Desmond Achterberg ran the data analytics shop at a state Department of Revenue, and for most of his career the word "algorithm" meant a SQL query somebody wrote in 2011. Then three different vendors arrived in the same fiscal quarter, each pitching an "AI solution," and each describing something that behaved nothing like the others. One promised to flag fraudulent returns by learning from past audits. One promised to "discover hidden taxpayer segments" nobody had defined. One promised a system that would "learn the best collection strategy over time by trying things and seeing what works." Desmond realized he could not govern, test, or even budget for these tools until he could tell them apart. They were not three flavors of the same thing. They were three fundamentally different ways a machine can learn, and each carried its own risks, its own evidence requirements, and its own failure modes.

This lesson gives you the vocabulary Desmond needed. Machine learning, the branch of artificial intelligence (AI) where systems improve from data rather than from hand-written rules, comes in three main paradigms: supervised learning, unsupervised learning, and reinforcement learning. By the end, you will be able to look at any government AI proposal and name which paradigm is at work and what that means for how you oversee it.

Why the Paradigm Is a Governance Question

Government agencies use all three paradigms, often inside the same portfolio. A benefits eligibility system might use supervised learning, because the model was trained on historical cases. A customer service chatbot might use unsupervised learning to cluster similar questions together. A procurement system might use reinforcement learning to optimize bidding strategies or resource allocation. Nothing on the outside of these systems announces which is which, and the vendor's marketing language is frequently the same regardless.

The problem is that the three have radically different risk profiles, testing requirements, and governance implications. Govern a reinforcement learning system with the framework designed for supervised learning and you will miss critical failure modes. Fail to understand why unsupervised learning sometimes produces clusters that do not match your business logic and you will have no answer when auditors ask why the system flagged legitimate applications as outliers. Naming the paradigm is not a technical nicety; it is the step that determines what evidence you are entitled to demand and what failures you should be looking for.

Supervised Learning: Learning From Labeled Examples

Supervised learning is the most common paradigm in government, and the easiest to grasp. You start with historical data where the correct answer is already known, and you train a system to predict that answer for new cases it has never seen.

The training data comes in pairs: an input and the correct label. For fraud detection, that pair is (the features of a tax return, the verdict fraud or legitimate). For benefits eligibility, it is (the applicant's data, the decision eligible or ineligible). For medical diagnosis, it is (patient symptoms and test results, diagnosis or no diagnosis). The algorithm learns the patterns that correlate with the answer, adjusting its internal parameters to minimize the error between its predictions and the actual labels. Once trained, you present it with new inputs it has not seen, and it predicts a label.

The first vendor at Desmond's agency was selling supervised learning. The training data would be tens of thousands of past returns that auditors had already classified. The model would learn which combinations of features, a particular deduction paired with a particular income band, say, correlate with confirmed fraud. It would not deliver certainty; it would deliver a probability score that ranks returns for human auditors to examine. In a typical year, Desmond's auditors could review only about 4 percent of flagged returns by hand. A model that pushes the genuinely suspicious returns toward the top of that 4 percent is worth real money.

The same pattern appears at the federal level: the IRS uses supervised learning to flag suspicious tax returns for review, training on historical filings where auditors had already determined fraud or no fraud, and the model learns which patterns correlate with fraud. It is not perfect and it is not meant to be; it is probabilistic, and its job is to route returns to human auditors, saving thousands of human hours annually.

When supervised learning fits: you have a clear, specific outcome you want to predict; you have historical data that domain experts have already labeled; and the relationship between inputs and outcomes is reasonably stable over time. Tax-fraud patterns shift, but not overnight.

The risks you must govern: a supervised model can only recognize what appeared in its training data. When fraud techniques evolve, a new deduction scheme the historical data never contained, accuracy quietly decays. Worse, if the training data carries bias, the model learns and repeats it. If past audits disproportionately scrutinized filers from certain ZIP codes, the model treats "from that ZIP code" as a fraud signal, laundering a historical pattern into an automated one. This is why supervised systems serving rights-impacting decisions require fairness testing broken out by demographic group, not just an overall accuracy number.

The bias problem has a nasty property that catches experienced teams: the model performs well on the test data precisely because the test data carries the same bias, so the evaluation confirms the error rather than exposing it. The starkest illustration is a criminal risk assessment system trained on historical sentencing data. It learns the patterns correlated with recorded recidivism, but if that history comes from an era of racially discriminatory policing and sentencing, the patterns it learns are those of the discrimination, and it then applies them to new defendants and perpetuates the injustice with a clean accuracy score attached. The question to ask about any labeled dataset is not "how accurate is it" but "who made these labels, under what pressures, and would they make the same ones today?"

