The previous chapter examined Hurricane Score as a predictive supervision tool operating within ICE’s Alternatives to Detention program. The Risk Classification Assessment occupies a different and more consequential position in the immigration enforcement architecture. Hurricane Score shapes supervision conditions for individuals already outside detention. RCA shapes whether a person is detained at all.
That distinction is legally significant. A system that influences the initial custody determination — detention or release, bond amount, custody classification level, community supervision level — operates at the moment where administrative processing becomes deprivation of liberty. That is the moment the Constitution is most directly engaged.
RCA is not a recent innovation. ICE developed it between 2009 and 2012 under a contract with IBM valued at $7.6 million, and has deployed it nationally since February 2013. Its operational scope is substantial: in fiscal year 2023, ICE processed 273,220 detained noncitizens through or alongside the RCA process. The system generates recommendations — not decisions — and ICE officers retain formal authority over final custody determinations. The legal analysis of RCA begins, and in important ways centers, on what that distinction between recommendation and decision actually means in practice.
I. What RCA does: structure, inputs, and outputs
DHS Office of Inspector General, OIG-15-22 (Feb. 4, 2015) DHS Office of Inspector General, OIG-24-31 (June 2024)
The DHS Office of Inspector General has examined RCA on two separate occasions, producing reports that together constitute the primary public documentation of the system’s design and operational performance.
The 2015 OIG report, OIG-15-22, describes RCA as a computerized tool used at intake to generate recommendations across four dimensions: detention or release, custody classification level for detained individuals, bond amount where applicable, and community supervision level for released individuals. ICE officers are expected to complete the RCA at intake or within five days of detention, except where detention is mandatory by statute. The system collects information across a range of variables including criminal history, prior removal records, visa violations, community ties, special vulnerabilities such as mental health and physical health status, and flight risk indicators. The inputs are entered by the officer, processed by the system’s rules engine and scoring rubric, and returned as a structured recommendation.
The 2024 OIG report, OIG-24-31, updated the compliance picture substantially. It found that ICE failed to conduct RCAs for 33 percent of detained noncitizens in FY2023 — 79,977 of 244,376 detained individuals — and that completion rates varied significantly across ICE’s 25 Enforcement and Removal Operations field offices, with nine completing fewer than 75 percent of required assessments. Where RCAs were completed and officers deviated from a detention recommendation toward release, 71 percent of a statistical sample showed insufficient documented justification for the departure.
The 2024 OIG recommended that ICE assign formal oversight responsibility for the RCA process and establish documented policy requiring officers to justify deviations from recommendations. ICE concurred with both recommendations — an institutional acknowledgment that the existing framework lacked the documentation and oversight infrastructure that the system’s liberty consequences demand.
II. The rules engine versus machine learning distinction — and why it matters legally
Before turning to the legal framework, a technical clarification is necessary because it directly affects how the legal arguments are framed.
Unlike Hurricane Score, which is a machine-learning model trained on historical case data, RCA operates primarily as a rules engine — a structured decision tree that applies predetermined scoring rubrics to categorized inputs and generates recommendations based on fixed logic. The business rules underlying RCA were obtained through FOIA litigation in Casper, Evans, and Koulish v. U.S. Department of Homeland Security and U.S. Immigration and Customs Enforcement, No. 0:16-cv-00380-ADM-BRT (D. Minn. 2016), and reveal a system built on explicit variable weightings and risk-level thresholds rather than statistical inference from training data.
That distinction matters for litigation strategy. A rules-engine system is, in principle, more transparent than a machine-learning model: its logic can be documented and examined, its scoring rubrics can be obtained through disclosure, and its outputs can be traced back to specific input values. The legal challenge to RCA is therefore less about algorithmic opacity in the technical sense and more about administrative opacity — the failure to document overrides, the inconsistency in application across field offices, and the absence of meaningful procedural safeguards for the individual subject to the recommendation.
A judge confronting a challenge to RCA does not need to engage with the complexity of statistical modeling. The challenge is recognizable in standard administrative-law terms: a structured decision-support system with documented inconsistencies, inadequate override justification, and no formal mechanism for the affected individual to contest the inputs before custody is determined.
III. The Fifth Amendment framework — Mathews applied to intake classification
U.S. Constitution, Amendment V Mathews v. Eldridge, 424 U.S. 319 (1976) Zadvydas v. Davis, 533 U.S. 678 (2001)
The central constitutional framework for analyzing RCA remains procedural due process under the Fifth Amendment, applied through the Mathews v. Eldridge balancing test.
The private interest implicated by RCA is significant. An initial detention recommendation that results in custody pending removal proceedings affects physical liberty directly. Bond amounts recommended by RCA determine whether detention continues for days, weeks, or months depending on the individual’s financial capacity to post bond. Custody classification levels affect the conditions of detention. The Mathews framework requires that the weight given to this interest be substantial.
The risk of erroneous deprivation is documented by the government’s own audits. The 2024 OIG report confirms that RCAs were not completed for 33 percent of detained individuals in FY2023 — meaning that for a third of cases, the system that is supposed to generate a documented, structured custody recommendation was not used at all, and the basis for the custody determination is correspondingly less documented. Where RCAs were completed and overrides occurred toward release, 71 percent of sample cases showed insufficient justification, indicating that the override process — the human-review mechanism that is supposed to provide individualized judgment — was not adequately documented. That is not a hypothetical risk of error. It is a measured, documented pattern of inadequate procedural compliance.
