It depends on the decision. GDPR lets an agent automate most work freely. Article 22 restricts only decisions based solely on automated processing that have legal or similarly significant effects on a person, such as refusing credit. Those are allowed only on specific grounds and with safeguards, including the right to a human review.
When does Article 22 apply to an agent's decision?
Three conditions must all be met:
- A decision about an individual. Sorting invoices is not one; refusing a loan application is.
- Based solely on automated processing. No person meaningfully involved in reaching the outcome. A person who signs off every result without the information, time or authority to change it does not count.
- Legal or similarly significant effects. Refusing credit, cancelling a contract, denying an insurance claim, or rejecting a job application typically qualify. Routing an email does not.
If all three apply, the decision is permitted only where it is necessary for a contract with the person, authorised by law with suitable safeguards, or based on the person's explicit consent. Even then, the person must be able to obtain human intervention, express their view and contest the decision. Decisions using special category data, such as health data, face tighter limits still. The concept is set out in what automated decision-making is under GDPR.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Why is this harder to judge with an agent?
A traditional scoring model makes one visible decision. An agent makes many small ones on the way to an outcome: which documents to trust, which questions to ask, which queue to send a case to. Any of these can decide the result in practice even when a person formally approves at the end.
There is also the action itself. A model recommends; an agent can send the refusal letter, close the account or freeze the card. If the agent can execute the outcome, the decision may be solely automated whatever your process diagram says. Where agents most often cross the line is examined in automated decisions under GDPR: where agents cross the line.
What may the agent do, and what stays with a person?
| Step | Agent | Person |
|---|---|---|
| Gather and check the person's information | Yes | Resolves conflicts the agent flags |
| Score or assess against policy | Yes, as a recommendation | Reviews the assessment and its sources |
| Approve a favourable outcome | Possible, where policy allows | Samples approvals |
| Refuse, cancel or deny | Drafts only | Decides, with authority to overrule |
| Handle a challenge to the decision | Gathers the file | Reviews afresh |
Many firms let an agent approve but never refuse. That asymmetry is a sensible default: adverse decisions carry the significant effect, so a person makes them.
An illustrative example
Take an online lender in the Netherlands. Its agent assesses small personal loans and, at first, sent approvals and refusals automatically. The lender relied on contract necessity for both.
Its review found refusals were where the risk sat. It changed the design: the agent still approves applications that clearly meet policy, but every refusal is held for a credit officer, who sees the agent's assessment, the documents it relied on and the reasons it found. The officer can approve, change or overturn the outcome, and does so in a meaningful share of cases. Refusal letters explain how to request a review. The lender records each officer decision beside the agent's recommendation, which shows the review is real.
Which controls keep automated decisions lawful?
- Map each agent decision against the three Article 22 conditions and record the outcome.
- Hold adverse decisions for a named person with the authority and information to change them.
- Make review meaningful: show the reviewer the sources, not just the score, and track how often they change the outcome.
- Record the lawful ground and the safeguards for any decision that remains solely automated.
- Explain: give people meaningful information about the logic involved and how to contest.
- Assess the processing with a data protection impact assessment where the risk is high.
The article-level detail is in GDPR Article 22 and AI agents that make decisions. Sector rules often add to GDPR; banking is covered in whether banking regulators allow AI agents to act for customers. The full map is in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, refusing or cancelling for a customer can be set as a held action: the agent drafts the outcome and its reasons, and it waits for a named person. The verdict and the person's decision are filed together, so the review can be shown later.
Questions people ask
Does a human click on every decision avoid Article 22?
No. If the person cannot or does not meaningfully assess the case, the decision is still solely automated. Regulators look at what the reviewer actually does.
Can an agent approve loans automatically?
It can, where a lawful ground applies and safeguards are in place. Approvals usually carry less risk than refusals, but they still need monitoring for errors and unfair patterns.
Do UK GDPR rules on automated decisions match the EU's?
UK GDPR started from the same text, but UK law can change separately. Firms operating in both should check each regime rather than assume they match.