Why public-sector AI decisions must be independently verifiable

Governments are deploying AI into decisions that carry legal weight: which applications get benefits, which taxpayers get audited, which cases get prioritized, which neighborhoods get resources. When an algorithm makes or shapes such a decision, a principle older than computing kicks in — due process. A person affected by a state decision has the right to know the basis for it and to challenge it. Increasingly, courts and regulators are making explicit that this applies to algorithmic decisions too: they must be auditable after the fact and contestable by the person affected. That requirement quietly imposes a technical demand most public-sector AI systems cannot yet meet.

The demand is not that the model be perfect, or even explainable in full — it is that the record of what happened be trustworthy. When a citizen contests an automated decision months later, the agency must be able to produce, credibly, what the system received, which model version ran, what it output, and when — and to show that this record was not altered after the complaint was filed. An internal log does not satisfy a court on its own, because the agency that holds it is the party with an interest in the outcome. The record has to be tamper-evident and independently verifiable, or it is not evidence a due-process review can rely on.

This is where a signed attestation becomes a governance tool rather than a technical nicety. At the moment of each decision, the system captures the inputs (or their hash), the output, the model identifier, and a timestamp, and signs the bundle. Later, anyone — the citizen's lawyer, an oversight body, a court-appointed auditor — can verify independently that this exact decision came from this exact system at that time and has not been touched since, by checking the signature. The agency is no longer asking to be trusted; it is offering proof anyone can check. That shift, from 'trust our logs' to 'verify the record yourself,' is precisely what due process for algorithmic decisions requires, and it scales to the millions of automated decisions a government makes.

Two design points make this durable and sovereign. First, public records must remain verifiable for years or decades, so sign with a post-quantum scheme (ML-DSA / Dilithium-2, NIST FIPS 204) — a classical signature could be forged once quantum computers mature, undermining historical decisions. It is resistant to known classical and quantum attacks per NIST, not unbreakable. Second, be honest about scope: an attestation proves what the system did and that the record is intact — it does not prove the decision was correct, lawful, or unbiased. Those remain matters for policy, law, and separate auditing. But a decision no one can later reconstruct or trust is indefensible on its face; a decision with a verifiable, tamper-evident, quantum-safe record can at least be examined honestly. For public-sector AI, that is the difference between accountability and a black box the public is asked to accept on faith.