Exposure

Definition

Exposure is the residual condition. Hours counts load, training counts investment, junior headcount counts the door closing and rework counts clean-up time. Exposure counts the thing none of the others can, which is harm that lands on a person.

Exposure: the AI-mediated adverse events that land on people, counted by class of harm and disclosed by position relative to the system.

Scope boundary

Exposure covers decisions and outputs with material consequence for a person. Correcting the wording of an AI-drafted internal memo is rework rather than exposure, while signing off a mortgage decision is exposure. This boundary is what stops the condition sprawling into everything.

The three positions

The same harm class means a different thing depending on where someone stands relative to the system. Exposure is therefore disclosed by position and never summed into a single figure, because an average blends the group with the most control into the group with the most exposure.

Position three has to be named explicitly in any disclosure, or it gets dropped.

The matrix

Positions are the columns; classes of harm are the rows. On a phone, each row opens with position three.

The errors funnel

Errors acted upon is a funnel, not three counts. It is one event stream measured at three gates, which yields two ratios that can be compared across organisations even when the absolute counts cannot:

• Catch rate (gate 1 → gate 2): how much of the operator layer is real.
• Amplification (gate 2 → gate 3): people affected per error that landed, and how badly.

A high error rate with a high catch rate is what an organisation that counts properly looks like. A low error rate with a low catch rate almost certainly belongs to one that doesn’t.

Liability without authority

Floors govern process; trends govern outcomes

Exposure is the condition that forced this rule, and it applies across all six.

• Procedural cells take real floors. No person may receive an adverse AI-mediated decision without a named human with the authority to reverse it. A floor like that can be breached, caught and enforced, and a minimum review time is the second one.
• Outcome counts cannot. For error counts, adverse decision counts and override rate, a floor is either incoherent (you cannot promise to reject fewer people) or perverse (a minimum override rate manufactures spurious overrides). These are disclosed with their trend and never targeted. The discipline comes from having to publish a worsening line beside last year’s and explain it, not from a threshold.

This keeps Principle Three intact rather than bending it: setting a direction as a target is exactly the maximised metric that gets gamed, whereas publishing the direction is not.

Declared floors, not universal ones

A universal minimum review time is indefensible, because a mortgage decision and a content approval are different worlds. So the core requires that a minimum review time be set and published for each decision class in scope, with breaches reported, and the annexes set the values. The disclosure then does the work by itself: an organisation publishing “minimum review time for credit decisions: 20 seconds” has indicted itself without anyone having to argue, because the number you set is the confession. This is the GHG shape, where the core mandates the measurement and the annex sets the threshold.

Judgement rate lives inside Exposure

Judgement rate is the P2 cell of Exposure, not a freestanding metric. Part II’s central number turns out to be something the core disclosure set already asks for, which strengthens both. Part II was framed this way before it was published, so this is a structural fix rather than a correction.

This is the relationship the annex rules describe, running in the other direction: judgement rate is not an annex metric but a core one that had been floating loose.

Companion measure: the trust gap

Perception of harm stays out of the core: it is self-reported, it moves with the survey instrument, and Principle One’s criterion is external observability. Putting it in hands every critic the same line of attack.

It is still worth publishing as a companion measure: explicitly labelled as declared rather than observed, and always expressed as a gap between positions, never as a single figure. The BambooHR finding is the evidence for it: 67% of HR professionals confident against 34% of employees, alongside 80% who had found bias problems in their own hiring tools. All of the value is in the difference.

Three open flags

Scope test: passed, 22 September 2026

Hospital and bank resolve trivially: position three is the patient and the applicant, and adverse decisions are the obvious harm class. The agency was the hard case, and it holds.

• Adverse decisions are largely absent in an agency, and that is fine rather than fatal. The matrix does not require every cell to be populated in every sector; severity tiers already allow a class to sit near zero.
• Errors acted upon still land on subjects, at low severity. A misleading claim, a product shown doing something it does not do or a misrepresented look are small costs spread across many people, but they are real ones. Position three in an agency is the audience.
• Liability without authority is where the agency case gets serious, and volume is the mechanism. Advertising carries regulatory duties, brand safety rules and brand guidelines, and a reviewer signing off tens of thousands of assets a year across multiple brands cannot meaningfully discharge any of them. Here, authority is removed by throughput rather than by policy.

That gives Annex A its own rendering of the condition: assets per reviewer per year, traceable straight back to liability without authority. It also generalises, because volume is how oversight becomes fictional in any sector that scales output faster than it scales reviewers.