GDPR Article 22 human review: what meaningful intervention looks like

Meaningful human review means a person who has the authority to change an AI agent's outcome, the competence to judge it, the agent's evidence, and the time to consider it, and who actually exercises that judgement. Under GDPR Article 22, anything less is token involvement, and the decision stays solely automated. The record must show the difference.

What does GDPR require of human review?

Human review matters in two places in Article 22.

First, it decides whether Article 22 applies at all. A decision is caught only if it is based solely on automated processing. Meaningful human involvement takes it outside. Token involvement does not.

Second, it is a safeguard where Article 22 does apply. Where a solely automated decision is allowed under the contract or explicit consent exceptions, the person must at least be able to obtain human intervention, express their point of view and contest the decision.

GDPR does not define meaningful, but regulators' guidance has consistently pointed to the same features: the reviewer must have the authority and competence to change the decision, must consider all the relevant data, and must not simply apply the automated output. Our pieces on GDPR Article 22 and AI agents that make decisions and the UK GDPR equivalent set out the surrounding rules.

Who must show it?

The controller. If your agent's decisions are reviewed by people, you must be able to show that the review is real. If your agent decides and people review on request, you must show that intervention, when requested, is real too.

What makes review real rather than token?

Six features, each of which an agent design can support or undermine.

1. Authority. The reviewer can approve, change or reject, and is not penalised for disagreeing. Targets on throughput or agreement rates undermine this quietly.

2. Competence. The reviewer understands the decision type and the agent's limits: what it reads, what it cannot see, where it tends to err.

3. Information. The reviewer sees the evidence, not just the conclusion. For an agent, that means the sources it relied on, the figures it extracted, and anything it could not verify. A reviewer who sees only "Decline: affordability" cannot review; one who sees the statements and the agent's income calculation can.

4. Independence of view. The reviewer forms a judgement before or alongside seeing the agent's recommendation, not merely after it. Some firms show the evidence first and the recommendation second, to reduce anchoring.

5. Time. The reviewer has enough time per case for the complexity. An agent that produces cases faster than people can read them turns review into a formality.

6. Effect. Reviews change outcomes at a plausible rate. A rate close to zero, sustained, means either the agent is perfect or the review is not happening.

Agents add a trap that scoring models do not: the fluent rationale. A draft often arrives with a persuasive paragraph explaining itself, and reviewers tend to read that instead of the evidence. Present the rationale as a claim to be checked against the sources, not as the reason to approve.

For a request-based intervention after a solely automated decision, the same features apply, plus one: the customer's own view must reach the reviewer and be considered.

How do you record that review happened?

The burden is on the controller to demonstrate compliance, so the record must show the substance of review, not just a click.

The procedure that ties these together, with roles and escalation, is in our human oversight procedure template for AI agents.

What will a supervisor or auditor ask?

• Show us a reviewed case. What did the reviewer see? How long did they spend?
• How often do reviewers change the agent's outcome?
• Are reviewers measured on speed or agreement?
• How do you know reviewers would catch a wrong draft?
• When a customer asks for human intervention, who handles it and what changes?

What does human review not cover?

It does not make a decision fair or accurate; a reviewer can approve a flawed outcome. It does not satisfy the EU AI Act's human oversight duty automatically, though the features overlap closely. It does not remove transparency duties about the use of the agent. And it does not tell you which decisions should be reviewed; that follows from your Article 22 assessment and risk appetite. For the full map, see AI agent regulation, mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

In Pryme, actions above an agent's earned depth receive a held verdict and wait for a named person. The filed record shows what the person was shown, who released or rejected the action, and when. That is the evidence of meaningful review, produced as part of the action rather than added afterwards.