GDPR Art. 22: solely automated decisions and their safeguards
A right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, except on contract, law or explicit consent; then human intervention, the right to express a view and to contest (Art. 22(3))
AIGE-OBL-GDPR-ART22. Drawn from chapter 08.
Text alternative
- Clause: GDPR, Art. 22.
- Duty holder: Controller.
- Applies from: 2018-05-25, In force.
- Artefact: Decision record with reason….
- Layers: Layer 04, Layer 05.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 16 other frameworks; the crosswalk section below links each clause.
Data table: the dates
| Date | Step | Detail |
|---|---|---|
| 2018-05-25 | In force |
- Id
AIGE-OBL-GDPR-ART22- Instrument
- General Data Protection Regulation (EU) 2016/679 law
- Clause
- Art. 22
- In scope
- Controller
- Authority
- National data protection authority
- Applies from
- In force
The artefact that evidences it
Decision record with reason codes; contest channel and human review log; appeal outcomes by group.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Patterns | Decision Notice & Contest Path | Direct |
| Patterns | Explanation Artefact | Direct |
| Same crosswalk topic | AI Verify 10.3.1, 10.3.2, 9.4.1 | Core clause |
| Same crosswalk topic | CSA AICM GRC-15 | Core clause |
| Same crosswalk topic | EU AI Act Art. 14, Art. 26, Art. 14(4)(b) | Core clause |
| Same crosswalk topic | GAO AI Accountability 3.9 | Core clause |
| Same crosswalk topic | ISO 42001 A.9 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 34(1)(4) | Core clause |
| Same crosswalk topic | NIST AI RMF MANAGE 2.4, MAP 3.5, GOVERN 3.2 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.2.2 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 App. 2 II.3 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.3.2 | Core clause |
| Same crosswalk topic | UK DUAA UK GDPR Art. 22C | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 17 | Related clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 10 | Related clause |
| Same crosswalk topic | CoE Convention CoE Art. 8 | Related clause |
| Same crosswalk topic | OECD AI Principles OECD 1.2(b) | Related clause |
| Same crosswalk topic | OWASP Agentic ASI09 | Related clause |
Patterns that build it
- Explanation Artefact (layer 4 and 5)
- Decision Notice & Contest Path (layer 4 and 5)
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Human oversight
- EU AI Act Art. 14 Human oversight (core)
- ISO 42001 A.9 Use of AI systems (core)
- NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use (core)
- TC260 Framework 3.0 TC260 App. 2 II.3 Strengthen human approval (core)
- NIST AI RMF MAP 3.5 MAP 3.5: Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function (core)
- CSA AICM GRC-15 Human supervision (core)
- Korea AI Act Art. 34(1)(4) Human management and supervision (core)
- UK DUAA UK GDPR Art. 22C Safeguards for automated decision-making (core)
- UK ATRS ATRS 2.3.2 Human review (core)
- Singapore Agentic Agentic 2.2.2 Design for meaningful human oversight (core)
- GAO AI Accountability 3.9 Human supervision: define and develop procedures for human supervision of the AI system (core)
- AI Verify 10.3.1 Human Agency and Oversight: define the role of the human in oversight and control of the AI system (in, over or out of the loop) (core)
- AI Verify 10.3.2 Human Agency and Oversight: flag decisions the model is significantly unsure of for human review, and monitor human overrides (core)
- EU AI Act Art. 26 Obligations of deployers of high-risk AI systems
- NIST AI RMF GOVERN 3.2 GOVERN 3.2: Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems
- China Algo. Rec. AlgoRec Art. 17 User option to switch off
- China GenAI Measures GenAI Art. 10 User guidance and protection
- EU AI Act Art. 14(4)(b) Awareness of automation bias
- OWASP Agentic ASI09 Human-Agent Trust Exploitation
- CoE Convention CoE Art. 8 Transparency and oversight
- OECD AI Principles OECD 1.2(b) Human agency and oversight safeguards
- AI Verify 9.4.1 Accountability: a manual to deactivate the AI model and a communications plan for disengagement
Source
Chapter 08, section The GDPR, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-gdpr-art22.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). GDPR Art. 22: solely automated decisions and their safeguards (AIGE-OBL-GDPR-ART22). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art22. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{GDPR Art. 22: solely automated decisions and their safeguards (AIGE-OBL-GDPR-ART22)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art22},
note = {Version 0.5.0}
}