General Data Protection Regulation (automated decision-making)
Article 22 gives individuals the right not to be subject to solely automated decisions producing legal or similarly significant effects, plus rights to information, human review and to contest — a key constraint on AI-driven decisioning.
Overview
Article 22 gives individuals the right not to be subject to solely automated decisions producing legal or similarly significant effects, plus rights to information, human review and to contest — a key constraint on AI-driven decisioning.
Key dates
- Apr 27, 2016Adopted
- May 25, 2018Became applicable & enforceable
Risk areas addressed
Who it applies to
Any organisation processing personal data of individuals in the EU/EEA, including AI systems making automated decisions with legal or similarly significant effects.
Penalties & enforcement
Up to €20M or 4% of global annual turnover.
Enforced by: European Data Protection Board & national data protection authorities
Whatever your exposure to EU GDPR (Art. 22), the practical work is the same: inventory the AI systems in scope, map them to concrete obligations, and keep the evidence to show it. A structured AI governance programme — risk assessments, documentation and continuous monitoring — turns a moving regulatory target into a repeatable process.