Automated Decision-Making Under GDPR Article 22

Who this is for

• EU operators (or anyone targeting EU people) whose system takes a decision about a person without a real human step
• Product teams who added an “approve” button and called it oversight
• Readers of AI Flags It, You Confirm who need the EU article, not the argument

Scope: EU GDPR, not the UK rewrite

This page is Article 22 of Regulation (EU) 2016/679 as it applies in the EEA.

The UK replaced Article 22 of the UK GDPR with Articles 22A to 22D from 5 February 2026 (Data (Use and Access) Act 2025, section 80; SI 2026/82). That is the UK ADM regime. Do not quote Article 22 at a UK controller as if it were still the UK text.

What Article 22 actually says

Article 22(1): a person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Article 22(2): paragraph 1 does not apply if the decision is:

• necessary for entering into, or performance of, a contract between the person and the controller; or
• authorised by Union or Member State law which also lays down suitable measures; or
• based on the person's explicit consent.

Article 22(3): in the contract and consent cases, the controller must implement suitable measures, at least the right to obtain human intervention, to express their point of view, and to contest the decision.

Article 22(4): special-category data may not be the basis of such decisions except in the narrow Art. 9(2)(a) or (g) cases, with suitable measures.

The “solely automated” threshold

The decision is solely automated when no person has meaningful involvement in the outcome.

Meaningful, in practice:

• The person sees the material the system used, not only a score.
• They have the authority and time to change the outcome.
• Changing it is a normal path.

A queue of “approve” clicks, with no file and a target of 400 an hour, is still solely automated. Recital 71 of the GDPR points the same way: human intervention, explanation, challenge.

Legal effects: a court order, a contract formed or refused, a benefit granted or withdrawn. Similarly significant: a widely used ICO/EDPB read includes decisions that affect financial circumstances, access to health services, employment opportunities, or other serious consequences. A product recommendation is usually not. A credit refusal usually is. A CV filter that drops a candidate from any human look usually is.

What involvement has to look like

This is guidance, not a statutory checklist. It matches how we design human oversight and how Vista is built (“AI flags it, you confirm”):

1. Name the reviewer. A role mailbox is not a reviewer.
2. Show them the inputs that mattered.
3. Let them refuse, edit, or send back. Log who did what.
4. Size the queue so review is possible.
5. Tell the person, where Art. 22(3) applies, that they can ask for a human and contest the decision, and honour it.

If you cannot staff that, do not ship the automated decision. Slow the system. Article 22 is not fixed by a privacy-notice paragraph.

How this sits next to the AI Act

Article 22 is live now. EU AI Act Article 14 (human oversight for high-risk systems) applies from 2 December 2027 for Annex III systems after Regulation (EU) 2026/1744. You can owe Article 22 today on a credit or hiring decision that will also be high-risk in 2027. Do not wait for the Act date to put a human in the loop.

Classification: Annex III. The argument: AI Flags It, You Confirm.

Questions

Does a human who only checks a sample take us out of Article 22?

Spot checks after the decision has landed do not. The right is about the decision the person is subject to. Review has to be able to change that decision, not a monthly audit.

We have explicit consent in the sign-up flow. Done?

Consent is one of three exceptions, and it must be explicit, informed, and withdrawable. You still need the Art. 22(3) measures. Consent for a credit decision is often the wrong basis because it is not freely given when the alternative is “no service”.

Does this apply to a chatbot that drafts an email a person sends?

Usually no, if the person actually reads and sends. The decision is theirs. If the draft auto-sends, you are closer to solely automated, and you may have an Article 50 AI Act duty as well.

What changed

• 13 August 2026: First publication. Cadence: stable / evergreen (180–365 days). Next review due 13 May 2027. Off-cycle if the EDPB issues new ADM guidelines or the EU GDPR itself is amended.

Note: This is compliance consulting and training, not legal advice. We work alongside your legal counsel, translating regulation into operational reality rather than replacing them. For a structured pass, see AI compliance.