Unsupervised Learning: Finding Patterns Without Labels

Unsupervised learning is different in kind. There are no labels. You are not predicting a known outcome. You are exploring: what natural groupings or structures exist in this data that nobody told the system to look for?

Two techniques dominate. Clustering groups similar records together, and it is the one you will meet most often. Dimensionality reduction takes high-dimensional data and simplifies it while preserving the most important variation, which is how a table with hundreds of columns becomes something a human can look at. The second vendor at Desmond's agency was selling clustering. The pitch was to take all registered businesses and let the algorithm discover natural segments based on filing behavior, payment timing, industry codes, and size. Nobody would pre-define the segments; the algorithm would surface them.

Consider a parallel case. A state labor department wants to understand the real skill profiles of unemployed workers. It holds descriptions of prior jobs, education levels, completed training programs, geographic location, and ages, but it has no pre-defined taxonomy of "skill groups." An unsupervised algorithm clusters the workers and discovers roughly five to seven natural groupings: recent high school graduates with some vocational training, concentrated in urban areas; mid-career workers displaced from manufacturing; workers with advanced degrees seeking specialized roles; and so on. Nobody hypothesized these groups in advance; the algorithm found them in the data.

The department can now design retraining programs tailored to each cluster. It might conclude that the displaced manufacturing group would benefit from a six-month cloud computing bootcamp, while the recent-graduate group would benefit more from apprenticeship programs. That is actionable knowledge produced without a predetermined hypothesis, and it is exactly what unsupervised learning is good for: questioning how things are organized rather than forecasting a specific outcome.

When unsupervised learning fits: you have data but no ground-truth labels, and you want discovery rather than prediction.

The risks you must govern: unsupervised methods readily find patterns that are statistically real but meaningless. Cluster on geographic coordinates and you get groups defined by latitude and longitude: technically correct, operationally useless. Validation is also harder. With supervised learning you can test accuracy on new labeled data; with unsupervised learning there is often no objective right answer, different clustering algorithms may find different groupings, and which one is "correct" is not obvious. Most importantly for government, clusters can quietly correlate with protected characteristics like race or national origin even though race was never an input. Because the algorithm was never given race as a label, it can take deep investigation to discover that a "business behavior" segment is in practice an ethnic-ownership segment. Unsupervised output that drives any consequential action needs that disparate-impact check before, not after, it is used.

Two shapes of failure recur often enough to name. The first is the useless-but-correct cluster: a clustering of job applicants that separates them by geography rather than skill level, or a clustering of regulatory violations that groups by reporting agency rather than by violation severity. The algorithm is mathematically right and operationally worthless. The second is worse because it looks useful. A city clusters neighborhood data on crime, housing prices, income, density and school ratings; staff read the output as "types of neighborhood" and propose different service levels for each; but the algorithm has actually clustered primarily by income and race, because those variables carry the highest variance in the data. The differential service proposal is then, inadvertently, based on race, and nothing in the model's specification says so.

Reinforcement Learning: Learning Through Reward

Reinforcement learning is the paradigm most people have never knowingly encountered, and the one Desmond's third vendor was selling. Here an agent learns by interacting with an environment rather than from a fixed dataset. It takes an action, observes the outcome, receives a reward signal that is positive for good outcomes and negative for bad ones, and adjusts its strategy to maximize long-term reward. Over many iterations it learns a policy: a strategy that maximizes expected future rewards.

The classic example is AlphaGo, the system that learned to play Go by playing millions of games against itself. Each game produced a reward signal, win or lose, and the system adjusted its strategy after each one until the learned policy was good enough to beat world champions. Robotics controllers that learn to walk by falling repeatedly work the same way. In government, reinforcement learning shows up in resource-optimization problems: how to schedule inspections, route maintenance crews, or, as the third vendor proposed, sequence collection actions on delinquent accounts to maximize recovered revenue.

A second government pattern is worth seeing because it shows how the reward gets defined. An agency oversees environmental permit applications, which are complex: applicants propose projects, and the agency must weigh environmental impact, public health implications, economic benefits, and regulatory compliance. An agency could set up a reinforcement learning system in which the agent proposes a decision on each application, approve, reject, or request more information; the system receives a penalty when a decision later proves problematic, whether an approved project causes unforeseen environmental damage or a rejected project would have brought jobs with no downside; and the system gradually learns which decision-making patterns minimize long-term regret.

