On this page 11 sections
Under GDPR Article 22, a person has the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on them, unless the decision is necessary for a contract, authorised by law, or made with their explicit consent, and even then they can demand human intervention, put their case, and contest the result. The UK replaced that rule on 5 February 2026 with one that permits such decisions on any lawful basis provided the same safeguards exist. In both regimes the working question for an engineer is the same: is the human in the loop actually deciding, or approving?
The answer is visible in the system’s own records. That is why this is an engineering article and not only a legal one.
Key takeaways
- Article 22 bites when three things are true: a decision, about a person, with legal or similarly significant effect, taken with no meaningful human involvement.
- “Meaningful” has a settled meaning: a person with the authority and competence to change the decision, who looks at the relevant data and does so. A rubber stamp does not count.
- The Court of Justice has ruled that a score which a third party relies on is itself a decision, and that the person is owed an explanation of the procedure actually applied to their data.
- The UK’s Articles 22A to 22D, in force since February 2026, permit solely automated significant decisions on ordinary personal data with four safeguards: information, representations, human intervention and contest. Special category data stays restricted.
- The EU AI Act’s human oversight duty for high-risk systems now applies from 2 December 2027. The US has no general rule, but New York City and Colorado have specific ones.
Who this applies to
Anyone building or buying a system that scores, ranks, approves, rejects, prices or routes people: loan and credit decisions, tenant screening, recruitment filters, insurance pricing, fraud holds, account suspensions, benefit eligibility, and the growing class of support agents that can refuse a refund or close an account without a person looking.
It is not limited to companies in Europe. The GDPR applies to processing of data about people in the EU regardless of where the company sits, and the UK rules apply likewise for people in the UK. A US company with European customers and an automated refund-refusal flow is in scope.
This is not legal advice. It sets out the rules as they stand in September 2026 and the design decisions they drive. The moment a system makes a decision with a legal effect, get counsel involved in the design, not the aftermath.
The three-part test
Article 22(1) gives the person the right not to be subject to a decision that is:
- based solely on automated processing, including profiling,
- which produces legal effects concerning them, or similarly significantly affects them.
Each part has been argued over. The working interpretations:
| Element | Clearly in | Clearly out | Contested middle |
|---|---|---|---|
| A decision | Loan refused, application rejected, account suspended | A summary, a draft, a recommendation nobody acts on | A score that someone else relies on |
| Legal effect | Contract refused, benefit denied, legal status changed | Marketing segmentation with no consequence | Price differentiation |
| Similarly significant | Access to credit, employment, housing, health care, education | Which advert a person sees | Ranking in a queue for a scarce service |
| Solely automated | No person looks before the effect lands | A person with authority reviews the data and decides | A person approves hundreds an hour |
Recital 71 gives the canonical examples: automatic refusal of an online credit application, and e-recruiting practices without human intervention. The 2018 guidelines from the Article 29 Working Party, adopted by the European Data Protection Board, add that the effect must be more than trivial, and that targeted advertising can qualify where it exploits vulnerability or affects a decision like credit.
A score is a decision if someone relies on it
On 7 December 2023, in SCHUFA (C-634/21), the Court of Justice held that a probability value produced by a credit reference agency is itself a “decision” under Article 22 where the bank that receives it draws strongly on it to grant or refuse credit. The agency could not say “we only produce a score, the bank decides”. That closed the most common escape route for scoring vendors, and it applies to any pipeline where an upstream model’s output effectively determines the downstream outcome.
For a lead scoring model that decides which applicants a human ever sees, or a fraud score that triggers an automatic hold, the vendor and the customer are both in scope.
Explanation means the procedure actually applied
On 27 February 2025, in Dun & Bradstreet Austria (C-203/22), the Court held that the “meaningful information about the logic involved” owed under Articles 13, 14 and 15 means the procedure and principles actually applied, explained so that the person can understand which of their data was used and how. Disclosing the algorithm is not enough, and a trade secret does not permit a blanket refusal: the controller gives the material to the supervisory authority or the court, which decides what the person gets.
