA GL-07)
  • Banks and insurers. By 7 October 2028, AI used for credit decisions or underwriting escalates to human review when pre-set conditions are met, customers are told, and there's a channel for redress; MAS's FEAT principles already expect appeal and review channels. Credit or lending; Insurance. Guidance. (MAS FEAT principles; MAS AI risk management guidelines)
Philippines
  • Automated decisions. A person can demand information on automated processes that are the sole basis of a decision significantly affecting them, and dispute and correct inaccurate data. Any decision about a person. (Data Privacy Act 2012)
  • AI systems. Where an AI system's automated decisions pose a significant risk, competent people with authority can intervene meaningfully, and the people affected can question and contest the decision. Any decision about a person. Guidance. (NPC Advisory 2024-04)
Malaysia
  • Automated decisions and profiling. The Act has no provision on automated decisions, but the Commissioner's guideline asks for an impact assessment and notice for those with significant effect, such as credit, hiring, health or pricing, and recommends a trained reviewer so AI isn't the only factor. Any decision about a person. Guidance. (PDP guideline on ADM)
  • A draft AI framework. A draft framework put out for comment in October 2026 would have privacy notices say when AI produces decisions that may affect people. Any decision about a person. Guidance. (PDP AI framework consultation)
  • Banks and insurers. Bank Negara's August 2025 discussion paper proposes building responsible-AI principles, accountability, transparency and fairness among them, into financial firms' existing governance; it's non-binding. Credit or lending; Insurance. Guidance. (BNM AI discussion paper)
United Arab Emirates
  • Automated decisions. A person can object to automated decisions with legal or serious effect, and the controller brings in human review on request in every case. Any decision about a person. (PDPL, Article 18; UAE PDPL (English))
  • Health care in Abu Dhabi. AI is supportive technology: a person makes the final decision and answers for it. Health or care. (DOH Abu Dhabi AI policy)
  • In the DIFC. A person can require manual review of a solely automated significant decision, and high-risk AI processing waits for certification and an Autonomous Systems Officer. Any decision about a person. (DIFC Regulation 10; DIFC DP Law, Article 38)
  • Banks and insurers. Customers can ask for human review or an explanation and get a non-AI alternative, and AI without a human is kept to low-risk, non-material processes. Credit or lending; Insurance. Guidance. (CBUAE AI guidance note)
Australia
  • Clinical software. Clinical decision software is exempt from registration only if it supports, not replaces, a health professional's judgement. Health or care. (TGA CDSS exemption)
  • Automated decisions in privacy policies. From 10 December 2026, a privacy policy says what kinds of significant decisions a program makes or substantially helps make, even with a person signing off; there's no right to a human decision. Any decision about a person. (Privacy amendment 2024, APP 1.7; OAIC APP 1.7 fact sheet)
  • Credit and insurance licensees. ASIC found no licensee with arrangements for customers to contest AI decisions, and only 10 of 23 with rules on telling consumers about AI. Credit or lending; Insurance. Guidance. (ASIC REP 798)
  • The voluntary AI safety standard. The government's voluntary standard asks for meaningful human oversight, telling people about decisions AI helps make, and a way for them to contest the outcome. Any decision about a person. Guidance. (Voluntary AI Safety Standard)
Anywhere else
  • Check four things. Whether people can object to automated decisions, ask for a human review or an explanation, or must be told; and the sector rules for credit, hiring, insurance and health. Any decision about a person. Guidance.

Sources

Every source this page cites (62)

Each one was opened and checked on the date beside it.