That collections pitch is exactly where Desmond should have stopped the meeting. Reinforcement learning optimizes whatever reward you define, and only that reward. Define the reward as "dollars recovered" and the system will, with perfect logic, learn to pursue the most aggressive lawful collection action on the most vulnerable taxpayers, because that is where the reward gradient points. It has no concept of hardship, proportionality, or public trust unless those constraints are built explicitly into the reward and the allowed actions. A reinforcement learning system pursuing a narrow objective in a high-stakes public setting is a governance problem before it is a technology problem.

When reinforcement learning fits: sequential decision problems with delayed rewards, where the environment is complex and changes over time, where you want to optimize long-term outcomes rather than predict immediate ones, and, critically, where you can let the system explore safely without harming real people during learning. Simulations and digital twins matter here, because a system that learns by "trying things" must not try them live on citizens.

The risks you must govern: reward misspecification, where the system optimizes the literal reward rather than your intent; unsafe exploration, where learning by trial and error happens against real people; and opacity, since reinforcement learning systems are black boxes even more than supervised ones and understanding a particular decision means examining a learned policy that is often uninterpretable to an auditor, a judge, or an affected citizen. Reinforcement learning in rights-impacting or safety-impacting contexts demands the strictest oversight of the three paradigms.

Reward misspecification is easier to produce than to imagine, because a manager naturally defines a single metric, speed, cost or throughput, and hopes the system will also respect equity, legality and public welfare. It will not. A hiring recommendation system rewarded for candidates interviewed per hour learns to recommend the shortest interviews and skip depth. A content moderation system rewarded for posts reviewed per hour learns to auto-approve everything, because approving is fast. A budget allocation system for social services rewarded for minimum cost per person served learns to concentrate resources on the easiest-to-serve population and to minimize services to people with complex needs, who cost more and who probably need the support most. In each case the system is working perfectly. The specification was the failure.

When the Paradigm Changes Underneath You

The most avoidable governance failure in this area is not choosing the wrong paradigm; it is losing track of which one you have. Vendors sometimes obscure the design, and teams often cannot see the boundary between paradigms from the outside. The pattern goes like this. A system starts as supervised learning, predicting case outcomes from historical data, and is validated accordingly. The vendor later adds reinforcement learning components to optimize caseload assignment. The agency keeps running the supervised test plan, which keeps passing, and nobody notices that a static predictor has become a learning agent whose strategy shifts with observed outcomes.

The defences are contractual and procedural rather than technical. Require vendors to explicitly document which paradigm or paradigms the system uses, at component level rather than for the product as a whole. Write into the contract that significant algorithmic changes require prior notification and re-validation. Make sure the people running your governance reviews understand what each paradigm implies for what they should be checking. And verify periodically that the system is still using the paradigm you believe it is using, because that belief has an expiry date nobody will send you a reminder about.

Three Worked Government Scenarios

Fraud detection in federal benefits (supervised). The Social Security Administration processes millions of claims annually, and some applicants misreport income, assets, or family status to claim benefits they do not qualify for. SSA trains a supervised model on historical cases where fraud investigators already determined whether fraud occurred, using features including reported income, assets, employment history, changes in reported data, and flags from previous investigations. The model learns patterns such as low reported income alongside large asset purchases, or a history of small benefit discrepancies. In operation, a new application produces a fraud probability score, and applications above the threshold are flagged for human investigation before benefits are disbursed. The governance challenge is that the model must not discriminate by protected class: if historical investigators biased their investigations toward certain racial or ethnic groups, the model learns that bias, and auditors need to verify that predictions rest on legitimate fraud indicators rather than demographic proxies.

Disease surveillance clustering (unsupervised). A national public health agency receives symptom reports from clinics and hospitals. During a respiratory illness outbreak, staff are overwhelmed and need to identify clusters of similar cases that might share a common cause: a contaminated water system, a product, a location. An unsupervised clustering algorithm takes reported symptoms, geographic location, age, and timing of illness onset, without being told what constitutes a cluster. It surfaces a geographic cluster in a specific county tied to a retail supplier, a demographic cluster among younger patients that might indicate a novel strain spreading in denser areas, and a temporal cluster suggesting two waves of the same disease. Officials examine those clusters. The algorithm cannot tell them causation; it narrows the investigative space. The governance challenge is that the algorithm may cluster by protected characteristics whenever those correlate with the features it was given, such as neighborhood socioeconomic status, so analysts must check whether the clusters reflect public health logic or data collection bias.

