New Jersey Businesses Should Map Automated Decisions Now

Start with a rental application. A leasing coordinator enters an applicant’s information into a screening service, receives a score and recommendation, then accepts, rejects, or adds conditions to the application. The vendor may describe the product as risk analytics rather than artificial intelligence. That label does not change the workflow: software evaluated a person, produced an output, and influenced access to housing.

This is the kind of system New Jersey businesses need to find before another policy questionnaire lands with legal, procurement, or compliance. The state’s Consumer Data Privacy Act is already in effect, its implementing regulations have been proposed, and guidance from the New Jersey Division on Civil Rights explains that the state’s Law Against Discrimination applies when automated tools produce discriminatory outcomes. A proposed regulation is not an enforceable final rule, while agency guidance explains how an existing law may apply rather than creating a separate prohibition. Those distinctions matter.

This walkthrough is not legal advice. It produces an operational record that counsel, auditors, product teams, and affected people can use without first reconstructing the system from invoices and screenshots.

Begin with the consequence, not the AI label

An inventory based on the words “AI,” “machine learning,” or “algorithm” will miss ordinary-looking tools. Applicant tracking systems rank résumés. Fraud dashboards score transactions and customers. Call-center software recommends which account should receive attention.

Tenant services screen applicants. Marketing platforms decide which people receive an offer, even when the purchasing team bought “optimization” or “business intelligence.

Use a broader internal test: include software that processes information about a person and produces a score, category, ranking, recommendation, eligibility result, or other output that can alter how the organization treats that person. Rules-based systems belong on the list too. A fixed threshold that rejects every applicant below a certain score may create the same governance problem as a statistical model.

New Jersey’s privacy law supplies a useful boundary. It defines profiling as automated processing used “to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual,” including aspects such as economic situation, health, preferences, reliability, behavior, location, or movements. Consumers can opt out of profiling “in furtherance of decisions that produce legal or similarly significant effects.” The statute connects those effects to consequential areas including housing, lending, insurance, education, employment opportunities, health care, and access to essential goods or services.

Do not treat that wording as a complete inventory filter. The law contains exemptions, including limits concerning data handled in an employment context, and another law may govern the same workflow. The inventory should capture the system first. Counsel can determine coverage afterward.

For the rental screening workflow, begin with the result shown to the leasing coordinator. Record whether the service returns a numeric score, a recommendation such as accept or decline, a required deposit, or a ranked list. Then identify what changes for the applicant. If the coordinator routinely follows the recommendation, the practical consequence matters more than a contract clause calling the output advisory.

Trace one decision backward through the stack

Open the screen used by the employee who acts on the result. Screenshots and field names are more useful here than a vendor’s product page because they show what the operator sees, which choices remain available, and whether the system explains its recommendation.

Trace the rental decision backward. Note which application fields enter the screening service, whether the vendor adds public records or consumer-report data, how the system converts those inputs into an output, and where the result travels next. Record integrations as well as applications. A score may arrive through an application programming interface, which is a software connection that lets one system exchange data with another, without any employee opening the vendor’s dashboard.

Then trace the decision forward. Does the property system automatically generate a rejection notice? Can the leasing coordinator override the recommendation? Does an override require a reason, and is that reason retained?

If the applicant disputes an error, can anyone identify the source record and rerun the check after correction?

That chain exposes the real control points. A nominally human decision offers little protection when the employee sees only the vendor’s recommendation, lacks the source data, and risks managerial scrutiny for overriding it. Conversely, an automated score may carry less practical weight when trained staff independently inspect relevant records and document a different outcome.

Give each workflow one inventory row, not one row per vendor contract. The same screening product used for housing and contractor onboarding creates different affected populations, consequences, legal questions, and review paths.

Search where procurement records do not

Accounts payable can identify vendors, but invoices rarely reveal embedded scoring. Search configuration screens, integration catalogs, data dictionaries, standard operating procedures, and employee training material for operational terms such as priority, fit, eligibility, propensity, risk, trust, quality, anomaly, match, or recommended action. These terms often reveal decisions hidden behind an analytics label.

Interview the employee who receives the output rather than relying only on the executive who approved the purchase. Ask that employee to demonstrate a normal case and an exception. For the rental workflow, watch what happens after the score appears: which button becomes available, what information is hidden, and whether the employee can pause the process without leaving the system.

Procurement should also examine add-ons enabled after the original purchase. A customer relationship platform may begin as a contact database and later gain lead scoring. An applicant system may add automated ranking through a configuration change rather than a new contract. Cloud products change frequently, so the inventory needs a named business owner who can confirm whether the workflow still matches the record.

A practical row should capture the business purpose, affected people, input categories, output, consequence, vendor and internal owner, human role, review or appeal route, retention period, and supporting documents. Add a status field for unknown answers. “No documentation supplied” is a finding; an empty cell is easy to mistake for unfinished clerical work.

