Direct answer
When a temporary restriction begins, record its reason, scope, case owner, decision owner and timetable: receipt, first substantive action, meaningful update, target resolution, maximum interim period and escalation dates. Every pending update must show real progress and the next action. Consider safe partial service, human review or protection of the person's position or rights. If there is no progress, the clock does not restart; escalation and a reasoned decision begin. If waiting has the same practical effect as refusal, treat it as a concealed or de facto refusal.
In plain language
A repair shop cannot keep your property for months by saying only 'under review'. It should give you a case number, responsible person, work performed, next date and the person who will decide if the problem remains unresolved. If keeping the item means you never get it back, an explicit decision is required.
Why this matters
Indefinite delay may allow an organisation to impose the effect of refusal without giving reasons or a route for challenge. Loss of service, missed opportunities and the burden on the person grow over time.
Do not confuse
- Legitimate waiting is an interim state with an owner, progress, communication and decision route.
- Stagnant waiting is a case with no substantive progress within the defined period.
- An indefinite restriction has no end condition, maximum duration or mandatory escalation.
- A concealed refusal produces the continuing effect of refusal without an explicit refusal decision.
- A meaningful update states the work done, obstacle and next date—not merely 'under review'.
What should you do?
- At the start, record the restriction's reason, scope, case owner, decision owner and effect on the person.
- Set dates for receipt, first substantive action, update, target resolution, maximum interim period and escalation.
- In every update, state the real work completed, obstacle, owner, next action and date.
- Provide safe partial service, a manual route, human review and protection of queue position or rights where possible.
- Limit an extension through the specified remaining work, a new date, total elapsed time, impact and authorised approval.
- Do not reset the original case age through transfer, closure and reopening, or repeated document requests.
- At the maximum period, trigger escalation, a formal reasoned decision, challenge rights and any appropriate remedy.
How do you audit it?
- Does every pending case have a reason, owner, next action and date?
- Is there real substantive progress, or only a general status message?
- Are a maximum interim period and mandatory escalation defined?
- Were extensions chained in a way that hides the total age?
- Did transfer or reopening reset the original case clock?
- Were denial of service, burden on the person and safe alternatives assessed?
- Did waiting become a refusal in practice without a reasoned decision and challenge route?
Limit
Exact response deadlines and the consequences of concealed or constructive refusal vary by jurisdiction, sector, contract, transaction and decision type. NOMOS GEO does not set one universal number of days; it proposes governance gates that prevent a temporary measure from becoming ownerless and unlimited.
Remember in one sentence
Waiting must lead to progress, protection, escalation or a decision; it cannot permanently replace deciding.
Sources for this record
- S38NIST AI 600-1, *Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile*Voluntary standards-oriented institutional guidance
- S44NIST, *AI Risk Management Framework Playbook* and AI RMF CoreVoluntary implementation guidance
- S48European Union, Regulation (EU) 2016/679 — *General Data Protection Regulation*Legislation
- S49Turkish Personal Data Protection Authority, *Personal Data Protection Law No. 6698*Official authority and legislation
- S50NIST AI 100-1, *Artificial Intelligence Risk Management Framework (AI RMF 1.0)*Voluntary standards-oriented institutional framework
- S61Council of Europe, *Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law* (CETS No. 225)International convention and official institution
- S62European Data Protection Board, *Guidelines on Automated Individual Decision-Making and Profiling for the Purposes of Regulation 2016/679*Official board guidance
- S64Turkish Personal Data Protection Authority, *Regulation on the Deletion, Destruction or Anonymisation of Personal Data*Official authority and legislation