Dynamic emergency response optimization (reinforcement). A city's emergency management agency wants to deploy first responders to minimize response times while ensuring equitable coverage. A reinforcement learning system takes the current state, meaning available responders per zone, current incidents, time of day and weather, and proposes a deployment strategy. The reward signal combines average response time, equity in the sense of similar service levels across neighborhoods, and cost efficiency. The system learns policies such as pre-positioning more responders in school zones during the 2-4 PM dismissal traffic, or moving responders closer to highways when weather worsens and accidents become more likely. Human incident commanders make the final calls, informed by the recommendations. Two governance challenges follow. If equity is not explicitly weighted in the reward, the system optimizes purely for speed, concentrating resources in easy-to-serve areas and neglecting harder-to-reach neighborhoods, so the reward signal must be transparent and publicly defensible. And because outcomes are delayed, you do not know whether a deployment decision was good until accident statistics accumulate days later, which makes validating the system genuinely hard.

Why the Distinction Governs Everything

The reason this taxonomy is the foundation of everything else, as Desmond came to see, is that the three paradigms carry radically different oversight needs:

• Evidence of correctness. Supervised systems can be tested against a held-out labeled set, producing clean accuracy and fairness numbers. Unsupervised systems often have no objective right answer, so validation relies on human judgment about whether the discovered structure is meaningful. Reinforcement systems must be validated in simulation before live deployment, because their behavior emerges over time.
• Data requirements. Supervised learning needs labeled data, which is expensive to produce and easy to bias. Unsupervised learning needs only raw data but produces results that are harder to interpret. Reinforcement learning needs a safe environment to explore and a carefully designed reward.
• Failure modes. Supervised models fail by replicating historical bias and degrading as the world drifts from the training data. Unsupervised models fail by surfacing spurious or discriminatory patterns. Reinforcement models fail by ruthlessly optimizing a poorly chosen objective.
• The audit question that matters. Supervised learning needs label audits. Unsupervised learning needs validation that the discovered structure is meaningful. Reinforcement learning needs reward signal audits. Ask the wrong one and a clean review tells you nothing.

Apply the governance framework built for one paradigm to another and you will miss the failure modes that matter. Treat the reinforcement learning collections system like a supervised classifier and you will test it for accuracy while ignoring the only question that mattered: what behavior does this reward actually produce?

Desmond's eventual decision memo named the paradigm for each of the three proposals on its first line, and tied each to a tailored oversight plan: fairness testing and drift monitoring for the supervised fraud model; a disparate-impact review and human interpretation step for the unsupervised segmentation; and a hard "simulation-only, no live citizen exposure" gate for the reinforcement learning collections tool, which the agency ultimately declined to pilot. Naming the paradigm was not academic. It was the act that made each tool governable.

Anti-Patterns

• Supervised learning on thin data or biased labels. Project managers want quick results, so they train on whatever data exists without checking whether the historical labels reflect genuine ground truth or human judgment under pressure. Audit training labels before building, asking whether they reflect ground truth or past decisions that might have been biased. Hold out a test set before training and test frequently. Refresh training data regularly, for example quarterly, so the model adapts to environmental change. And reserve supervised learning for well-defined, stable prediction tasks rather than novel or high-stakes decisions where ground truth is ambiguous.
• Unsupervised learning without validation or interpretation. Teams deploy clustering expecting discovery to be automatic, then are surprised when the output does not match expectations, because the algorithm is agnostic about meaning and will return clusters even when the clustering is arbitrary. Always inspect unsupervised outputs manually and with domain experts. Test whether clusters remain stable when features are added or removed. Use domain knowledge to check that clusters make business sense and not merely statistical sense. Be transparent about which features created the clusters. And if clusters correlate with protected characteristics, investigate why before deploying anything.
• Reinforcement learning with a misaligned reward. A single-metric reward produces a system that is very efficient at the narrow goal and terrible at everything else. Make the reward multi-objective, weighting equity alongside efficiency. Involve domain experts in reward design rather than leaving it to engineers. Test on complex scenarios and edge cases before deployment. Monitor continuously in production. And include hard constraints, rules the system must follow, alongside the learned objective.
• Mixing paradigms without clarity on which applies. Governance, testing and accountability frameworks silently stop matching the actual algorithm, and the blind spot is invisible from inside the passing test report. Require component-level paradigm disclosure, contract terms that make algorithmic changes trigger re-validation, and periodic verification that the running system is the one you validated.
• Treating production monitoring as a safety net. "We will monitor it in production" is the reassurance that most often substitutes for design work. Monitoring reports only on what somebody chose to measure, on the cadence they chose, and a reinforcement learning system whose reward is misspecified will look healthy on every metric derived from that same reward. Decide before launch which unintended consequence you are watching for and which signal would show it, and accept that anything outside that list will reach you as a complaint rather than as an alert.
• Reading a held-out test result as proof of durability. A held-out set answers one question well: how the model performs on data drawn from the same distribution as its training data. It says nothing about the new fraud scheme, the policy change, or the population shift that has not happened yet. Frequent testing detects decay against a fixed yardstick; it does not detect that the yardstick has aged. Pair it with a scheduled re-examination of whether the test set still resembles the world.