Separate enforceable duties from incoming proposals

New Jersey’s Consumer Data Privacy Act already gives covered consumers rights concerning personal data and profiling, and it requires data protection assessments for certain processing that presents a heightened risk of harm. A data protection assessment is a documented evaluation that weighs a processing activity’s benefits against its risks and safeguards. The attorney general can request relevant assessments under the statute.

The Division of Consumer Affairs has also published proposed implementing regulations. The public proposal can signal the records regulators expect businesses to maintain, but a proposal may change before adoption and should not be described as an enforceable final requirement. Teams should check the current rulemaking record rather than copying a summary from an older compliance memo.

Separate from the privacy law, the Division on Civil Rights has stated that New Jersey’s Law Against Discrimination applies to algorithmic discrimination. A company does not avoid responsibility merely because a vendor built or operated the tool. For rental screening, that means an owner should know what variables drive the recommendation, how errors are corrected, and whether outcomes differ across protected groups where lawful and feasible to evaluate.

Other rules can attach to a specific workflow. A tenant report may qualify as a consumer report under federal law, bringing duties that differ from New Jersey privacy requirements. Credit, employment, insurance, and health decisions have their own regimes. The inventory does not decide which one applies.

It gives the people making that determination a complete decision chain.

Build the evidence packet while access is available

For every consequential workflow, link the inventory row to the material needed to test the vendor’s claims. Useful records include the current instructions shown to operators, contracts and data-use terms, input-field definitions, threshold settings, validation reports, change notices, output logs, override records, complaint procedures, and copies of notices delivered to affected people.

Ask for a model card, a structured document describing a model’s intended use, evaluation, limitations, and training context, if the vendor maintains one. Do not let the model card replace workflow evidence. A model can perform as documented while the customer applies it to a different population, changes the cutoff, feeds it stale data, or turns a recommendation into an automatic rejection.

Return to the rental application. The minimum useful evidence packet should let a reviewer reconstruct which data went in, which score came back, who acted, whether the person could challenge an error, and what happened after a correction. If the vendor cannot expose source reasons or historical outputs, mark that limitation beside the system rather than burying it in procurement correspondence.

Logging has a cost. Detailed records consume storage, may retain sensitive data longer than necessary, and require access controls. Sparse logs cost less but can leave the company unable to explain a disputed result. Choose retention with the applicable legal and operational needs in view, then document the choice; collecting everything forever is not a governance strategy.

Test the map with a disputed result

Run a tabletop exercise using a plausible error, without entering real personal data into an unapproved environment. Assume the rental service associated the applicant with the wrong record. Ask the owner to locate the original input, identify the data source, stop an adverse action if appropriate, correct the record, rerun the workflow, and preserve the before-and-after result.

Time the handoffs in broad operational terms rather than inventing a service target. If the leasing team must email procurement, which contacts a reseller, which opens a ticket with the vendor, the supposed appeal path may not function before the unit is offered to someone else. Record that failure. The useful remediation may be a manual hold, a direct escalation channel, or a rule preventing automatic action when identity confidence is low.

Repeat the exercise after a material product update. Vendors change models, data sources, interfaces, and default thresholds. An annual inventory review will miss a change deployed between review cycles unless contracts or internal release processes require notice.

The finished inventory is not proof that a system is fair or lawful. It is a map showing where a person encounters automated judgment, who can intervene, and which claims still lack receipts.

Questions people ask

Does ordinary analytics software belong in an automated decision inventory?

Yes, when its output affects how a person is ranked, screened, recommended, scored, or treated. The relevant facts are the input, operation, output, and consequence. A fixed rule in a dashboard can deserve the same scrutiny as a machine-learning model if employees rely on it to grant, deny, delay, or price an opportunity.

Are

New Jersey’s proposed privacy rules already enforceable?

A published proposal is not the same as an adopted final rule, and its text may change. The underlying New Jersey Consumer Data Privacy Act is already in effect, however, while the Law Against Discrimination and other existing laws may apply independently. Businesses should verify the current rulemaking status with qualified counsel rather than treating the inventory as a legal conclusion.

Should a business inventory systems used for employees?

Yes for governance purposes, even where a particular privacy-law provision or exemption changes the legal analysis. Hiring, scheduling, performance scoring, productivity monitoring, and termination recommendations can affect employment opportunities and raise discrimination concerns. Capture the workflow and mark its employment context so reviewers can apply the correct law instead of excluding it at discovery.

What if the vendor will not explain how its score works?

Record what the vendor withholds, what the business can observe, and whether a human can review source data or correct an error. Then test whether the workflow can operate safely with that gap. For the rental example, a score that cannot be reconstructed or disputed may require a manual hold, a different configuration, or a different vendor.