Often, yes. Where a decision with legal or similarly significant effects is made solely by automated means, GDPR and its UK equivalent give people the right to obtain human intervention, express their view and contest the decision. Other markets have their own versions. In practice, offer a real route to a person whatever the strict legal test.
What do the rules require, in plain words?
Under Article 22 of the GDPR, people have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects for them. Such decisions are permitted only on limited grounds, such as being necessary for a contract, authorised by law or based on explicit consent. Where they are permitted, the organisation must put safeguards in place, including at least the right to obtain human intervention, to express a point of view and to contest the decision. Our entry on what automated decision-making is under GDPR explains the terms.
Data protection law also gives people a broader right to object to some processing of their data, and transparency duties mean they must be told about automated decisions that affect them.
The UK applies its own version through UK GDPR and the Data Protection Act 2018, overseen by the ICO, and has been reforming how automated decisions are treated; see the ICO and automated decision-making by AI agents. Nigeria's Data Protection Act 2023 has provisions of its own, covered in the NDPA and automated decision-making. In the US, Colorado has passed an AI act aimed at high-risk systems that make consequential decisions, and credit decisions carry adverse action duties under ECOA and Regulation B.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
When does an agent's decision count as automated?
The test turns on whether a person meaningfully took part. If an agent declines a credit limit increase and nobody looks at it, that is solely automated. If the agent drafts the decision and a person with authority reviews the facts and decides, it usually is not, provided the review is real. A reviewer who approves everything the agent proposes without looking is not meaningful involvement, and regulators look at how review works in practice.
Significance is the second test. A routing decision rarely qualifies. Decisions about credit, insurance cover, claims, account closure or employment often do. The term consequential decision is used in some laws for this category.
What should the agent do and what should people do?
| Step | The agent | A person |
|---|---|---|
| Gathering facts for the decision | Yes | Checks unusual items |
| Proposing the decision with reasons | Yes, at depth 2 | Reviews and decides |
| Telling the customer the outcome and how to challenge it | Drafts the notice | Sends it, or approves the wording |
| Receiving an objection | Logs and routes it | Owns the review |
| Reviewing the objection | Prepares the file | Decides afresh, with authority to change the outcome |
The last row is where many processes fail. A review that only checks whether the agent followed its rules is not a review of the decision.
What does that look like for a real objection?
Say a consumer lender's agent proposes declining a request to extend a loan term, because the customer's income in its sources has fallen. A credit officer approves, and the customer receives a letter explaining the main reasons and how to ask for a review.
The customer objects, saying their income fell for three months during parental leave and has since returned. The objection is logged with the original verdict. A different credit officer reviews the case, asks for recent payslips, and approves the extension. The record now shows the agent's proposal, the first approval, the objection, the new evidence and the second decision, each with a named person. How to word the original explanation is covered in explaining an AI agent's decision to a customer.
Which controls make objections workable?
- Clear notice at the point of decision, saying how to object and to whom.
- Reasons recorded with every decision, from the agent's sources, so a reviewer can see what the decision rested on.
- A different reviewer for objections where possible.
- Authority to change the outcome, not just to confirm it.
- Objection rates tracked per capability, since a rise suggests a problem in the agent's brief or sources.
The wider rules picture is in our guide to AI agent regulation.
Questions people ask
Does a person approving the agent's proposal remove the right to object?
It may take the decision outside the strict automated-decision rules, if the approval is meaningful. Customers can still complain and challenge outcomes through normal routes, and fairness duties still apply.
Must the customer be told an AI agent was involved?
Transparency duties often require telling people about automated decision-making that affects them, and the EU AI Act requires people to be told when they interact with an AI system. Check which duties apply to your use.
Can the agent handle the review of an objection?
It can prepare the file, but the review should be by a person with authority to change the outcome. An agent reviewing its own decision is not human intervention.