Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, when it produces legal effects or similarly significant effects. If an agent decides alone, you need an exception and safeguards, including a route to human intervention. This is general information, not legal advice.
What the text says
Paragraph 1: a person has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.
Paragraph 2 lists three exceptions. The decision is necessary for entering into or performing a contract. It is authorised by Union or Member State law that includes suitable safeguards. Or it rests on the person's explicit consent.
Paragraph 3: for the contract and consent exceptions, the controller must put in place suitable measures. At minimum, the person must be able to obtain human intervention, express their point of view and contest the decision.
Paragraph 4: such decisions may not rest on the special categories of data in Article 9(1) unless Article 9(2)(a) or (g) applies and suitable safeguards exist.
Where agents trigger it
The risk is not the word agent. It is the combination of three facts: the agent makes the decision rather than recommending, a human does not meaningfully review it, and the outcome matters to a person. Examples that deserve a second look:
- an agent that approves or declines applications
- an agent that ranks or rejects job candidates without a person reviewing the rejections
- an agent that closes accounts or cuts access based on a score
- an agent that sets individual pricing or terms
An agent that drafts and a person who decides, with real authority and time to disagree, is a different design.
Making human involvement real
"Solely" is the key word, and a rubber stamp is a weak answer. Build the review so a person can actually change the outcome:
- Show the person the inputs and the reasoning the agent used, not just the verdict.
- Give them authority and time to override.
- Record overrides, so you can see whether review does anything.
- Provide a simple path for the affected person to ask for review, state their view and contest the result.
A short procedure
- Inventory agent actions that decide something about a person.
- For each, ask whether the effect is legal or similarly significant.
- If yes, pick the lawful route: contract, law or explicit consent, or redesign so a person decides.
- Add the safeguards in paragraph 3.
- Check that special category data is not driving the decision.
- Ask your data protection officer or counsel to confirm.
Where Safeguard fits
Safeguard's compliance and evidence automation can hold your decision inventory and review records, and policies and gates can require an approval step before an agent action runs.
Quick check
Does Article 22 ban all automated decisions?
No. It sets a right not to be subject to solely automated decisions with significant effects, with exceptions and required safeguards.
Is a human clicking approve enough?
Not if the review is a formality. The person needs real authority and information to change the outcome.
Sources
Last reviewed: 19 October 2026.
