Automated decision-making under GDPR means a decision about a person made solely by automated means, with no meaningful human involvement, that has legal effects on them or similarly significant effects. Article 22 restricts such decisions and gives people safeguards. An AI agent that decides alone on credit, claims or account closures can fall within it.
Why does it matter once agents act?
Agents are built to act without a person in every step. If an agent declines a loan application, refuses an insurance claim or closes an account by itself, the decision may be one Article 22 covers, with all the conditions that brings.
The question is not whether AI was involved but whether a human played a meaningful part. An agent that drafts a decision for an underwriter who reviews the facts and decides is in a different position from an agent whose output is applied automatically.
How does Article 22 work in practice?
Three tests decide whether a decision falls within it:
- Solely automated: no person with the authority and competence to change the outcome actually considered it. Rubber-stamping does not count as involvement.
- A decision: not just a score or a recommendation that a person then weighs.
- Legal or similarly significant effects: such as refusing credit, cancelling a contract, or denying a benefit or service that matters to the person.
Where all three apply, such decisions are permitted only in limited circumstances, such as where necessary for a contract, authorised by law or based on explicit consent, and with safeguards: the person can obtain human intervention, express their view and contest the decision. People must also be given meaningful information about the logic involved. Whether GDPR allows AI agents to make automated decisions walks through each condition.
What does an example look like?
A consumer lender's agent assesses small loan applications. Version one declines applications that fail affordability automatically and sends the decline letter. That is likely a solely automated decision with a significant effect. Version two drafts the decision with its reasons and sources; an underwriter reviews each decline, can change it, and does so in a meaningful share of cases. Approvals within policy may still be automated. The lender now limits automated decisions to approvals and keeps declines with people, recording each review. The line between the two is explored in automated decisions under GDPR: where agents cross the line.
How is it different from profiling?
Profiling is the automated evaluation of personal aspects, such as predicting someone's reliability or behaviour. It is regulated by GDPR whether or not a decision follows. Automated decision-making is about the decision itself. An agent can profile without deciding (producing a risk score a person uses) or decide without much profiling (applying a fixed rule). Article 22 covers decisions based solely on automated processing, including profiling.
Similar rules exist elsewhere. The UK GDPR has its own version. South Africa's POPIA and Nigeria's Data Protection Act also address automated decisions; see POPIA, automated decision-making and AI agents and NDPA, automated decision-making and AI agents.
What should you do about it?
Map each agent capability that affects people against the three tests. Where a decision is significant, either keep a person meaningfully involved, with the time and information to change the outcome, or make sure a permitted basis and the safeguards are in place. Record which applies. Be ready for people to challenge decisions; whether a customer can object to a decision made by an AI agent covers that route. For the wider picture, see our guide to AI agent regulation.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does holding an agent's decision for approval take it outside Article 22?
Only if the approval is meaningful: the person has authority, competence, the relevant information and time, and actually changes outcomes when warranted. A held queue cleared in seconds per item may not be enough.
Do these rules apply to approvals as well as refusals?
They apply to any decision with legal or similarly significant effects. In practice, refusals and adverse outcomes are where challenges arise, which is why many firms keep those with people.