GDPR Article 22: Automated Decision-Making
Deliberate Academy Editorial Team
Reviewed for accuracy and professional relevance
You're 4 lessons in — don't lose your progress.
Sign up free to save where you are and earn a verified certificate when you pass.
- Explain what GDPR Article 22 covers and the three conditions that must all be met for it to apply to a described AI system
- Identify the three rights Article 22 gives individuals when it applies, and what each requires an organization to actually provide
- Recognize why a nominal human review step does not, by itself, take a system outside Article 22's scope
- Apply Article 22 to a described AI use case and correctly determine whether it is triggered
A company deploys an AI tool that scores loan applications and automatically declines applications below a set threshold, with a loan officer glancing at each decline for an average of eight seconds before confirming it. The company's legal team believes this satisfies GDPR Article 22 because "a human is in the loop." This is one of the single most common Article 22 misconceptions in AI compliance work, and this lesson exists specifically to correct it.
What Article 22 Actually Covers
GDPR Article 22 gives individuals the right not to be subject to a decision based solely on automated processing that produces a legal effect or similarly significant effect concerning them. Three conditions must all be met for it to apply: the processing must be solely automated, with no meaningful human involvement in the specific decision; the decision must produce a legal or similarly significant effect — denial of credit, rejection of a job application, denial of insurance, exclusion from a public service, and comparably consequential outcomes; and the decision must concern the data subject — it must affect the specific individual whose data was processed, not an aggregate or population-level outcome.
The most common way organizations get this wrong is assuming that adding a nominal human review step automatically removes a system from Article 22's scope. It does not. If the human reviewer lacks the time, the information, or the practical authority to genuinely override the automated recommendation, the processing is functionally solely automated regardless of the nominal review step — an eight-second glance at a pre-computed decline is not meaningful human involvement.
A company's AI tool automatically declines loan applications below a credit-scoring threshold. A loan officer reviews each decline, but internal data shows the average review takes eight seconds and officers almost never override the AI's recommendation. Does this process fall within Article 22's scope?
Select one answer.
The Three Rights Article 22 Provides
When Article 22 applies, the organization must provide the individual with three things: meaningful information about the logic involved — not simply "an AI system was used," but a genuine, understandable account of the factors that influenced the decision; the right to obtain human intervention — a real opportunity for a human to review and potentially change the decision, not a rubber-stamp confirmation of an already-made automated outcome; and the right to contest the decision — a functioning process through which the individual can present additional information or challenge the outcome.
These three rights are not just policy commitments — they translate into concrete operational requirements: a genuinely explainable model or output (or a documented account of the key factors behind a decision), a real human-review workflow with the time, information, and authority to change an outcome, and an accessible process for an individual to raise a challenge. An organization that cannot point to all three in practice has a compliance gap, regardless of what its written policy says.
Redesigning a Review Process to Satisfy Article 22 — HR Technology Vendor
Context
A DPO reviewed her company's AI-assisted candidate-screening product, used by client companies to rank job applicants. The product included a client-side 'human review' step before any rejection was finalized, and the company had assumed this satisfied Article 22 for its client organizations.
Action
The DPO ran a sample audit of how client organizations actually used the review step and found wide variation — some clients had reviewers spending genuine time assessing borderline cases, while others had reviewers approving AI-generated rankings in bulk with no individual review at all. She worked with the product team to redesign the interface so that borderline-ranked candidates were flagged for mandatory individual review with the underlying ranking factors displayed, while clearly non-borderline cases moved through a lighter-touch process.
Outcome
The redesigned workflow gave client organizations a defensible, documented basis for asserting genuine human involvement in consequential cases, and gave the vendor company a stronger position when responding to client compliance questions about the product's Article 22 posture — rather than relying on a generic 'a human reviews every decision' claim that a closer audit had shown was not consistently true in practice.
A company argues that its automated candidate-screening tool falls outside Article 22 because a recruiter technically approves every AI-generated ranking before it is finalized. What follow-up question does this lesson indicate is most important for testing that claim?
Select one answer.
Exercise
Your Task
Take an AI-assisted process in your organization that produces an outcome affecting a specific individual (or a plausible one). Walk through Article 22's three conditions in order: (1) is the processing solely automated, applying the meaningful-human-involvement test from this lesson, not just whether a human is nominally present; (2) does the outcome produce a legal or similarly significant effect; (3) does it concern a specific individual. Based on your answers, state whether Article 22 is likely triggered, and if so, whether your organization can currently point to all three required rights in practice.
Success looks like
- The "solely automated" analysis specifically evaluates review time, override frequency, and reviewer authority — not just whether a human is nominally present in the process
- All three required rights (meaningful information, human intervention, right to contest) are assessed individually, not treated as a single bundled requirement
Watch out for
- Concluding a process falls outside Article 22 solely because a human technically reviews the output, without examining whether that review is substantive
- Article 22 applies when three conditions are all met: solely automated processing, a legal or similarly significant effect, and a decision concerning a specific individual.
- A nominal human review step — brief, rarely overridden, lacking real authority or information — does not remove a process from Article 22's scope; the review must be genuinely meaningful.
- When Article 22 applies, individuals are owed three specific things: meaningful information about the decision logic, a real opportunity for human intervention, and a functioning process to contest the decision.
- These rights translate into concrete operational requirements — explainability, a substantive review workflow, and an accessible challenge process — not just a written policy statement.
- This is one of the most frequently tested compliance concepts in AI governance work, and the "meaningful human involvement" nuance is the specific detail most often missed.