Automated Decisions and GDPR: Human Checks

Automated decisions and GDPR meet at a single article of the regulation, and it matters to anyone who uses AI to score, rank, approve or reject people. Article 22 gives individuals a right not to be subject to a decision based solely on automated processing when that decision has legal effects or similarly significant effects on them. A loan refused by an algorithm, an application filtered out by a ranking system or an account closed by a risk score can all raise the question.

This guide explains in plain words what Article 22 says, when it applies, what the exceptions are, what a real human check must involve, what you must tell the people affected and how the rules fit with the EU AI Act and data protection impact assessments. It is written for small businesses, team leads and anyone who buys or builds AI tools. It is general information, not legal advice, and you should confirm your own position with a qualified lawyer or your data protection officer.

What GDPR says about automated decisions

The text of the General Data Protection Regulation deals with this in Article 22, which you can read in full on a public copy of Article 22. In simple terms it sets a default: a person has the right not to be subject to a decision that is based solely on automated processing, including profiling, if the decision produces legal effects concerning them or similarly significantly affects them.

Three conditions must be present together for the right to apply.

A decision. Something is decided about a person, not merely a suggestion or an analysis.
Solely automated. No meaningful human involvement in reaching it.
Legal or similarly significant effect. The outcome affects the person’s rights, status or circumstances in a serious way, such as access to credit, a job, a service or a benefit.

If one of these is missing, Article 22 does not apply in the same way, although other parts of the GDPR still do, including lawfulness, fairness, transparency and data minimisation.

Everyday examples

The table shows how the three conditions play out in typical situations. The answers depend on the facts, so treat them as illustrations, not rulings.

Situation	Automated?	Significant effect?	Article 22 likely relevant?
A shop suggests products based on past purchases	Yes	Usually no	Usually not
An online lender approves or refuses a loan instantly	Yes	Yes	Yes
A tool ranks candidates and a recruiter reads every profile before deciding	Partly	Yes	Depends on how real the human review is
A system automatically rejects applicants below a score	Yes	Yes	Yes
An insurer sets a price using a risk model with no human review	Yes	Often yes	Often yes
An assistant drafts a reply that an agent edits and sends	No	No	No
A fraud system blocks an account and cannot be reviewed by staff	Yes	Often yes	Often yes

Courts have also looked at the border cases. In a 2023 ruling about credit scoring, the Court of Justice of the European Union held that producing a score can itself count as an automated decision when a lender relies on it heavily to decide whether to grant credit. The lesson is that the label “recommendation” does not protect you if humans in practice follow the system’s output.

The exceptions

Article 22 does not forbid all automated decision-making. It allows it in three cases, each with conditions.

Necessary for a contract. The decision is necessary to enter into or perform a contract with the person. “Necessary” is read strictly, and convenience is not enough.
Authorised by law. European Union or national law allows it and provides suitable safeguards for the person’s rights and interests.
Explicit consent. The person has given explicit consent, which must be informed, specific and freely given.

Where the first or third exception is used, the organisation must put suitable safeguards in place, at minimum the right to obtain human intervention, to express a point of view and to contest the decision. The regulation also restricts automated decisions based on special categories of data, such as health, ethnic origin or religious belief, to narrow cases with specific protections.

What a real human check means

Many organisations believe they are safe because a person clicks “approve”. Regulators look at what the person actually does. A review counts only if it is meaningful.

Authority. The reviewer can change the outcome and is not discouraged from doing so.
Competence. The reviewer understands the data, the system and its limits.
Information. The reviewer sees the underlying facts and the reasons, not only a score or a colour.
Time. The workload leaves room for real consideration, not a few seconds per case.
Independence. The reviewer does not simply follow the system’s recommendation in nearly every case.

A rubber stamp does not turn an automated decision into a human one. If the reviewer overrides the system in almost no cases, that is a signal to examine the process. Keep records of reviews and overrides, because they help show that the check is real. A person can also drift into following a machine out of habit, an effect our article on AI sycophancy describes from the assistant’s side.

What you must tell people

Transparency is the other half. When a controller uses automated decision-making of the kind Article 22 covers, the GDPR requires that people receive meaningful information about the logic involved and about the significance and expected consequences of the processing. This appears in the information duties and in the right of access. It does not require handing over source code or trade secrets, but it does require an explanation that a person can understand.

Say that it happens. Tell people in your privacy notice and at the moment of the decision that automated decision-making is used.
Explain the logic in plain words. Name the main factors, how they are weighed and what data they come from.
State the consequences. Explain what the decision means for the person, such as refusal of a service.
Offer a route to a human. Provide a simple way to ask for review, give their view and contest the result.