Practice Prompts

• Paradigm identification. Look at three AI systems in your agency, or three hypothetical ones if you are new. For each, identify the prediction or learning goal; whether you hold historical labeled outcomes, which suggests supervised; whether you are exploring for hidden patterns with no predetermined outcome, which suggests unsupervised; and whether the system learns through interaction and reward signals, which means reinforcement. Write a one-paragraph description of the paradigm and why it is appropriate, or not, for that use case.
• Risk analysis. Pick one of those systems. Given its paradigm, what validation risk does it face: label bias for supervised, meaningless clusters for unsupervised, reward misalignment for reinforcement? How is that risk currently managed in your agency, and what additional validation would you recommend? Write a short risk assessment naming the paradigm-specific vulnerabilities.
• Historical data audit. If your system uses supervised learning: how were the historical labels generated, by humans, by automated rules, or by a previous system? Is there evidence of bias in the labeling process? How frequently does the world change in ways that make old labels less relevant? Write a brief audit memo on label quality.
• Governance mismatch. Think about how your agency currently governs AI systems. Does the governance framework differentiate between paradigms at all? If a system moved from one paradigm to another, would auditors notice, and through what mechanism? Write a recommendation on how governance should be adjusted to address paradigm-specific risks.
• Multi-objective validation. If your system uses reinforcement learning: what is the explicit reward signal? What other values, equity, speed, accuracy, cost, matter to your agency but might not appear in that reward? How would the system behave if reward and values diverged? Write a brief note on whether the reward is genuinely multi-objective or needs adjustment.

Reflection

Take two minutes and pick one AI system you interact with in your agency, whether you use it, manage it, or merely know it exists. Diagnose it: which paradigm is it, supervised, unsupervised, or reinforcement, and what is your evidence? Notice whether your evidence is documentation you have seen or an assumption you have inherited. Then ask the question that follows from your answer: given that paradigm, what is the single most important validation question for that system, and what would you most need to know before you would be willing to trust its output? Write your answer down; later lessons on testing frameworks build directly on it.

Glossary

• Supervised learning. A paradigm where the model is trained on labeled data, meaning input and output pairs, and learns to predict outputs for new inputs. Ground truth is required.
• Unsupervised learning. A paradigm where the model finds patterns in unlabeled data without being told what structure to look for. No ground truth is required; discovery is the goal.
• Reinforcement learning. A paradigm where an agent learns by taking actions in an environment, receiving reward signals, and adjusting its strategy to maximize long-term cumulative reward.
• Label bias. Systematic bias in the labeled data used to train a supervised model, often reflecting human bias in how historical cases were classified. It causes trained models to perpetuate those biases.
• Clustering. An unsupervised technique that groups similar items together. The algorithm discovers clusters without being told what a cluster is, so the clusters must be validated as meaningful.
• Dimensionality reduction. An unsupervised technique that simplifies high-dimensional data while preserving the most important variation in it.
• Reward signal. The feedback mechanism in reinforcement learning that tells the agent whether an action was good or bad. It must be carefully designed to align with actual goals.
• Policy. The strategy a reinforcement learning agent has learned, mapping situations to actions in a way that maximizes expected future reward.
• Ground truth. The correct answer for a prediction or classification. Supervised learning requires it in training data; unsupervised learning has none, which is what makes validation harder.
• Validation. The process of testing whether a model works correctly on data it has not seen. The methods differ by paradigm: accuracy metrics for supervised, meaningfulness checks for unsupervised, reward alignment checks for reinforcement.