The consequence for system design is direct. If you cannot say, for one named person, which inputs went in and how the result followed, you cannot meet the obligation. That record is the subject of building an audit trail an AI system can defend.
What “meaningful human involvement” actually requires
This is the element most systems fail, and they fail it in the same way: a review step exists, and it is nominal.
The Working Party guidelines are specific. To count, the human involvement must be carried out by someone who has the authority and competence to change the decision, who considers all the relevant data, and whose review is not a token gesture. The UK’s new Article 22A uses the same idea, defining a solely automated decision as one where “there is no meaningful human involvement in the taking of the decision”, and the ICO’s draft guidance from March 2026 treats a review that rarely or never departs from the machine as evidence that the involvement is not meaningful.
In practice, three questions settle it.
Can the reviewer see what they need? A person shown “Decision: reject. Approve?” with no access to the applicant’s data cannot consider it. The interface has to present the inputs and the reasoning, not just the verdict.
Do they have time? If the queue and the staffing imply eight seconds per case, no reasonable person concludes that each case was considered. Throughput is evidence.
Do they ever disagree? A reviewer who has never overridden the system in six months is, on the record, approving it. An override rate near zero is not proof that the model is right; it is proof that the review is not functioning as a decision.
The EU and the UK now differ
Until February 2026 the two regimes were the same text. They are not any more.
| EU GDPR, Article 22 | UK GDPR, Articles 22A to 22D | |
|---|---|---|
| Starting position | Prohibition, with exceptions | Permitted, with safeguards |
| When allowed, ordinary data | Necessary for a contract; authorised by law; explicit consent | Any lawful basis, including legitimate interests |
| Special category data | Only with explicit consent or substantial public interest under law, with safeguards | Only with explicit consent, or contract or law together with substantial public interest |
| Safeguards owed | Human intervention, express a point of view, contest | Information about the decision, make representations, human intervention, contest |
| Definition of “solely” | Guidance: no meaningful human involvement | Statute: no meaningful human involvement; regulations may define it further |
| In force | Since 25 May 2018 | 5 February 2026, under the Data (Use and Access) Act 2025 |
The UK change was made by section 80 and Schedule 6 of the Data (Use and Access) Act 2025, commenced by regulations on 5 February 2026. The ICO opened consultation on its rewritten guidance on 31 March 2026 and closed it on 29 May 2026; the final guidance is expected later in the year. Until then, the draft is the best indication of how the regulator reads the new words.
For a company serving both markets, the safe design is to meet the EU rule everywhere. The UK relaxation lets you rely on legitimate interests instead of consent or contract, which matters for some products, but the four safeguards are required in both, and the safeguards are where the engineering is.
The AI Act adds oversight as a product duty
For systems the EU AI Act classifies as high-risk, which under Annex III includes creditworthiness assessment, recruitment and worker management, and access to essential public and private services, Article 14 requires the system to be designed so that people can effectively oversee it: understand its capabilities and limits, watch for automation bias, interpret the output, and decide not to use it or to override it. Article 26 requires deployers to assign that oversight to people with the competence, training and authority to do it.
The Digital Omnibus regulation, in force since 27 July 2026, moved the high-risk application date for Annex III systems to 2 December 2027. The transparency duties in Article 50, including telling people they are interacting with an AI system, applied from 2 August 2026 and were not moved.
What this adds to Article 22 is that oversight becomes a property the system must have, not just a process the company must run. A review interface that hides the inputs fails Article 14 in design before it fails Article 22 in practice.
The United States
There is no federal rule equivalent to Article 22. Two specific ones matter.
New York City’s Local Law 144, enforced since 5 July 2023, requires an independent bias audit of automated employment decision tools before use, publication of a summary, and notice to candidates.
Colorado repealed its 2024 AI Act, which would have imposed a duty of care on developers and deployers of high-risk systems, before it took effect, and replaced it on 14 May 2026 with Senate Bill 26-189, a disclosure-and-rights framework for automated decision-making technology effective 1 January 2027. The rules under it are still being written. The shape is recognisable: tell people, keep a record, give them a way to contest.
