GDPR Article 22 is triggered by two things together: a decision based solely on automated processing, and a legal or similarly significant effect on a person. An AI agent crosses that line when it alone decides something that matters to someone: declining credit, closing an account, refusing a claim. Agents that read or draft usually stay clear.
What does Article 22 cover?
In substance, Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The rule has narrow exceptions, and where they apply, safeguards are required, such as a way for the person to obtain human intervention, express their view and contest the decision. The UK GDPR, read with the Data Protection Act 2018, contains an equivalent rule. Our explainer on what automated decision-making under GDPR is sets out the basics.
The rule is about decisions, not processing in general. An agent can process personal data extensively without engaging Article 22, as long as it is not the sole basis of a significant decision. Other GDPR duties, such as the Article 5 principles and a lawful basis under Article 6, still apply to all of that processing.
What makes a decision "solely" automated?
The absence of meaningful human involvement. A person somewhere in the chain does not automatically take a decision outside Article 22. If the person cannot change the outcome, does not review the substance, or approves whatever the system proposes, the decision may still be solely automated in effect.
This is where agents need careful design. An agent that drafts a decline and a person who approves every draft without reading has not added meaningful involvement. An agent whose held items are cleared in bulk at the end of the day has not either. The test is whether the person has the authority, the information and the time to reach a different conclusion, and whether they actually use it.
What counts as a significant effect?
Legal effects are those that change a person's legal position or rights, such as cancelling a contract or refusing a benefit. Similarly significant effects are those with a comparable impact on someone's circumstances, behaviour or choices, such as refusing credit, denying access to a service or affecting employment. Routine actions, such as answering a question or updating a preference the person asked for, usually do not qualify.
Agents in regulated businesses often sit close to this line. A customer service agent answering balance enquiries is far from it. The same agent waiving a fee is close to it only if refusing would be significant. An agent assessing creditworthiness is squarely within it. Our piece on AI agents and credit decisions looks at that case in detail.
Where do agents typically cross the line?
The combination of depth and effect decides it.
| Agent action | Effect on the person | Human involvement | Article 22 concern |
|---|---|---|---|
| Answers a product question | Minimal | None needed | Low |
| Drafts a credit decline for an underwriter to review | Significant | Underwriter reviews and decides | Low, if review is real |
| Declines a credit application on its own | Significant | None | High |
| Closes an account after a rule is triggered | Significant | None | High |
| Refuses an insurance claim below a threshold | Significant | None | High |
| Holds a refund above a limit for a named person | Varies | Person decides | Low |
| Approves held items in bulk without review | Significant | Nominal | High in effect |
The pattern is simple. Where an agent executes, at depth 3 or above, a capability whose outcome significantly affects a person, Article 22 is likely engaged. Where the agent drafts and a person with real authority decides, it usually is not. Our page on GDPR Article 22 and AI agents that make decisions goes through the edge cases.
How should agents be designed to stay on the right side?
Start by classifying capabilities by effect. For each capability an agent holds, ask whether its outcome could have a legal or similarly significant effect on a person. Capabilities that could should be capped at draft, with a named person deciding, unless the organisation deliberately relies on one of the narrow exceptions and has the required safeguards in place.
Then make the human involvement real. The person deciding should see the facts the agent relied on and their sources, the reason the item reached them, and have the authority and time to decide differently. Their decision should be recorded, along with any change they made.
Finally, assess before deploying. A data protection impact assessment under Article 35 is likely to be required where an agent's processing is likely to result in a high risk to individuals, and any agent near the Article 22 line is a strong candidate. Our explainer on whether GDPR allows AI agents to make automated decisions covers the exceptions and safeguards in more depth.
How does this interact with the EU AI Act?
The two laws overlap without being the same. The EU AI Act classes some uses as high-risk, such as creditworthiness assessment of individuals, and imposes human oversight and transparency duties on them. GDPR Article 22 focuses on solely automated decisions with significant effects. An agent may engage one, both or neither. Our comparison of where EU AI Act and GDPR duties overlap for AI agents maps the intersection.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What is the trade-off?
Keeping significant decisions with people limits how far agents can go in the processes where they might save the most. Every credit decline, account closure or claim refusal that must be reviewed by a person costs time.
The alternative is solely automated decisions that may breach a person's rights and that you will have to defend case by case. For each agent, list the capabilities whose outcomes could significantly affect a person, check whether any of them run above draft without real human involvement, and either cap them or document the exception and safeguards you rely on. The wider mapping of rules to controls is in our guide to AI agent regulation, mapped to controls.
Questions people ask
Does Article 22 apply if the agent only recommends?
Usually not, provided a person makes the decision with real involvement: they review the substance, can decide differently and sometimes do. If the recommendation is followed automatically in practice, the decision may be treated as solely automated.
Must customers be told an agent was involved?
Transparency duties under GDPR require people to be informed about the processing of their data, including the existence of automated decision-making within Article 22 and meaningful information about the logic involved. Other rules may require them to be told when they interact with an AI system.
Can consent make an automated decision acceptable?
Explicit consent is one of the narrow exceptions, but it must meet GDPR's standard for consent and comes with safeguards. In many consumer relationships, relying on it is difficult. Take advice before building a process around it.