Related Lessons

• How Transformers and LLMs Work zooms in on the specific model family behind the generative AI tools now in wide use.
• Generative AI Deep Dive extends that into what generative systems can and cannot be relied on to do.
• Data Quality and AI Performance follows the thread this lesson opens: the training data determines what any paradigm can achieve.
• Testing and Validating AI Systems supplies the paradigm-appropriate testing methods this lesson argues you need.

Closing

Understanding these three paradigms is foundational because it shapes everything downstream: what data you collect, how you validate, how you ensure fairness, how you explain decisions, and how you handle changing environments. A supervised system that drifts in accuracy needs retraining. An unsupervised system that clusters by protected characteristics needs different features. A reinforcement learning system optimizing the wrong metric needs a redesigned reward. Same toolkit, different answers depending on what is actually happening inside the system.

Recognize too that government AI is increasingly hybrid. You might use supervised learning to classify applications, then unsupervised learning to detect fraud patterns the supervised system missed, then reinforcement learning to optimize case prioritization. Each component carries its own risks and its own evidence requirements. Your job is to know which is which and to ensure each one is governed appropriately, which is precisely why Desmond's memo put the paradigm on the first line rather than in an appendix.

Key Takeaways

• Supervised learning predicts a known outcome from labeled examples. It is the workhorse of government AI and fails by replicating historical bias and drifting as the world changes. Govern it with fairness testing, label audits, and scheduled re-validation.
• Unsupervised learning discovers structure without labels. It is exploratory and powerful, covering clustering and dimensionality reduction, but its patterns can be spurious or quietly discriminatory. Require a disparate-impact check before any cluster drives a consequential action.
• Reinforcement learning optimizes a reward through trial and error. It will pursue whatever you reward, literally. In high-stakes public settings, scrutinize the reward and the allowed actions before anything else, and never let it learn live on citizens.
• Each paradigm has a signature risk. Label bias for supervised, meaningless or biased clusters for unsupervised, misaligned reward for reinforcement. Know the paradigm and you know where to look first.
• The paradigm determines the oversight. Each carries distinct evidence requirements, data needs, and failure modes. Applying the wrong governance model hides the risks that matter.
• Real systems mix paradigms, and vendors change them. Require documented disclosure of which paradigm is doing what, and contract terms that make significant algorithmic changes trigger notification and re-validation.
• Name the paradigm on the first line of every AI proposal. You cannot test, budget for, or oversee a system you cannot classify. The label is the first governance act, not a technicality.

Frequently Asked Questions

How do I tell which paradigm a vendor is actually selling? Ask three questions and listen for the shape of the answer. Where does the training signal come from, a labeled historical dataset, no labels at all, or consequences of the system's own actions? What would you show me as evidence that it works? And does the system's behavior change after deployment without a new release? A vendor who cannot answer the first question crisply is either obscuring the design or does not know it, and both are findings.

Is one paradigm safer than the others? They are unsafe in different directions, so the question is really which failure your setting can least afford. Supervised learning fails quietly and systematically along the lines already present in your historical records. Unsupervised learning fails by handing you a real pattern that means nothing, or a real pattern you are not allowed to act on. Reinforcement learning fails by doing exactly what you asked with more determination than you intended, which is why it carries the heaviest oversight burden in rights-impacting and safety-impacting settings.

Can a system be more than one paradigm at once? Yes, and hybrid systems are increasingly common. The governance risk is not the mixture; it is the mixture nobody documented. When a supervised classifier acquires a reinforcement learning component for prioritization, the old test plan still passes while the new component goes unexamined. Require component-level disclosure so accountability attaches to each part rather than to the product name.

Does unsupervised learning avoid bias, since nobody labels anything? No. It removes the label bias channel and leaves every other one open. Clusters form from whichever features carry the most variance, and in government data that is frequently income, geography, or something else that correlates tightly with protected characteristics. Because race was never an input, the correlation is not visible in the model specification and only appears when someone tests for it deliberately.

Our reinforcement learning vendor says the system learns safely in production. What should I ask? Ask what "safely" bounds. Specifically: what is the set of actions the agent is permitted to take, what happens to a citizen who is on the receiving end of an exploratory action, is there a simulation environment and how faithful is it to reality, and what triggers a halt. A system that learns from consequences is learning from consequences that happened to somebody. That is the whole objection, and a satisfying answer has to describe the containment, not restate the intention.

How often should we recheck the paradigm itself? Whenever the contract renews, whenever the vendor ships a significant model change, and on the same cadence as your other governance reviews. The failure to guard against is quiet substitution: the system you validated is not necessarily the system now running, and no supervised-learning test plan will notice that it is now watching a learning agent.