What does GDPR Article 22 forbid? Automated decisions and the AI Act

Everything quoted below came back from Rekvira's tools on 24 September 2026, from the EUR-Lex texts of the GDPR (Regulation (EU) 2016/679) and the EU AI Act (Regulation (EU) 2024/1689). The UK GDPR keeps the same article numbers for the GDPR.

What does Article 22(1) actually forbid?

Three conditions must all be met before the rule applies. The decision is based solely on automated processing, which includes profiling. It is a decision about the person, not just an analysis. And it "produces legal effects concerning him or her or similarly significantly affects him or her".

Recital 71 gives the legislator's two examples: "automatic refusal of an online credit application or e-recruiting practices without any human intervention". Both are ordinary processes in lending and hiring.

Article 22(1) is written as a right of the person rather than a duty of the controller, but the effect for the controller is the same: without an exception, the decision cannot be made that way.

When is a solely automated decision allowed?

Article 22(2) lists three exceptions. The safeguards that come with each differ.

The minimum safeguards in Article 22(3) are "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". Recital 71 adds that safeguards should include "specific information to the data subject" and the right "to obtain an explanation of the decision reached after such assessment". The recital also says such a measure "should not concern a child".

Can special-category data be used?

Only narrowly. Article 22(4): decisions under paragraph 2 "shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place". Point (a) of Article 9(2) is the person's "explicit consent"; point (g) is processing "necessary for reasons of substantial public interest, on the basis of Union or Member State law".

What must you tell people?

The access right in Article 15 names Article 22 directly. A person can ask for "the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing" (Article 15(1)(h)).

Automated decisions with legal or similarly significant effects are also the first of the three cases in which a DPIA is always required, under Article 35(3)(a). When is a DPIA required? covers that assessment, and the processing belongs in your record of processing activities.

What does the EU AI Act add?

Two provisions sit next to Article 22 when the automated decision uses a high-risk AI system.

The first is an explanation right against the deployer. Article 86(1) of the AI Act gives "any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2 thereof" the right "to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken". It covers decisions that produce legal effects or similarly significantly affect the person "in a way that they consider to have an adverse impact on their health, safety or fundamental rights". Article 86(3) makes it apply "only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law".

The second is a duty to tell. Under Article 26(11), "deployers of high-risk AI systems referred to in Annex III that make decisions or assist in making decisions related to natural persons shall inform the natural persons that they are subject to the use of the high-risk AI system". Note "or assist": this duty reaches decisions a human takes with the system's help, which Article 22 of the GDPR does not.

When do the AI Act provisions apply?

The dates differ, and they changed in July 2026. Article 113 of the AI Act says the Regulation "shall apply from 2 August 2026", with listed exceptions, and Regulation (EU) 2026/1744 amended those exceptions. Chapter III, Sections 1 to 3, now "shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III". Article 26(11) sits in that part of Chapter III, so it applies to Annex III systems from 2 December 2027. The amending regulation does not amend Article 86 or Article 26.

Article 86 is outside Chapter III and is not among the listed exceptions, so its own start date is the general one. But it only concerns high-risk systems listed in Annex III, and the Annex III classification rules sit in the Chapter III sections that now apply from 2 December 2027. How those two dates interact is a question for your counsel, not something the text settles on its face. GDPR Article 22 needs no such reading: it applies now.