GDPR Article 22 and AI agents in credit decisions

GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, and refusing credit is the textbook example. If an AI agent decides a loan with no meaningful human involvement, Article 22 applies. Structure the decision so a named person truly weighs the case.

What does Article 22 require, in plain words?

Article 22 restricts decisions made solely by automated means, including profiling, that produce legal effects or similarly significantly affect a person. The GDPR itself gives the automatic refusal of an online credit application as an example of such a decision.

Such decisions are allowed in three cases only: where necessary to enter into or perform a contract with the person, where authorised by law with safeguards, or with the person's explicit consent. In the contract and consent cases, the lender must offer at least the right to obtain human intervention, to express their point of view and to contest the decision. People must also be told that automated decision-making is happening and given meaningful information about the logic involved and its consequences. Our overview of Article 22 and AI agents that make decisions covers the general case.

Two points catch lenders out. "Solely" is about substance: a person who rubber-stamps every output does not stop the decision being solely automated. And EU case law has treated a credit score as itself capable of being an automated decision where a lender draws strongly on it, so a score supplier cannot assume it sits outside the rule.

Who does it apply to?

Any lender or credit intermediary processing personal data of people in the EU, and in the UK under UK GDPR with the Data Protection Act 2018, which has its own rules on automated decisions. It applies to consumer credit, mortgages, overdrafts, cards and buy-now-pay-later, and to limit decreases and account closures that significantly affect someone. UK firms should also read our piece on UK GDPR Article 22 for UK firms.

Lending to a company is outside Article 22 because the company is not a natural person, but a decision about a sole trader or a personal guarantor can be inside it.

What changes when the system is an agent?

A scorecard either decides or it does not. An agent does many things around a decision, which blurs the line.

The agent may gather the documents, compute affordability, write a summary and recommend an outcome. If a person then reads that summary and approves in seconds every time, the decision is in substance the agent's. If the agent can also approve small loans directly, those approvals are solely automated by definition.

So the design question is not "is there a human in the loop?" but "does a named person have the information, authority and time to reach a different answer?". We set out where the line sits for credit decisions in more detail. Our position: an agent may prepare a credit decision at depth 2, but the decision itself is held for a person unless the lender has deliberately chosen an Article 22 exception and built every safeguard around it.

The same applies to account changes. An agent that lowers a credit limit is making a decision with a significant effect. Our answer to whether an agent can change a credit limit explains when that is safe.

How do you keep a person accountable for the decision?

The referral itself is where accountability lives. When an agent passes a case up, the note should state the facts, the recommendation, what it is unsure of and what it did not check. Our credit referral note template gives a structure that makes a person's review real rather than ceremonial.

What will a data protection authority ask?

• Are any credit decisions taken without a person? Under which exception?
• Show us how an underwriter's review differs from approving the agent's recommendation.
• How often do underwriters disagree with the agent? If almost never, why?
• How does a declined applicant obtain human review, and how long does it take?
• What do you tell applicants about the logic involved?
• Where is the DPIA for this agent?

What does Article 22 not cover?

Article 22 governs solely automated decisions. It does not set fair lending duties, accuracy requirements for models or the content of decline reasons under consumer credit law. It does not classify the system as high-risk; that is the EU AI Act, where credit scoring of individuals is listed in Annex III. And it sits alongside, not instead of, the GDPR's general principles under Article 5, lawful basis under Article 6 and transparency duties. For the broader picture of banking agents, see our guide to AI agents in banking.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

In Pryme, a credit decision can be configured as held: the agent drafts the recommendation and referral note, and the verdict waits for a named person. The record shows who decided, what they saw and whether they overrode the agent, so a regulator can test whether review was meaningful. An agent cannot raise its own depth to decide.