The previous chapter examined COMPAS as the defining case of proprietary opacity in criminal justice AI: a tool whose internal methodology was protected as a trade secret, leaving defendants to challenge a score they could not examine. The Public Safety Assessment presents a different legal problem — one that is in some ways more revealing precisely because it does not share COMPAS’s opacity.
The PSA’s algorithm is public. Arnold Ventures has published the complete list of factors and the tool’s weighting methodology, so that anyone can see how risk scores are calculated. That transparency is deliberate and is one of the features that distinguishes the PSA from older risk tools. And yet the legal problems the PSA creates are not primarily about hidden methodology. They are about something more subtle and more pervasive: the displacement of individualized judicial judgment by a structured actuarial recommendation — even when that recommendation is transparent, validated, and openly available.
That is the legal problem this chapter addresses.
I. What the PSA is and how it was built
Arnold Ventures — Public Safety Assessment, advancingpretrial.org
The Public Safety Assessment was developed by Arnold Ventures, formerly the Laura and John Arnold Foundation, through the analysis of approximately 750,000 historical criminal cases from more than 300 jurisdictions across the United States. Researchers identified nine factors most predictive of three pretrial outcomes: failure to appear at a scheduled court hearing (FTA), new criminal activity while on pretrial release (NCA), and new violent criminal activity while on pretrial release (NVCA).
The nine factors, drawn entirely from administrative criminal history records, are: age at current arrest; whether the current offense is violent; whether there is a pending charge at the time of the current offense; prior misdemeanor convictions; prior felony convictions; prior violent convictions; prior failure to appear within the past two years; prior failure to appear more than two years ago; and prior sentence to incarceration. The tool produces two scaled scores — FTA and NCA, each on a scale of 1 to 6 — and a binary NVCA flag indicating elevated risk of violent reoffending. The PSA does not use race, gender, employment status, level of education, or history of substance use.
That design reflects a deliberate effort to exclude variables that critics of earlier tools identified as proxies for poverty or racial disadvantage. The algorithm is publicly available. The factor weightings are published. This is not COMPAS.
The PSA has been implemented in more than 50 jurisdictions across the country, including New Jersey statewide, Kentucky statewide, and numerous county systems. As the previous chapter established in the context of COMPAS, the reader already understands the legal framework for criminal justice AI under both the EU AI Act and the US Constitution. This chapter applies that framework to the PSA’s specific design and the specific legal problems it creates.
II. The constitutional and statutory framework for pretrial liberty
U.S. Constitution, Amendment VIII Bail Reform Act of 1984, 18 U.S.C. § 3142
The constitutional baseline is the Eighth Amendment to the US Constitution, which provides that excessive bail shall not be required. The prohibition on excessive bail is not merely a fiscal constraint. It reflects the constitutional principle that pretrial detention is a severe liberty deprivation imposed on a person who remains presumed innocent and should be the exception, not the default.
At the federal statutory level, the Bail Reform Act of 1984, codified at 18 U.S.C. § 3142, directs that a judicial officer must order pretrial release on personal recognizance or unsecured bond unless release will not reasonably assure the appearance of the person or will endanger the safety of any other person or the community. Where conditions are imposed, the statute requires the least restrictive further condition, or combination of conditions, that will reasonably assure appearance and safety. The standard is individualized: what conditions are least restrictive for this defendant, given this defendant’s circumstances, in this case?
The PSA does not replace those legal standards. Its intended function is to provide the judge with structured, data-driven information relevant to the individualized determination the statute requires. The legal problem arises when the recommendation generated by the tool begins to function as the standard itself — when the judge’s individualized determination becomes a response to the score rather than an independent assessment that the score merely informs.
III. The automation bias problem — documented in the PSA’s own research
DeMichele et al., “What Do Criminal Justice Professionals Think About Risk Assessment at Pretrial?”, Arnold Ventures (April 2018)
Unlike the opacity problem in COMPAS, the central legal challenge to PSA use is automation bias: the documented tendency of human decision-makers to defer to a structured algorithmic recommendation even when the underlying legal standard requires independent individualized judgment.
The PSA’s own research literature documents this directly. A 2018 survey by DeMichele and colleagues, commissioned as part of the PSA research program, found that 79 percent of judges surveyed reported that the PSA “always” or “often” informs their decision-making. A separate study in Virginia examining a structured decision-making framework combined with a risk assessment tool found that pretrial officers followed the framework’s recommendation 80 percent of the time, and that judges released defendants at first appearance nearly twice as often when release was recommended by the pretrial officer using the framework.
Those findings reflect the tool operating as intended — increased consistency, reduced reliance on cash bail, more structured decision-making. But they also document the gravitational force the recommendation exerts on judicial discretion. When 79 percent of judges report the PSA “always” or “often” informs their decisions, the practical question is whether the remaining decisional space constitutes meaningful individualized judgment or whether the score has become the effective standard from which departure requires justification.
That question is the constitutional issue. The Eighth Amendment and the Bail Reform Act of 1984 require that the least restrictive conditions be determined for each defendant individually. A score is a probabilistic estimate derived from population patterns — not a determination about this defendant’s actual likelihood of appearance or reoffending. A judicial decision that amounts to deference to the score without independent reasoning is not the individualized determination the law requires.
IV. Why transparency does not resolve the legal problem
The PSA’s transparency is a genuine legal distinction from COMPAS. Because the algorithm is public and the factor weightings are known, a defense lawyer can, in principle, examine exactly how the score was calculated. That distinguishes it from the trade-secret opacity that made State v. Loomis, 881 N.W.2d 749 (Wis. 2016), such a difficult due process case.
