When does Article 22 apply to AI And Automated Decisions?
Article 22 is about a decision that is based solely on automated processing and that produces a legal effect or a similarly significant effect for the individual. In plain English, the key question is whether a person is getting a meaningful human decision-maker, or whether the system is deciding on its own.
Teams should treat AI and automated decisions under the UK GDPR as a source-linked Article 22 and AI-governance decision: identify whether the system makes solely automated decisions with legal or similarly significant effects, confirm the lawful basis or Article 22 condition, and define transparency, human review, challenge, DPIA, accuracy, bias, and security controls.
The safest first step is to map the automated decision, the role of any human reviewer, the personal data used, the effect on the individual, and the evidence proving that safeguards work in practice.
- Write the UK GDPR AI and automated-decision decision in one sentence before drafting controls.
- For UK GDPR AI or automated decisions, record whether Article 22 applies and how people can request human intervention or challenge the decision.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
Explains the UK GDPR Article 22 restriction, permitted bases, human review, challenge rights, and DPIA expectations.
Supports AI-specific UK GDPR implementation work, including governance and data-protection risks in AI systems.