An assistant can help draft this wording, but you must provide the facts about how your system actually works. Our guides to AI disclosure to customers and answering data subject access requests with AI cover related writing tasks.

Profiling, bias and fairness

Automated decisions often rest on profiling, which means evaluating personal aspects such as reliability, behaviour or economic situation. Profiling raises fairness issues even when no single decision is solely automated. A model trained on historical data can repeat past discrimination, and proxies such as postcode can stand in for protected characteristics. Test results across groups, document the data you used and review the model when conditions change. Our article on AI bias explains how bias arises and how to look for it.

How it fits with DPIAs and the EU AI Act

Article 22 is not alone. The GDPR requires a data protection impact assessment when processing is likely to result in a high risk, and its text names systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. If your use falls there, do the assessment before you start. Our guide to a DPIA for AI tools shows the steps.

The EU AI Act adds a separate layer. It classes certain uses, such as systems used in recruitment, in assessing creditworthiness or in access to essential services, as high risk, and it sets requirements for risk management, data quality, documentation, human oversight and transparency. It also gives affected people a right to an explanation of decisions made with the help of certain high-risk systems. The two laws overlap but are not the same, and compliance with one does not automatically satisfy the other.

A practical checklist for small organisations

List your decisions. Write down every decision about people that uses software, scoring or AI.
Classify each one. Is it solely automated, and does it have a legal or similarly significant effect?
Choose a lawful route. If Article 22 applies, identify the exception you rely on and record why.
Design the human check. Define who reviews, with what authority, information and time.
Write the notices. Update the privacy notice and the message at the moment of decision.
Build the appeal route. Give people a simple way to contest and a deadline for your answer.
Assess and monitor. Run a DPIA where needed, test for bias and track overrides and complaints.
Review vendors. Ask suppliers how their tools work, what data they use and what documentation they provide.

Our guide to a small business AI risk assessment offers a simple format for steps one and two, and the article on EU-hosted AI and GDPR explains related questions about where and how data is processed.

Using Mio to prepare, not to decide

Mio is one assistant with Chat, Write, Research, Code and Design modes, and you never pick a model: Mio routes each request to one suited to the task. For this topic it is a drafting and thinking aid. In Chat mode you can walk through your own decisions and ask which of the three conditions applies. In Write mode you can draft plain-language notices and appeal messages from the facts you provide. On paid plans, Research mode searches the web and cites sources, so you can read the official text of the regulation and guidance from data protection authorities yourself.

Mio does not make legal determinations, and it should not decide who gets a loan, a job or a service. Keep personal data of real individuals out of your chats where you can, and use examples with invented names. Your chats and files remain yours, they are not used to train models and you can export or delete them at any time.

Frequently Asked Questions

What is Article 22 of the GDPR in simple terms?

It says people have the right not to be subject to a decision based solely on automated processing, including profiling, when the decision has legal effects or similarly significantly affects them. There are exceptions for contracts, authorising law and explicit consent, and then safeguards such as human intervention and the right to contest must apply.

Does it apply if a person approves the decision?

Only a meaningful human review takes a decision out of the solely automated category. If the person has no real authority, lacks the information or simply confirms the system’s output in nearly every case, regulators may treat the decision as automated. Design the review so that the reviewer can and does change outcomes.

Do chatbots and AI assistants fall under Article 22?

Not by themselves. An assistant that drafts text, answers questions or suggests options usually does not take decisions with legal or similar effects. The rule becomes relevant when a system’s output is used to decide something important about a person, such as access to a job, credit or a service, without meaningful human involvement.

What must I tell people about automated decisions?

You must tell them that automated decision-making takes place, give meaningful information about the logic involved and explain the significance and expected consequences for them. You also need to describe how they can ask for human intervention, give their view and contest the decision. Use plain language and give real examples of the main factors.

Is this the same as the EU AI Act?

No. The GDPR protects personal data and sets rights around automated decisions about individuals. The AI Act regulates AI systems by risk level and sets duties for providers and deployers, with specific rules for high-risk uses. They overlap, for example on human oversight and explanation, and an organisation may need to comply with both.

The Bottom Line

Automated decisions and GDPR come down to one question: does a system decide something important about a person without a meaningful human check? If it does, you need a lawful exception, safeguards, clear information and a way to contest. Map your decisions, make human review real, and use an assistant to draft notices and test your thinking, not to decide for you. To try it on your own checklist, start on the free plan and compare options on the Ask Mio pricing page.

Automated Decisions and GDPR: When AI Needs a Human Check