GDPR Article 22 exceptions: contract, law and explicit consent

Three exceptions allow an AI agent to make a solely automated decision with significant effects under GDPR Article 22: the decision is necessary for entering into or performing a contract, it is authorised by EU or member state law, or the person has given explicit consent. Each still demands safeguards, and none easily permits decisions based on special category data.

What does each exception require?

Article 22 starts from a prohibition on solely automated decisions with legal or similarly significant effects, then lifts it in three cases.

1. Necessary for a contract. The decision is necessary for entering into, or performing, a contract between the person and the controller. Necessary is read strictly: the automated decision must be a targeted and proportionate way to achieve the contract's purpose, not merely convenient. High-volume online credit or insurance applications are the usual example, where a person reviewing every application would not be practical.

2. Authorised by law. EU or member state law to which the controller is subject authorises the decision and lays down suitable measures to safeguard the person's rights, freedoms and legitimate interests. Fraud prevention and tax are areas where some member states have such laws. The authorisation must be specific enough to cover the decision.

3. Explicit consent. The person has given explicit consent to the automated decision. Explicit consent is a higher bar than ordinary consent: it must be expressly confirmed, for example in a clear written statement, and it must meet GDPR's general conditions for consent, including being freely given and withdrawable.

The starting point, and when a decision falls within Article 22 at all, is set out in GDPR Article 22 and AI agents that make decisions.

What safeguards does each still demand?

For the contract and explicit consent exceptions, the controller must implement suitable measures to safeguard the person's rights, freedoms and legitimate interests, at least:

• the right to obtain human intervention on the part of the controller;
• the right to express their point of view;
• the right to contest the decision.

For the legal authorisation exception, the law itself must lay down the safeguards, and the controller follows them.

Across all three, GDPR's transparency duties require the controller to tell people about the decision-making, give meaningful information about the logic involved, and explain its significance and envisaged consequences.

Special category data adds a further restriction. Decisions under any of the exceptions may not be based on special category data unless the person has given explicit consent to that processing, or the processing is necessary for reasons of substantial public interest under law, and suitable safeguards are in place.

Who must rely on an exception?

Any controller whose agent decides about people without meaningful human involvement, with significant effects. If your design keeps a person meaningfully in the decision, you do not need an exception; GDPR Article 22 and agents that draft but do not decide explains how to stay there.

How does each exception fit an agent?

Contract necessity fits agents that decide routine applications where the contract cannot sensibly be offered at scale without automation. It fits poorly where the agent makes decisions during the life of a contract that the contract does not need, such as closing an account for low profitability. Ask whether the decision is necessary for this contract, not whether automation is useful to the business.

Legal authorisation rarely fits private firms' agents, because the law must authorise the specific decision and set safeguards. Where it does apply, follow the law's own conditions exactly.

Explicit consent fits poorly in most regulated contexts. Consent must be freely given, which is hard to show when a customer cannot get the product otherwise. And it must be withdrawable: if a customer withdraws, the agent must stop deciding about them, and a person must take over. Build that switch before relying on consent.

One agent-specific risk spans all three. An exception covers a specific decision type. An agent that gains a new capability can begin making decisions the exception was never assessed for. Each new decision type needs its own exception check.

How do you meet the exceptions in practice?

The general question is answered in brief in whether GDPR allows AI agents to make automated decisions.

What will a supervisor or auditor ask?

• Which exception applies to each automated decision your agents make?
• Why is automation necessary for the contract, rather than convenient?
• Show us how a customer obtains human intervention, and how often the outcome changes.
• If you rely on consent, how is it freely given, and what happens on withdrawal?
• How do you keep special category data out of these decisions?

What do the exceptions not cover?

They do not remove other GDPR duties: lawful basis, fairness, accuracy and minimisation still apply. They do not satisfy the EU AI Act's oversight duties for high-risk uses, which require human oversight whatever the GDPR position. And they do not make a decision fair; an agent can act within an exception and still discriminate. For the full map, see AI agent regulation, mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.