GDPR Article 22 and the human reviewer's job

GDPR Article 22 gives people the right not to be subject to decisions based solely on automated processing with legal or similarly significant effects. So organisations that use agents in such decisions need a person to decide with the agent's help, or to step in when someone contests the outcome. That person is the human reviewer.

What does Article 22 require?

In plain words, a person should not be subject to a decision made solely by automated means, including profiling, where it produces legal effects for them or similarly significantly affects them. Refusing credit, rejecting an insurance claim or turning down a job application can all fall in that category.

There are three exceptions: where the decision is necessary for a contract with the person, where law authorises it with safeguards, or where the person has given explicit consent. In the contract and consent cases, the organisation must still provide safeguards, including at least the right to obtain human intervention, to express their point of view and to contest the decision.

Article 22 works alongside the GDPR's principles in Article 5, the need for a lawful basis under Article 6, and, where processing is high risk, a data protection impact assessment under Article 35. In the UK, the same structure comes through UK GDPR and the Data Protection Act 2018.

Where does the human reviewer come in?

Article 22 creates two distinct reviewer positions, and job seekers should know which one an advert describes.

Before the decision. The organisation puts a person into the decision so that it is no longer based solely on automated processing. The agent gathers evidence and drafts a recommendation; the reviewer decides. This only works if the review is real. A person who clicks approve on every recommendation without weighing it does not change the nature of the decision. What a real review demands of the individual is set out in what a meaningful human review requires of the person doing it.

After the decision. The organisation relies on an exception and lets the system decide, but offers human intervention. A person asks for review, gives their side, and a reviewer looks at the case afresh with the authority to change the outcome.

The first is a high-volume queue role. The second is closer to complaints or appeals work, with fewer cases and more depth. Both are the human reviewer's job.

Who needs reviewers under Article 22?

Any organisation under the GDPR that uses automated processing for significant decisions about individuals. In practice that means lenders and credit card issuers, insurers handling underwriting and claims, payment firms deciding on account restrictions, employers using automated screening, and public bodies making eligibility decisions.

Agents widen the reach. An agent that drafts and executes refunds, blocks accounts or declines applications may be making significant decisions even when nobody planned it as an "automated decision system". Organisations then need reviewers they had not budgeted for. For employers training these teams in payments, see training reviewers for meaningful human review in payments.

What does the job involve day to day?

Titles vary: decision reviewer, credit referrals officer, claims assessor, case review specialist, human-in-the-loop specialist. That last label is explained in what is a human-in-the-loop job, and the question of whether the role is established is answered in is AI agent reviewer a real job.

The common tasks are:

1. Open a case the agent has held, with its recommendation, sources and reasons.
2. Read the evidence before relying on the agent's summary.
3. Decide: approve, change or reject, within your authority.
4. Write the reason in plain words that could be shown to the person or a regulator.
5. Flag patterns, such as the agent repeatedly misreading one document type, to the agent owner.
6. For contested decisions, read the person's point of view and decide afresh.

The competence is judgement under a standard, written down.

How do you show employers you can do it?

What might an interviewer ask?

Expect questions that test whether your review would be real:

1. "You have two hundred cases today and the agent is usually right. How do you work?" Show that you would review each case on its facts and raise the volume with your lead if it made real review impossible.
2. "A customer contests a decline and gives new information. What do you do?" Assess it as new evidence, reconsider the decision fully, and record the reason either way.
3. "When would you not follow the agent's recommendation?" When the evidence does not support it, when a source looks unreliable, or when the case falls outside the agent's scope.

A credit operations assistant we will call Mette prepared by writing three decline reasons she had seen at work and rewriting each so a customer could follow and contest it. That is the core skill.

What does Article 22 not cover?

It does not apply to decisions without legal or similarly significant effects, such as routine product recommendations. It does not ban automated decisions outright; it limits them and requires safeguards. It does not set reviewer caseloads or qualifications. And it does not replace sector rules, such as credit decline reason duties in other markets or the EU AI Act's oversight requirements for high-risk systems.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.