Many organisations operate data-driven decisioning systems that predate the machine learning era. These include expert systems encoding domain knowledge as decision trees or rule sets, business rules engines processing structured if-then-else conditions against customer or transaction data, scoring models based on weighted criteria defined by subject-matter experts, and threshold-based systems triggering actions when observed values cross predefined boundaries.
These systems may fall within the Article 3(1) definition of an AI system if they are designed to operate with varying levels of autonomy, may exhibit adaptiveness after deployment, and infer from inputs how to generate outputs. Their principal compliance advantage is transparency: every decision pathway is deterministic and documentable. The rules can be enumerated, each rule tested in isolation, and the system’s behaviour explained by reference to the specific rule that fired. For high-risk domains where explainability is paramount, such as credit decisioning, benefits eligibility, or judicial risk assessment, heuristic approaches may satisfy regulatory requirements more naturally than opaque machine learning models.
The compliance disadvantage is that heuristic systems can embed their designers’ biases without the statistical tools available to detect and mitigate those biases in learned models. A manually designed scoring model may assign weights to features that correlate with protected characteristics without the designer recognising the correlation. The risk assessment for heuristic systems must therefore include a retrospective bias audit, testing the system’s historical decisions for disparate impact across protected groups.
When evaluating heuristic approaches against the six compliance criteria, they score strongly on documentability, testability, auditability, and determinism; adequately on maintainability; and variably on bias detectability depending on how feature weights were derived.
Key outputs
- Compliance criteria scoring for heuristic candidates
- Retrospective bias audit results (if selected)