  1. Infocomm Media Development Authority and PDPC, SingaporeModel Artificial Intelligence Governance Framework, Second Edition21 January 2020
  2. Information Commissioner's OfficeAutomated decision-making, including profiling: What does the UK GDPR say about ADM? (draft guidance)31 March 2026
  3. Court of Justice of the European UnionJudgment of 7 December 2023, OQ v Land Hessen (SCHUFA Holding), Case C-634/217 December 2023
  4. Office of the Australian Information CommissionerAPP 1.7–1.9 transparency obligation fact sheet2026
  5. Official Journal of the European UnionRegulation (EU) 2026/1744 amending Regulation (EU) 2024/1689 (Digital Omnibus on AI)24 July 2026
  6. European CommissionAI Act: regulatory framework for AI3 August 2026
  7. eCFR12 CFR 1002.9, Notifications (Regulation B)7 October 2026
  8. eCFR42 CFR 422.101(c), medical necessity determinations (Medicare Advantage)8 October 2026
  9. Centers for Medicare & Medicaid ServicesFrequently asked questions on coverage criteria and utilization management requirements in CMS-4201-F6 February 2024
  10. California Legislative InformationSB 1120 (Chapter 879, Statutes of 2024), Health care coverage: utilization review28 September 2024
  11. NYC DCWPAutomated employment decision tools2023
  12. Colorado General AssemblySB26-189, Automated Decision-Making Technology14 May 2026
  13. Colorado Attorney GeneralColorado Automated Decision-Making Technology and Chatbot Safety Rulemaking6 October 2026
  14. California Privacy Protection AgencyApproved regulations text: CCPA updates, risk assessments and automated decisionmaking technology (Cal. Code Regs. tit. 11, §§ 7200–7222)22 September 2025
  15. US Food and Drug AdministrationClinical Decision Support Software: guidance for industry and FDA staff29 January 2026
  16. Commission d'accès à l'information du QuébecPrincipaux changements apportés par la Loi 2510 October 2026
  17. Government of Ontario (e-Laws)Employment Standards Act, 2000, section 8.4: disclosure of artificial intelligence in job postings11 October 2026
  18. Government of Ontario (e-Laws)O. Reg. 476/24: Rules and exemptions re job postings28 November 2024
  19. Innovation, Science and Economic Development CanadaArtificial Intelligence and Data Act9 December 2025
  20. Parliament of Canada (LEGISinfo)C-27 (44-1): Digital Charter Implementation Act, 20226 January 2025
  21. Office of the Superintendent of Financial InstitutionsGuideline E-23: Model Risk Management (2027)11 September 2025
  22. legislation.gov.ukData (Use and Access) Act 2025, section 80: automated decision-making (UK GDPR Articles 22A to 22D)19 June 2025
  23. legislation.gov.ukThe Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 22026
  24. GOV.UKData (Use and Access) Act 2025: plans for commencement5 February 2026
  25. Information Commissioner's OfficeAutomated decision-making, including profiling: What are the ADM safeguards? (draft guidance)31 March 2026
  26. Information Commissioner's OfficeICO consultation on the draft guidance about automated decision-making, including profiling31 March 2026
  27. Information Commissioner's OfficeAutomated decision-making, including profiling: When can we use special category data in our ADM? (draft guidance)31 March 2026
  28. EUR-LexRegulation (EU) 2016/679 (General Data Protection Regulation)4 May 2016
  29. Court of Justice of the European UnionJudgment of 27 February 2025, CK v Dun & Bradstreet Austria, Case C-203/2227 February 2025
  30. European Parliament, Legislative ObservatoryProcedure file 2025/0360(COD): Digital Omnibus1 October 2026
  31. Bundesministerium der JustizBundesdatenschutzgesetz, § 37 Automatisierte Entscheidungen im Einzelfall einschließlich Profiling12 May 2026
  32. Bundesministerium der JustizBetriebsverfassungsgesetz, § 95 Auswahlrichtlinien and § 87(1) Nr. 610 October 2026
  33. European Commission, AI Act Service DeskAI Act, Annex III: High-risk AI systems referred to in Article 6(2)27 July 2026
  34. European Commission, AI Act Service DeskAI Act, Article 26: Obligations of deployers of high-risk AI systems27 July 2026
  35. European Commission, AI Act Service DeskAI Act, Article 14: Human oversight27 July 2026
  36. European Commission, AI Act Service DeskAI Act, Article 27: Fundamental rights impact assessment for high-risk AI systems27 July 2026
  37. Gazette of IndiaThe Digital Personal Data Protection Act, 2023 (No. 22 of 2023)11 August 2023
  38. Gazette of IndiaNotification G.S.R. 843(E): commencement of the Digital Personal Data Protection Act, 202313 November 2025
  39. Reserve Bank of IndiaReserve Bank of India (Commercial Banks – Credit Facilities) Directions, 2025 (RBI/DOR/2025-26/154), updated as on 1 October 2026: Chapter III, Digital Lending Guidelines1 October 2026
  40. Reserve Bank of IndiaReserve Bank of India (Digital Lending) Directions, 20258 May 2025
  41. Reserve Bank of IndiaFramework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) Committee Report13 August 2025
  42. Indian Council of Medical ResearchEthical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare2023
  43. Personal Data Protection Commission, SingaporeAdvisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems1 March 2024
  44. Ministry of Health and Health Sciences Authority, SingaporeArtificial Intelligence in Healthcare Guidelines (AIHGle) Version 2.010 March 2026
  45. Health Sciences Authority, SingaporeGL-07: Risk classification of standalone medical mobile applications and qualification of clinical decision support software21 July 2025
  46. Monetary Authority of SingaporeGuidelines on Artificial Intelligence Risk Management7 October 2026
  47. Monetary Authority of SingaporePrinciples to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of AI and Data Analytics in Singapore's Financial Sector7 February 2019
  48. Lawphil Project (Arellano Law Foundation)Republic Act No. 10173, Data Privacy Act of 201215 August 2012
  49. National Privacy Commission, PhilippinesNPC Advisory No. 2024-04: Guidelines on the application of the Data Privacy Act to artificial intelligence systems processing personal data19 December 2024
  50. Personal Data Protection Department, MalaysiaGuideline on Automated Decision-Making and Profiling (Garis Panduan Pembuatan Keputusan Secara Automatik dan Pemprofilan)30 April 2026
  51. Personal Data Protection Department, MalaysiaPublic Consultation Paper No. 1/2026: AI and Personal Data Protection Framework5 October 2026
  52. Bank Negara MalaysiaDiscussion paper: Artificial Intelligence in the Malaysian Financial Sector2025
  53. UAE Legislation (Ministry of Cabinet Affairs)Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data (English text)20 September 2021
  54. UAE Government portal (u.ae)Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Article 18 (Arabic text)20 September 2021
  55. Department of Health, Abu DhabiPolicy on Use of Artificial Intelligence in the Healthcare Sector of the Emirate of Abu Dhabi30 April 2018
  56. Dubai International Financial Centre AuthorityData Protection Law, DIFC Law No. 5 of 2020, Article 38 (consolidated version, July 2025)2025
  57. Dubai International Financial CentreData Protection Regulations, Regulation 10: processing through autonomous and semi-autonomous systems1 September 2023
  58. Central Bank of the UAEGuidance Note on Consumer Protection and Responsible Adoption and Use of AI and Machine Learning by Licensed Financial Institutions11 February 2026
  59. Federal Register of Legislation, AustraliaTherapeutic Goods (Medical Devices) Regulations 2002, Schedule 4 Part 2 item 2.158 September 2026
  60. Federal Register of Legislation, AustraliaPrivacy and Other Legislation Amendment Act 2024, Schedule 1, Part 15 (automated decisions and privacy policies)10 December 2024
  61. Australian Securities and Investments CommissionREP 798 Beware the gap: Governance arrangements in the face of AI innovation29 October 2024
  62. Department of Industry, Science and Resources, AustraliaVoluntary AI Safety Standard: the 10 guardrails2024

