GDPR Article 22 and training reviewers for meaningful human review in hiring and HR

Rejecting a candidate, cutting someone's shifts or flagging an employee for a performance process can all be decisions with significant effect under GDPR Article 22. When an AI agent makes them, employers need meaningful human review. Recruiters, HR advisers and line managers must be trained to examine the agent's reasons, apply their own judgement, and own the outcome.

What does Article 22 mean for employers?

Article 22 gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects. Employers can make such decisions only where necessary for a contract, authorised by law with safeguards, or based on explicit consent. Where they rely on contract or consent, the person must be able to obtain human intervention, express their view and contest.

Two features make employment harder than most settings. First, consent is weak: the imbalance of power between employer and worker or applicant means consent is rarely freely given, so employers cannot lean on it. Second, a necessary-for-contract argument is hard to make for screening thousands of applicants when a person could do it. In practice, the safe course for significant employment decisions is a person who decides.

The EU AI Act points the same way. It treats AI used to recruit and select people, to make decisions on promotion and termination, to allocate tasks and to monitor and evaluate workers as high-risk. Deployers must assign human oversight to competent people under Article 14 and, under Article 26, employers must inform workers' representatives and affected workers before using such a system at work.

Which HR decisions are significant?

• Rejecting an applicant at screening or after an assessment.
• Ranking or scoring candidates where the ranking decides who is seen.
• Allocating shifts and work, where hours mean income.
• Flagging performance or conduct in a way that triggers a formal process.
• Decisions on pay, promotion or bonus informed by agent scoring.
• Dismissal or non-renewal recommendations.

Who does it apply to?

Any employer, recruitment agency or platform making these decisions about individuals where GDPR applies. Reviewers in scope:

• Recruiters confirming agent-built shortlists and rejections.
• Hiring managers choosing from agent-ranked candidates.
• HR advisers reviewing performance and conduct flags.
• Workforce planners and line managers approving agent-built rotas.
• Reward teams using agent analysis on pay and bonus.

Responsibility stays with these people and the employer. The piece on whether HR advisers are accountable for an AI agent's mistakes explains where it lands.

What makes HR review meaningful?

Apply the three-part test from what meaningful human review is: authority to change the outcome, competence to judge it, and access to the information. HR adds particular traps.

Volume at screening. An agent can read thousands of CVs. A recruiter who confirms its rejections in bulk has not reviewed them. Better design: the agent drafts a shortlist with reasons at depth 2, while rejections are held, and recruiters review a sample of rejections in depth each day, alongside any rejection near the threshold.

Proxies. Gaps in employment, postcode, age-coded wording, non-standard qualifications and accents in recorded interviews can stand in for protected characteristics. Reviewers must be trained to see a proxy in the agent's reasons.

Data the agent should not use. Performance agents may read productivity logs, messages or sickness records. Reviewers must know what the agent read, whether it should have, and set aside any reason built on data outside its bounds.

The worker's side. A worker contesting a flag or a rota may have caring duties, a disability adjustment or a manager dispute the agent cannot see. Reviewers must hear it and re-decide.

What must HR reviewers be trained to do?

1. Read the agent's reasons and test each against the CV, record or rota rules.
2. Recognise proxies and data the agent should not have used.
3. Weigh provenance: payroll and attendance records are sealed; a manager's note is signed by a named person; an applicant's claims are declared until checked.
4. Use authority to reinstate a candidate, change a shift or close a flag, and record why.
5. Treat a contest as a new decision, not a defence of the old one.
6. Know how the agent is bounded: which capabilities sit at which depth, and that dismissal recommendations are always held.
7. Explain outcomes plainly to the applicant or worker.

How do you meet it and show it?

What will a regulator or auditor ask?

• Which hiring and HR decisions does the agent make, and which are held?
• Show us rejected applicants: who reviewed them, and how?
• How do reviewers spot proxies for protected characteristics?
• What did you tell workers and their representatives?
• How many contested decisions changed, and why?
• How were reviewers trained, and are they current?

Employers also face a hiring question of their own: who is qualified to run these agents. Checkable credentials are the new hiring signal for AI operations argues for verifiable proof.

What does Article 22 not cover?

It does not replace equality and employment law, which apply whether or not an agent was involved. It does not cover decisions with no significant effect, such as interview scheduling. It does not set the AI Act's high-risk duties, which apply alongside it. And it does not remove the need for a lawful basis under Article 6 for monitoring and profiling staff. Compare public services review and collections review. The guide to AI literacy and certification covers the wider training model.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where the Academy fits

Pryme Intelligence Academy certificates are themselves checkable at source through VerifyDoc.ai, and a public register lists certified people by name, credential and expiry. For HR teams, the Operator track teaches human review and when something goes wrong on the real product. An employer can adopt a practice that only staff with a current certificate may release held rejections or performance flags.