Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
Processing that uses personal data to evaluate, analyze, or predict aspects of an individual's circumstances, behavior, or attributes, with no meaningful human involvement in reaching or implementing the decision. GDPR Article 22 gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, such as credit decisions, employment screening, or benefits eligibility, subject to listed exceptions. The EU AI Act adds requirements, including human oversight, when such decisions use high-risk AI systems.
Why this matters for your team
If your AI makes or significantly influences decisions about people — scoring, ranking, hiring, or access to services — you likely have GDPR Article 22 obligations. Document whether a human meaningfully reviews each decision before it takes effect, and provide a process for affected individuals to request reconsideration.
A lending platform uses an AI model to approve or reject loan applications automatically. Because this constitutes automated decision-making with significant legal effects, GDPR Article 22 requires that applicants be able to request human review of any rejection.