GDPR Article 22 automated decisions: what AI systems can and cannot do in 2026

The text of Article 22(1) reads: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her" [2]. Three exceptions in Article 22(2) allow such decisions: when necessary for entering into or performing a contract; when authorised by Union or Member State law; or with the data subject's explicit consent. Even where one of the three exceptions applies, Article 22(3) requires the controller to implement suitable safeguards - at minimum, the right to obtain human intervention, to express a point of view, and to contest the decision.

Article 22(4) further restricts processing of special-category data (health, biometrics, race, political opinions, etc.) in solely automated decisions to two narrow grounds: explicit consent, or substantial public interest grounded in EU or Member State law. Articles 13(2)(f), 14(2)(g) and 15(1)(h) layer on transparency obligations: when Article 22 applies, the controller must give the data subject "meaningful information about the logic involved, as well as the significance and the envisaged consequences" of the processing.

In SCHUFA Holding (C-634/21), decided 7 December 2023, the Court of Justice held that the automated generation of a credit score - even where the score is then passed to a third party (a bank) which formally takes the lending decision - amounts to a "decision" within Article 22(1) when the score plays a determining role in that downstream decision. This extended the article's reach beyond decisions taken in a single legal entity to any case where an automated output strongly determines a subsequent human-formal decision [3].

The European Data Protection Board's guidelines on Article 22 (revised 2024 in light of SCHUFA) reinforce three points buyers should design around. First, "solely automated" includes cases where a human is nominally in the loop but does not exercise meaningful authority over the outcome - a rubber-stamp human is not human oversight. Second, "similarly significant effects" includes pricing, eligibility, employment screening, fraud flags, content moderation that affects livelihood, and access to public services. Third, the transparency obligation requires meaningful explanation of the logic, not a generic statement that "AI is used" [4].

The practical effect of SCHUFA and the EDPB guidelines is that a wide set of AI use cases now requires Article 22 analysis as a default, not as an edge case. Credit scoring, debt-collection prioritisation and contact-strategy systems. Insurance underwriting and claims-fraud scoring. Hiring and CV-screening systems. Tenant-screening systems. Employee-performance and dismissal-risk scoring. Content-moderation and account-suspension decisions on platforms where this affects livelihood. Pricing personalisation that materially affects access to a product. Welfare-eligibility and benefits-allocation systems in the public sector.

Conversely, decisions that are genuinely advisory - where a competent human reviews the AI output, has authority to override, has time and information to do so, and exercises that authority in practice - fall outside Article 22(1). The bar is design, not branding. A "human-in-the-loop" UX overlay where the human has fifteen seconds and no countervailing information does not meet the EDPB's standard for meaningful intervention.

The compliance pattern has six elements. A documented assessment per system answering whether it is in or out of Article 22(1) and, if in, which Article 22(2) lawful basis applies. A meaningful human-review design where the reviewer has the AI output, the underlying data, the rationale, and authority and time to override. An explanation interface giving data subjects a clear, non-trivial description of the logic, the significance and the envisaged consequences. An access-rights workflow that can produce the per-decision explanation when an Article 15(1)(h) request comes in. A contest-and-appeal workflow with an SLA. A monitoring layer that detects when the human-review rate drops below the threshold that makes the human meaningful.

The EU AI Act's Article 14 on human oversight reads as a more concrete sibling of these requirements. For high-risk systems under the Act, the human-oversight obligation is explicit and detailed, and a system designed to comply with Article 14 will typically also meet the Article 22 GDPR threshold - though the legal bases are independent and both must be documented.

Article 83 of the GDPR sets the fine framework: up to EUR 20 million or 4% of global annual turnover, whichever is higher, for breaches of the lawful-basis and data-subject-rights provisions including Article 22. Recent enforcement actions across EU supervisory authorities have targeted credit-scoring providers, gig-economy platforms with algorithmic worker-management systems, AI-driven insurance pricing and biometric-based access systems. Fines have ranged from EUR 100k for documentation failures to multi-million-euro penalties for systemic non-compliance.

The other risk vector is private litigation. Article 79 gives the data subject a right to a judicial remedy, and consumer collective actions under the Representative Actions Directive (effective June 2023) can now bundle Article 22 claims into class proceedings. The reputational and litigation cost of an Article 22 finding is frequently larger than the regulatory fine. ENISA's threat-landscape work on AI underlines the security and trust dimension that compounds the regulatory exposure [5].

Every Impetora build that touches a person-level decision starts with a written Article 22 analysis: is the decision solely automated, what is the lawful basis, what does meaningful human review look like, what does the explanation interface need to expose. The architecture step bakes the explanation, contest and access-rights workflows into the system rather than bolting them on afterwards. The Citations and Evidence pillar of TRACE makes per-decision explanation a property of the output, not a separate report.

For buyers building or buying an AI system that affects individuals, the practical test is to ask the vendor for a sample Article 22 analysis from a comparable past project. A vendor that can produce one within hours has done this work before. A vendor that returns a generic statement about "compliance with GDPR" has not.