GDPR Article 22 applies when an AI agent's decision about a person is based solely on automated processing and has legal or similarly significant effects. Such decisions are prohibited unless an exception applies: necessity for a contract, authorisation by law, or explicit consent. Even then, people must be able to get human intervention and contest the outcome.
What does Article 22 require?
In substance, Article 22 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.
Three conditions must all be met for it to bite:
- A decision. Not a step in a process, but an outcome that determines how the person is treated.
- Solely automated. No meaningful human involvement in reaching it.
- Legal or similarly significant effects. A legal effect changes rights or legal status, such as terminating a contract. A similarly significant effect seriously affects circumstances, behaviour or choices, such as refusing credit, rejecting a claim or denying access to a service.
Where all three apply, the decision is permitted only under one of three exceptions, and the controller must put safeguards in place. Decisions based on special category data face a stricter rule. GDPR's transparency duties also require controllers to tell people about the existence of such decisions, meaningful information about the logic involved, and the significance and envisaged consequences. Our short answer to whether GDPR allows AI agents to make automated decisions is: sometimes, within these limits.
Who does it apply to?
Every controller making such decisions about people in the EU, or about people whose data is processed under GDPR's scope. It does not matter who built the agent; the controller making the decision is responsible.
When does an agent's action become a solely automated decision?
Agents change the analysis because they act. A scoring model produces an output that someone then uses. An agent can produce the output and act on it in the same run: decline the application, freeze the account, cancel the policy, send the letter.
Typical agent actions that can be solely automated decisions with significant effects:
- declining or approving credit, or setting a credit limit, for an individual;
- blocking a card or freezing an account on suspected fraud, where the customer cannot transact;
- closing an account or terminating a contract;
- rejecting an insurance claim, or refusing cover;
- screening out a job applicant;
- deciding eligibility for a benefit or public service.
Actions that are rarely decisions in this sense: answering questions, drafting documents for a person, routing a case, or reminding a customer of a due date.
The line is crossed most often by gradual change. An agent first drafts declines for an underwriter; then, to clear a backlog, low-value declines are released automatically; then the threshold rises. Each step looks small. Together they move the process into Article 22. Our piece on automated decisions under GDPR and where agents cross the line traces that drift, and the opposite design is covered in GDPR Article 22 and agents that draft but do not decide.
What must you do if an agent decides?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify solely automated decisions | Register of agent capabilities that can take effect without a person, tagged by effect on individuals | Capability register with Article 22 assessment |
| Valid exception | Exception recorded per decision type: contract necessity, legal authorisation or explicit consent | Legal assessment per decision type |
| Right to human intervention | Request route to a person who can reconsider and change the decision | Request log and outcomes |
| Right to express a view | Customer can submit information that a person considers | Submissions linked to case records |
| Right to contest | Clear challenge route in the decision communication | Decision templates; challenge log |
| Meaningful information about logic | Notice explaining what the agent considers and how it affects the outcome | Privacy notice; decision letters |
| Special category data | Agent cannot use special category data in such decisions unless explicit consent or substantial public interest applies with safeguards | Data filter rules; assessments |
| Accuracy and fairness | Outcome monitoring by group; regular re-testing | Monitoring reports |
| DPIA | Assessment before deployment | Signed DPIA |
Credit is the hardest case, because decisions there are high-volume and high-impact; see GDPR Article 22 and AI agents in credit decisions.
What will a supervisor or auditor ask?
- Which of your agents can make decisions about individuals without a person?
- What exception applies to each, and how did you establish it?
- How does a customer get a human to look at the decision? How often do they, and how often does it change?
- What do you tell customers about the logic?
- How do you keep special category data out of these decisions?
What does Article 22 not cover?
It does not prohibit automated processing generally, only solely automated decisions with significant effects. It does not cover decisions about legal persons, such as companies, though decisions about sole traders may count. It does not replace the EU AI Act's duties for high-risk systems, which apply alongside. And it does not tell you which decisions should be automated; that is a risk judgement. For the full set of rules, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is an approval decision covered by Article 22, or only refusals?
Any decision with legal or similarly significant effects. Approvals often have favourable effects, but terms attached to them, such as a lower limit or higher price, can be significant.
Does a fraud block count as a decision with significant effects?
It can, if the customer is unable to access their money or use their account in a way that seriously affects them. Short, quickly reviewed holds are a weaker case than lasting blocks.
Can we rely on a vendor's statement that its agent is Article 22 compliant?
No. Article 22 depends on how you use the agent: whether a person is involved, which exception applies and what safeguards you offer. Those are the controller's decisions.