But transparency of the algorithm does not resolve three legal problems that remain.
First, transparency of the methodology does not guarantee accuracy of the inputs. The PSA is calculated from administrative criminal history records, and those records can be wrong — a dismissed charge still coded as a conviction, a juvenile event improperly included, a prior failure to appear entered against the wrong person through a database error. A transparent algorithm applied to inaccurate inputs produces a wrong score whose methodology the defendant can read but whose factual basis remains contestable.
Second, transparency of the algorithm does not address the structural disparities embedded in the data on which it was trained. The PSA’s nine factors are drawn from prior arrest, conviction, and failure-to-appear history. Those records are themselves products of prior policing and prosecution decisions that were not racially or socioeconomically neutral. A model trained on that history, even if it excludes race and gender explicitly, may still reproduce structural disparities through factors that correlate with race and socioeconomic status — prior arrest history, prior incarceration, geographic patterns of enforcement. Arnold Ventures’ own research acknowledges that studies have not isolated the PSA’s independent impact on racially disparate outcomes from the impact of other pretrial reform measures implemented alongside it, meaning that the racial equity claim rests on an incomplete evidential foundation.
Third, transparency of the algorithm does not guarantee that the validation performed in one jurisdiction is adequate for use in another. Arnold Ventures recommends that jurisdictions validate the PSA locally before use or within one year of implementation. Where that validation has not been performed or is out of date, the tool is being used as though it were validated for the current population when it may not be.
V. Rectification: attack the inputs, not the formula
Privacy Act of 1974, 5 U.S.C. § 552a — U.S. Constitution, Amendment V Mathews v. Eldridge, 424 U.S. 319 (1976)
As established in Chapter 22, rectification of the factual record is often the most effective short-term strategy in algorithmic criminal justice cases. The PSA’s narrow, administrative-data-driven design makes that strategy particularly applicable.
Because the PSA is calculated from nine identifiable factors drawn from administrative records, every one of those factors is a potential litigation target. The defense lawyer should obtain the PSA worksheet or scoring record immediately — in the first hearing if possible — and verify each input against the underlying source record. Common error patterns include: a dismissed arrest still coded as a conviction-equivalent input; a charge miscoded as violent when the actual offense was not; a prior failure to appear that resulted from documented notice failure rather than willful evasion; a juvenile event improperly included in the adult criminal history; and identity database errors that attribute another person’s record to the client.
Under the Mathews v. Eldridge framework from Chapter 12, applied here through the Fifth Amendment’s due process guarantee, the risk of erroneous deprivation at the pretrial stage is significant — the private interest is liberty, the consequence of error is detention pending trial, and a factual error in a PSA input is correctable if identified promptly. The value of the additional safeguard — access to the PSA worksheet and an opportunity to correct factual errors before the bail hearing concludes — is high relative to the government’s administrative burden. That analysis supports a procedural due process argument for disclosure of the PSA scoring record as a matter of right.
The time dimension matters acutely in pretrial practice. A PSA score is often generated in the hours between arrest and the first bail hearing. A defense lawyer who does not have the worksheet at the hearing cannot challenge the inputs. And once a detention order issues based on a flawed score, the practical burden of correction multiplies.
VI. Framing the argument for the judge
The PSA is a reform tool and is presented as such. Defense counsel should not argue that pretrial risk assessment is inherently unlawful. Courts will not accept that framing, and the research literature does not support it. What courts can accept — and what the legal framework requires — is that the PSA’s output does not substitute for the individualized judgment the Eighth Amendment and the Bail Reform Act of 1984 demand.
The argument has three components. First: the PSA score is a probabilistic estimate based on population patterns, not a determination about this defendant. The tool’s own documentation acknowledges that it estimates likelihoods — it does not determine individual outcomes. Second: the Bail Reform Act of 1984, 18 U.S.C. § 3142, requires the least restrictive conditions for this defendant, not the conditions that statistical models associate with defendants with similar histories. Third: where the inputs are inaccurate, the score is unreliable for any purpose, including as a starting point for judicial reasoning.
Those three points, combined with a specific factual challenge to any input that can be shown to be wrong, produce an argument that is legally grounded, factually concrete, and resistant to the objection that the defense is simply opposing algorithmic tools in principle.
VII. The EU AI Act framework
EU AI Act, Regulation (EU) 2024/1689, Annex III, Articles 9, 10, 13, and 14
As established in Chapter 24, under Annex III of Regulation (EU) 2024/1689, AI systems used in criminal proceedings for individual risk assessment and profiling are classified as high-risk. The PSA would fall within that classification, triggering the full compliance architecture: risk management under Article 9, data governance under Article 10, transparency for deployers under Article 13, and effective human oversight under Article 14.
The Article 14 effective human oversight requirement is particularly relevant to the automation bias problem documented above. An oversight mechanism in which 79 percent of judges report that the tool “always” or “often” informs their decisions — without documented independent reasoning for each case — may satisfy the formal requirement that a human signs the detention order while not satisfying the substantive requirement that the human decision-maker exercise meaningful independent judgment. Effective oversight under Article 14 of the EU AI Act means the capacity to understand the system’s limitations and to disregard or override the output where appropriate. A judge who lacks the training to distinguish a PSA score from an individual prediction, or who treats agreement with the recommendation as the path of least resistance, is not exercising oversight in the Article 14 sense.
Next: Chapter 27 — Clearview AI: when facial recognition convicts the innocent.
Leave a Reply