A decision with legal effect is one that changes a person's legal rights, obligations or status: terminating a contract, cancelling an insurance policy, refusing an entitlement, imposing a penalty. GDPR Article 22 gives people rights about decisions based solely on automated processing that have legal or similarly significant effects. For AI agents, these are actions a person should own.
Why does the term matter once agents act?
Because agents can produce these effects through ordinary-looking actions. Closing an account, sending a notice of default, cancelling a policy for non-payment, withdrawing an offer: each is a few clicks in a system, and an agent with the right tool can do any of them. The legal consequence follows the action, whether or not anyone thought of it as a decision.
Under GDPR, where a decision with legal or similarly significant effect is based solely on automated processing, it is restricted to specific grounds and needs safeguards, including the right to obtain human intervention and to contest the decision. UK GDPR, with the Data Protection Act 2018, has an equivalent rule. This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How should agents handle such decisions in practice?
First, identify them. Go through every action each agent could take and ask whether it changes someone's rights or status, or has a comparably serious effect. Record the answer in the autonomy decision matrix. Then make sure a person makes each such decision in substance, not as a rubber stamp. Human involvement counts only if the person has the authority, the information and the time to decide differently.
The agent can still do most of the work: gather the facts, check them, draft the notice, explain the reasons. It stops before the decision takes effect.
What does that look like in an example?
A motor insurer's agent handles missed premium payments. It sends reminders on its own, because a reminder changes nothing about the customer's cover. After the final reminder, the next step is cancelling the policy, which ends the customer's insurance and has legal effect. The agent prepares the cancellation with the payment history and the reminders sent, and holds it. A person reviews, sees the customer called to report a hospital stay, and arranges a payment break instead.
How is a decision with legal effect different from a consequential decision?
A consequential decision is a broader term for any decision that materially affects a person's access to credit, insurance, housing, work or essential services. A decision with legal effect is narrower: it changes rights or status in law. Many decisions are both. GDPR's phrase "similarly significant effects" reaches decisions without formal legal effect, such as some credit refusals, which brings the two closer. Whether a refusal can be undone is a separate question; see is a credit decision reversible?
How does this differ from giving legal advice?
An agent preparing a notice that has legal effect is not giving legal advice, and an agent giving information about rights is not necessarily making a decision. They are separate risks with separate controls. Where the line sits for advice is covered in can an AI agent give legal advice?, and handling preservation duties in how to handle legal holds with an AI agent. The principle behind keeping people at these points is in regulated autonomy.
Questions people ask
Is a fully automated decision with legal effect ever allowed?
Under GDPR, only on specific grounds and with safeguards. Most regulated firms choose to keep a person in these decisions for agents, which is simpler to evidence.
Does a person clicking "approve" count as human involvement?
Not if they cannot realistically review or change the outcome. The person must have the authority, the information and the time to decide otherwise.