Public bodies make decisions people cannot shop around to avoid: benefits, housing, school places, penalties. When an AI agent makes or shapes those decisions, GDPR Article 22 and public law duties both demand a competent person who can change the outcome. Caseworkers must be trained to review the agent's work, give reasons and correct errors before they reach a citizen.
What does Article 22 require of a public body?
Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. A solely automated decision is allowed where necessary for a contract, authorised by Union or member state law that lays down suitable safeguards, or based on explicit consent.
Public bodies usually rely on the authorised-by-law route, since contracts and consent rarely fit the relationship between state and citizen. That route depends on the law itself providing safeguards. Where no specific law authorises the automated decision, the body needs a person to decide.
Public bodies also carry duties private firms do not. They must act within their legal powers, follow fair procedures, give reasons and treat like cases alike. They face additional transparency and fairness duties. These duties apply however a decision is reached, and they assume that the official who signs a decision has considered it.
How does the EU AI Act add to this?
Under the EU AI Act, some public uses of AI are high-risk, including systems used to assess eligibility for essential public services and benefits. Deployers of high-risk systems must assign human oversight to people with the competence, training and authority to carry it out, under Articles 14 and 26. Deployers that are public bodies must also carry out a fundamental rights impact assessment under Article 27 before use. Every deployer must ensure AI literacy among staff under Article 4.
Which public service decisions are significant?
- Benefit eligibility and amount, including suspension and recovery of overpayments.
- Housing allocation and priority banding.
- School and care place allocation.
- Penalties and fines, such as parking and late filing penalties.
- Permit and licence decisions.
- Fraud and error flags that trigger investigation or stop payments.
Who does it apply to?
National and local government, agencies, public health and education bodies, and contractors delivering public services for them. Reviewers in scope include caseworkers, eligibility officers, housing officers, penalty review officers, fraud and error investigators, and appeal and review officers. The broader question of what AI literacy means for public bodies using AI agents covers everyone else who works alongside them.
What makes public service review meaningful?
The test in what meaningful human review is, authority, competence and information, is necessary but not enough here. Public law adds three expectations.
The official must consider the case. Caseload pressure pushes caseworkers to confirm agent recommendations. A decision confirmed without consideration may be unlawful on public law grounds as well as under Article 22.
Reasons must be the official's own. An agent can draft reasons at depth 2. The caseworker must check that they match the evidence and the legal criteria, and adopt them only if they do.
Like cases must be treated alike. Caseworkers who override the agent must do so on grounds they would apply to anyone in the same position, and record them.
Bound the agent firmly. At depth 1 it reads the application and records. At depth 2 it drafts an assessment and decision letter. At depth 3 it may process routine changes, such as an address update, within set rules. Refusals, suspensions, penalties and overpayment recoveries are held for a named caseworker. Stopping a payment already due is depth 4 and stays with a person.
What must caseworkers be trained to do?
- Apply the legal criteria, not the agent's summary of them.
- Read the evidence by provenance: records from another public register are signed; a citizen's statement is declared; a document sent by a third party is external until checked.
- Recognise people the agent is likely to misjudge: those with irregular income, unusual households, language barriers or disabilities.
- Use authority to decide differently, with reasons that would hold on appeal.
- Write decisions a citizen can understand and challenge.
- Treat requests for review as fresh decisions.
- Report patterns of agent error so bounds can be corrected.
How do you meet it and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Lawful route for automated decisions | Significant decisions held for caseworkers unless a law authorises automation with safeguards | Legal basis register; hold configuration |
| Competent oversight under Articles 14 and 26 | Caseworkers trained and assessed on the agent and legal criteria | Assessment results per caseworker |
| Reasons and consideration | Caseworker adopts or rewrites reasons; time and edits recorded | Decision record with reasons and reviewer |
| Consistency | Override reasons coded and reviewed for consistency | Override reports |
| Fundamental rights assessment | Article 27 assessment before deployment | Approved assessment |
| Right to review | Requests for review handled by trained officers | Review log with outcomes |
What will an auditor, ombudsman or regulator ask?
- Which decisions does the agent make without a caseworker?
- What law authorises any automated decisions, and what safeguards does it set?
- Show us refusals: did the caseworker consider them, and are the reasons theirs?
- How do caseworkers handle people the agent misjudges?
- How were caseworkers trained, and when?
Auditors in the public sector increasingly test people rather than systems; your auditors will sample the reviewers, not just the agents explains why.
What does Article 22 not cover?
It does not replace administrative law, appeal rights or equality duties. It does not apply to purely informational services with no significant effect. It does not itself authorise automated decisions; only specific laws can. And it does not cover national security processing outside GDPR's scope. Compare review in payments and insurance claims. The guide to AI literacy and certification covers reviewer training generally.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy sets module tests in the learner's own industry and role, so caseworkers are tested on public service cases. The Operator track teaches human review and running the rhythm of a live workspace. Lessons can be read or listened to as audio, which suits caseworkers fitting training around a caseload. A public body can make release rights for held decisions depend on a current certificate.
Questions people ask
Can a public body make fully automated decisions?
Only where a law authorises it and sets suitable safeguards. Without such a law, a person must make significant decisions.
Does a caseworker's signature make a decision human?
Not on its own. The caseworker must actually consider the case, with authority and information to decide differently.
Should citizens be told an agent was involved?
Yes. Transparency duties under GDPR and public law expect it, and Article 50 of the EU AI Act applies where citizens interact with an agent directly.