The person subject to RCA at intake typically receives no disclosure of the recommendation, no access to the specific inputs as applied to their case, and no formal opportunity to contest factual errors before the custody determination is made. An individual who has been misclassified due to a criminal history error, an incorrect prior removal entry, or a misidentified community ties assessment has no structured mechanism to correct those errors before the initial detention decision is implemented.
Zadvydas v. Davis, 533 U.S. 678 (2001), confirmed that the Due Process Clause applies to immigration detention and that detention cannot be treated as an unbounded administrative tool. While Zadvydas addressed post-removal-period detention rather than pre-hearing custody classification, its foundational principle — that liberty deprivation requires procedural justification, not merely administrative regularity — applies to the intake classification stage. An intake process that relies on a structured recommendation tool with documented inconsistencies and no individual disclosure mechanism does not obviously satisfy the procedural requirements that Mathews demands for decisions with direct liberty consequences.
IV. The APA dimension — arbitrary action and documentation requirements
Administrative Procedure Act, 5 U.S.C. § 706
Where RCA operates in a context subject to APA review, the arbitrary-and-capricious standard provides an additional avenue for challenge that does not require a constitutional argument.
Under 5 U.S.C. § 706(2)(A), a reviewing court must hold unlawful and set aside agency action that is arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law. The APA’s requirement of reasoned decision-making — articulated by the Supreme Court in Motor Vehicle Manufacturers Association v. State Farm Mutual Automobile Insurance Co., 463 U.S. 29 (1983) — demands that an agency examine the relevant data and articulate a satisfactory explanation for its action, including a rational connection between the facts found and the choice made.
A custody determination that relies on an RCA recommendation without documented individualized reasoning — or that departs from the recommendation without documented justification, as the 2024 OIG found in 71 percent of sampled override cases — does not easily satisfy that standard. The failure to document the basis for a custody decision is not merely an administrative housekeeping problem. In APA terms, it is the absence of the reasoned explanation that makes agency action reviewable and distinguishes lawful discretion from arbitrary action.
The FOIA-obtained business rules from the Casper litigation are significant here because they establish what the system is supposed to do — and allow a lawyer to demonstrate, in a specific case, that the recommendation departed from the system’s own logic or that the inputs fed into the system were factually incorrect.
V. The EU AI Act framework — what pre-deployment governance demands
EU AI Act, Regulation (EU) 2024/1689, Annex III, Articles 13, 14, and 27
Under the EU AI Act, a system with RCA’s function and operational scope would fall within the high-risk classification under Annex III as an AI system used in migration management for risk assessment and custody classification purposes affecting legal status and liberty. That classification would trigger compliance obligations whose content illuminates the governance gaps in the current US framework.
Article 13 requires high-risk systems to be sufficiently transparent that deployers can interpret the outputs and use them appropriately. An RCA recommendation that an officer may override without documented reasoning does not clearly satisfy that requirement — it is not sufficient that the system produces a recommendation if the officer cannot assess its basis or reliability in the specific case.
Article 14 requires effective human oversight. The 2024 OIG’s finding that 33 percent of required RCAs were not completed and that 71 percent of release-override cases lacked adequate justification documents a systematic failure of the human-review mechanism, not an isolated exception. Effective oversight in the Article 14 sense requires that the human decision-maker understand the system’s limitations and be capable of making an independent judgment — not merely that a human signature appears at the end of the process.
Article 27 requires a fundamental-rights impact assessment before deployment. The documented performance gaps identified across multiple OIG audits — inconsistent completion, inadequate override documentation, absence of centralized oversight from 2017 onward — represent exactly the kind of operational risk that a genuine pre-deployment rights assessment would be expected to identify and address.
The EU framework does not apply to US immigration agencies. Its value here is comparative: it defines the standard that a governance framework adequate to the liberty interests at stake would require, and makes visible the distance between that standard and current practice.
VI. Practical litigation strategy — inputs, documentation, and the override record
For the practitioner, the most actionable RCA-related arguments are grounded in records access, factual correction, and documentation requirements rather than abstract challenges to the system’s validity.
The first step is to obtain the RCA record for the specific case. The RCA summary print-outs — the documents generated by the system for individual cases — were obtained through the Casper FOIA litigation and are a known category of agency record. A FOIA request specifically identifying RCA summary documentation, combined with Privacy Act access requests where the client qualifies, can establish what recommendation the system generated, what inputs were recorded, and whether the officer’s custody determination departed from the recommendation.
The second step is to audit the inputs. RCA’s recommendations depend on the accuracy of the data entered: criminal history, prior removals, visa violations, community ties, and special vulnerabilities. Each of those data points can be wrong. A dismissed arrest treated as a conviction-equivalent input, an outdated prior removal entry, an incorrect community-ties assessment, or a special vulnerability that was not recorded can all affect the recommendation in ways the individual has no opportunity to correct at intake.
The third step is to examine the override documentation. If the officer departed from an RCA recommendation — in either direction — the 2024 OIG’s findings confirm that this departure was frequently undocumented. An undocumented departure from a structured recommendation tool is administratively vulnerable: it is either a departure without reasoning, which is arbitrary, or a departure based on reasoning that was not preserved, which makes the custody determination unreviewable.
The fourth step is to frame the argument in legal terms the forum can reach. In immigration court bond proceedings, the argument is that the custody determination is not supported by adequate individualized reasoning. In habeas proceedings under 28 U.S.C. § 2241, the argument is that the detention lacks the procedural foundation that due process requires. In contexts subject to APA review, the argument is that the agency action is arbitrary and capricious for want of documented reasoned decision-making.
Next: Chapter 20 — AI in criminal pretrial: bail algorithms, risk scores, and the automation of liberty in the criminal justice context.
Leave a Reply