Frequently asked questions

Why does undocumented work score so poorly?

AI cannot automate what you cannot explain. If the process relies on the "gut feeling" of your staff, an engineer cannot map it to a prompt or a script.

Can AI read unstructured data?

Yes. Language models can extract structured JSON from messy emails and unstructured PDFs, making them viable targets, provided the rules for extraction are clear. Measure the accuracy on a sample of your own documents before relying on it.

What does human-in-the-loop mean?

It means the AI does the heavy lifting of reading, extracting, and drafting, but a human staff member clicks the final "Approve" button. This covers the error tolerance gap. Singapore's Model AI Governance Framework names three levels: in the loop, where a person takes each decision; over the loop, where a person monitors and can take over; and out of the loop, with no human override, as in its example of a low-harm product recommendation.

Does a human reviewer make an AI decision lawful?

Only if the review is real. The UK regulator's draft guidance says a person must review each decision before it applies and be able to change it, and spot checks don't count. In the EU, a credit score a lender relies on strongly counts as an automated decision even when a person signs the loan (the SCHUFA judgment, 2023). In Australia, from 10 December 2026, a decision a program substantially helps make still goes in the privacy policy.

When do the EU AI Act's high-risk rules apply?

From 2 December 2027 for the uses in Annex III, such as filtering job applicants, credit scoring and life and health insurance pricing: the AI Omnibus (Regulation 2026/1744) moved the date from 2 August 2026. AI built into regulated products follows from 2 August 2028. A trained person with authority then oversees each system and can override it.

Related

Let's find your highest ROI process.

We audit your operations to find the workflows where automation will yield the fastest financial payback.

Buy an audit

Built and maintained by Stafflo. Questions or a wrong number: contact. Last updated 11 October 2026.