If "some buggy ML classifier" is allowed to make decisions that trigger broad enforcement, that classifier is, for all intents and purposes, a policy maker. The claim made by the article is somewhat broad relative to the evidence presented, but whether policy decisions are automated or not doesn't really matter.