Automated Decision-Making: A GDPR Concept, Not an AI Act Risk Tier

Automated decision-making (ADM) is the making of a decision about a person by automated means. In its strict legal sense it is a GDPR term, governed by GDPR Article 22, which gives a person the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them. That is the definition to hold onto, because the single most common mistake here is to treat "automated decision-making" as an EU AI Act risk category. It is not. The AI Act has no ADM tier.

The two regimes overlap heavily in practice — most consequential ADM today runs on an AI system — but they are different instruments with different triggers, and a company usually has to satisfy both. This page draws the line.

---

The GDPR rule: Article 22

GDPR Article 22(1) sets a default prohibition: a person has the right not to be subject to a decision based solely on automated processing (including profiling) that has legal or similarly significant effects. "Solely" is load-bearing — if a human meaningfully reviews and can override the outcome, Article 22's strict regime is not triggered, though other GDPR duties still apply.

Article 22(2) carves out three lawful bases for such solely-automated decisions: where they are necessary for a contract, authorised by EU or Member State law, or based on the person's explicit consent. Where the decision is permitted on the contract or consent grounds, Article 22(3) requires safeguards: at minimum, the right to obtain human intervention, to express a point of view, and to contest the decision. And under GDPR Articles 13–15, the person is entitled to meaningful information about the logic involved and the significance and envisaged consequences of the processing.

A "legal effect" means something with a legal consequence — a contract cancelled, a benefit denied, entry refused. "Similarly significant" reaches things like an automatic loan refusal or being filtered out of a job at the screening stage. Showing someone a tailored advert generally does not clear that bar; deciding their creditworthiness does.

---

The AI Act layer: oversight and transparency, not an ADM right

The EU AI Act, Regulation (EU) 2024/1689, does not grant the individual right that Article 22 does. Instead it regulates the systems that perform the processing, and it bites mainly where the use case is high-risk under Article 6 and Annex III — for example creditworthiness assessment, recruitment, or eligibility for essential public benefits.

For those high-risk systems, two AI Act duties matter most to automated decisions:

• Article 14 — human oversight. Providers must design high-risk systems so that deployers can effectively oversee them, and deployers must assign competent people to that oversight. This is a system-design and governance duty on organisations — distinct from the GDPR's individual right to human intervention. They point the same direction (keep a human in the loop) but they are not the same obligation.
• Article 50 — transparency. Where a person interacts with an AI system, or where content is AI-generated, the relevant Article 50 disclosures apply, so people know when AI is involved.

Critically, the AI Act classifies by use, never by whether a decision is "automated." A system can make fully automated decisions and still be minimal-risk (a spam filter) or limited-risk (a chatbot). "Automated decision-making" is not a fifth risk tier sitting beside prohibited, high-risk, limited, and minimal — it is a GDPR concept that cuts across those tiers.

---

GDPR Article 22 vs the EU AI Act side by side

The takeaway: GDPR Article 22 asks "was this decided about a person by a machine alone, with serious consequences?" The AI Act asks "what is this system used for?" Different questions, frequently the same system.

---

Where they stack

For a high-risk AI system that makes consequential decisions about people, both regimes apply at once. The Article 14 human-oversight design and the GDPR Article 22(3) right to human intervention reinforce each other; the AI Act's documentation and the GDPR's "meaningful information about the logic" duty draw on the same underlying material. And note the assessments: a GDPR Article 35 DPIA and the AI Act's Article 27 Fundamental Rights Impact Assessment (FRIA) are different instruments, but Article 27(4) lets a FRIA build on an existing DPIA — so the factual groundwork is shared, not duplicated wholesale.

---

Worked example: an automated loan refusal

Consider Nordkredit Bank AS, a fictional EU regional lender — about 600 employees, ~€90M turnover — that runs an AI model which approves or declines small consumer-loan applications automatically, with no human looking at routine cases.

Under GDPR: This is a solely-automated decision with a significant effect, so GDPR Article 22 is squarely engaged. Nordkredit relies on the "necessary for a contract" basis under Article 22(2), which means it must provide the Article 22(3) safeguards: a declined applicant can demand human intervention, express their view, and contest the refusal — and Nordkredit must give meaningful information about the logic of the model under GDPR Articles 13–15.

Under the AI Act: Creditworthiness assessment is an Annex III high-risk use case, so Nordkredit is a deployer under Article 26. It must run Article 14 human oversight (a person able to interpret and override outputs), follow the provider's instructions, keep logs, and — because creditworthiness sits in Annex III point 5(b) — complete an Article 27 FRIA before deployment.

The combined picture: The GDPR gives the applicant rights against the automated refusal; the AI Act puts organisational duties on Nordkredit to govern the system that produced it. Nordkredit cannot satisfy one and ignore the other. The good news is the overlap: the human reviewer it stands up for GDPR Article 22(3) is largely the same function the AI Act's Article 14 requires, and the DPIA feeds the FRIA. Build it once, map it to both.

---

How Confir helps

Confir is built for the deployer side of exactly this overlap. It classifies each AI system you deploy by intended purpose — applying Articles 5, 6, and 50 — and flags where an Annex III high-risk use (such as creditworthiness or recruitment) brings Article 14 oversight and Article 27 FRIA duties into play, and where those interlock with your GDPR obligations. The engine is deterministic and rule-based: the same intake produces the same cited finding, with the rule that fired shown in plain language — so the line between the AI Act layer and the GDPR ADM layer is documented, not guessed.

---

Related guides

• What is a high-risk AI system?
• Article 22: automated decisions and human oversight
• Article 14: human oversight explained
• Article 27: the Fundamental Rights Impact Assessment
• Obligations of deployers (Article 26)
• Article 50 transparency obligations