For a US company the practical rule is that a system built to the EU standard will meet whatever arrives at state level, and a system built to no standard will be rebuilt.
What we design in, and where it costs the sale
We build the human step so that it can fail the “meaningful” test visibly, on purpose. The reviewer sees the inputs, the retrieved sources, the score and the reason, and has one action that overrides. The override rate is a metric on the dashboard next to throughput. When it sits at zero for a month, the system flags it, because a zero override rate means one of two things: the model is perfect, or nobody is looking. We have never seen the first.
This costs us sales. A buyer who wants “AI to handle rejections automatically” hears that the design either includes a real review step, with the staffing that implies, or treats the decision as solely automated and meets the rules for that, with consent or contract as the basis and a contest path that works. Both are more work than the demo suggested. The alternative, a review queue that exists only to say one exists, is the design most likely to be found out, because the trail itself proves it.
The concrete opinion: if the reviewer cannot change the decision in under a minute with the evidence in front of them, take the reviewer out and design for a solely automated decision honestly. Nominal oversight is the worst of both, it costs the staff time and provides none of the protection.
For the mechanics of what escalates to a person and when, confidence thresholds and escalation design covers the gate. This article covers what the gate has to satisfy when the decision on the other side of it matters.
When this is not worth it
When nothing is decided. A system that drafts, summarises, suggests or ranks for a person who then decides on the evidence is not making a solely automated decision. Keep the record that the person decided, and move on.
When the effect is trivial. Which help article the bot shows first, which of two email subject lines a customer receives, whether a ticket is tagged “billing” or “shipping”. Article 22 is for effects that matter to the person’s life or legal position. Do not build a contest process for a tag.
When the volume does not justify automation at all. A company rejecting forty applications a month can have a person read forty applications. The cost of meeting the rules for an automated decision exceeds the cost of the person well below that number.
When consent is the only basis and it will not be freely given. In an employment or benefits context, consent is rarely valid because the person cannot realistically refuse. If contract necessity does not fit and no law authorises it, the honest design under EU rules is a human decision, however much the vendor demo promised.
Frequently asked questions
Our support bot can refuse a refund. Is that a significant effect?
It can be. A refused refund on a small purchase is probably not. A refused refund that leaves a person out of pocket for a significant sum, or a closed account that removes access to a service they depend on, may be. The safe design is to route refusals above a threshold, and all account closures, through a person, which is also what the escalation design recommends on quality grounds.
If a person clicks approve on every decision, are we covered?
No. The guidance on both sides of the Channel says a token gesture does not count, and the ICO’s draft guidance treats a review that never departs from the machine as evidence that the involvement is not meaningful. Your own override rate will be the evidence.
We buy scores from a vendor. Are we responsible, or are they?
Both, after SCHUFA. The vendor’s score is a decision if you draw strongly on it, and you are the controller for the decision you take. The contract should say what the vendor will provide when a person asks for an explanation, because you will be the one asked.
Does the UK change mean we can drop consent for our UK users?
For ordinary personal data, a UK-only decision may now rest on legitimate interests with the four safeguards. For special category data, the restriction remains. If the same system serves EU users, the EU rule still applies to them, so most companies gain nothing by running two designs.
What does a contest process need to look like?
A channel the person can find, a person with authority to reverse the decision, access to the record of how the decision was reached, and a reply within a defined time. It does not need to be elaborate. It does need to work, and the first time it is used will show whether the audit trail exists.
Does any of this apply to internal decisions about our own staff?
Yes, fully. Performance scoring, shift allocation and disciplinary triggers driven by a model are decisions about people with significant effects, and employees are the group least able to give free consent. Employment counsel should be in the room for any of these.
Next step
If you cannot say today what your override rate is, or your reviewers could not change a decision if they wanted to, the AI evaluation and QA engagement measures the human step against the standard above using your own decision records, before anyone else does.
Related: Building an audit trail an AI system can defend · Confidence thresholds and escalation design · Responsible AI as an engineering decision · What belongs in an AI acceptable use policy