Engine Registries and the Right to Know

GDPR Article 22, research-only mode, and mandatory engine disclosure

Ai governance regulation — Engine Registries and the Right to Know
Key takeaways
  • GDPR Article 22 requires meaningful engine-level attribution, not just model category disclosure.
  • Research-only engine outputs are still personal data.
  • Version-controlled registries enable retroactive disclosure.
Risk signals
  • Article 22 explanations limited to 'an AI model was used'.
  • Research-only engines scoring individuals without any disclosure pathway.
Action items
  • Build and expose an explainability API returning engine-level attribution.
  • Design a data subject access request workflow that covers research-only engine logs.
Series 1 ADV — Part 2 of 8

The engine registry is the process table of the behavioral AI platform. It knows exactly which engines scored you, in what order, and with what weights. The question this article asks is: should you know too?

The Technology in Plain Language

Every behavioral score you receive from a multi-engine system is the product of many individual computations — Bayesian confidence, emotional regulation, temporal state machine, narrative propagation, and more. Each computation is logged in an engine registry with a version, an activation state, and an audit trail. The system knows which engines ran. The question is whether the subject of the scoring is entitled to that information.

GDPR Article 22 and What It Actually Requires

Article 22 gives data subjects the right to explanation when a solely automated decision produces legal or similarly significant effects. The Court of Justice of the EU has clarified that this requires "meaningful information about the logic involved" — not merely a description of the model category, but enough to understand the specific factors that drove the decision.

In a 34-engine system, "the model considered your communication patterns" does not meet that standard. The engine that scored communication patterns, its version, its confidence output, and the weight it received in collation — that is the meaningful information Article 22 requires.

Research-Only Mode and Regulatory Transparency

Research-only engines run, log outputs, but never expose results. Regulators should be aware that a system can lawfully run engines that score individuals without those scores appearing in any disclosure — because the scores are "only for research." If research-only outputs later influence model training that becomes active, the disclosure gap is real.

What Developers Should Do

  • Build explainability APIs that return engine-level attribution, not just aggregate scores.
  • Treat research-only engine outputs as personal data under GDPR — they were computed about a person.
  • Version-control the registry so you can reconstruct which engines ran on a specific date.
LinkedIn

Technical Deep Dive

Read the technical deep dive

See the implementation walkthrough on govindpreetsingh.com

Read on govindpreetsingh.com →

Request a consultation

This is a lightweight intake endpoint for now. It is structured so the practice management system can later take over scheduling, conflict checks and matter creation.

Submitting this form does not create an advocate-client relationship. Please avoid sending confidential details until engagement is confirmed.