Article 22 gives people the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Two things about it surprise most teams: European regulators and the Court of Justice treat it as a general prohibition rather than a right somebody has to invoke, and it applies to any automated decision meeting the test — a rules engine written in 2019 counts, with no machine learning anywhere in sight.
This article covers the three conditions that bring a decision inside Article 22, the three exceptions that permit it, the safeguards that attach when you rely on them, what "solely" means after the Court's first ruling on the provision, and the automated decisions ordinary SaaS products make without noticing.
The Three Conditions
Article 22(1) applies where all three of the following are true, and the Court of Justice confirmed this cumulative structure in its first ruling on the provision.
There is a decision. The concept is read broadly. It is not limited to a formal determination communicated to the individual, and it can include acts that affect a person in a variety of ways.
It is based solely on automated processing, including profiling. Profiling is defined in Article 4(4) as automated processing used to evaluate personal aspects of a person — analysing or predicting performance, economic situation, health, preferences, reliability, behaviour, location or movements.
It produces legal effects or similarly significantly affects the person. Legal effects are the narrower category: something that changes legal status or rights. "Similarly significantly affects" is the limb that catches most commercial systems, and it turns on the consequences for the individual rather than the sophistication of the method.
Recital 71 gives the archetypes: automatic refusal of an online credit application, and e-recruiting practices without human intervention.
The Court's decision in SCHUFA Holding (Case C-634/21, 7 December 2023) is the reference point for how widely this reaches. A credit reference agency generated a probability value about an individual's ability to repay, and supplied it to lenders. The agency argued that it made no decision — the bank did. The Court disagreed: where a third party draws strongly on that score to establish, implement or terminate a contractual relationship, generating the score is itself an automated individual decision under Article 22(1), and the Article 22 obligations attach to the agency and not only to the lender. The Court also confirmed that Article 22(1) operates as a prohibition in principle, which does not have to be invoked by the individual to bite.
The lesson for a SaaS company is that supplying scores rather than making decisions is not the shelter it looks like. If your customers act on your output more or less automatically, the output may be the decision.
The Three Exceptions, And What Comes With Them
Because Article 22(1) is a prohibition, you need one of the exceptions in Article 22(2) before you can do this at all.
(a) Necessary for entering into, or performance of, a contract between the individual and the controller. "Necessary" is the constraint. Convenient, cheaper and faster do not qualify; the question is whether the contract could be performed by a less intrusive route.
(b) Authorised by Union or Member State law which lays down suitable safeguards. This is the route for fraud prevention and tax evasion regimes and other statutory schemes, and it depends on a specific law existing.
(c) Explicit consent of the individual. Explicit is a higher standard than ordinary consent — an express statement, not an inferred agreement — and it must still be freely given, which means a genuine alternative has to exist.
The Safeguards That Come With Them
Where you rely on (a) or (c), Article 22(3) requires safeguards, and it sets a floor rather than a menu. At minimum, the individual must be able to obtain human intervention, to express their point of view, and to contest the decision. These are operational commitments rather than policy language: someone must actually be available, and they must be able to change the outcome.
Article 22(4) adds a further restriction. Decisions of this kind may not be based on special category data unless Article 9(2)(a) explicit consent or 9(2)(g) substantial public interest applies, with suitable safeguards in place.
Alongside the exception you need transparency. Articles 13(2)(f) and 14(2)(g) require you to tell people at collection that automated decision-making is happening, and Article 15(1)(h) lets them ask afterwards. In each case the requirement is the same: meaningful information about the logic involved, and the significance and envisaged consequences of the processing for them.
What "Solely" Means, And Why Token Review Fails
"Solely" is where most teams try to escape Article 22, and where most of them fail.
The escape route is familiar: put a person in the loop, and the decision is no longer solely automated. It works only when the human involvement is real. Regulatory guidance and the Court's approach both point the same way — a person who rubber-stamps an output, or who lacks the authority or the information to reach a different conclusion, does not take the decision out of Article 22. The Court's reasoning in SCHUFA went further in the same direction, treating a score as an automated decision where the eventual decision-maker draws strongly on it.
Three questions determine whether your human review is genuine. Does the reviewer have the authority to overturn the outcome? Do they have access to the underlying information, rather than only the system's conclusion? Do they in fact overturn outcomes sometimes — and can you show it?
That last one is the useful test, because it is measurable. A review step with an approval rate of 100% across ten thousand decisions is not review. It is a logging step with a person attached, and the override rate is the number a regulator will ask for.
The Automated Decisions SaaS Products Make Without Noticing
Article 22 is widely assumed to be about artificial intelligence. It is not. It is about consequences, and a deterministic rules engine can produce them just as effectively as a model.
Some patterns worth checking in an ordinary B2B product: automated account suspension triggered by fraud or abuse scoring; automated rejection or approval of applications, credit limits or payment terms; algorithmic pricing that materially changes what an individual is offered; automated content removal on a platform where the account carries someone's livelihood; automated screening in a hiring product, which Recital 71 names directly; and automated performance scoring inside workforce tools, which is where this meets the question of what employers may lawfully monitor.
Two structural points follow.
A Data Protection Impact Assessment is likely to be mandatory rather than advisable. Article 35(3)(a) names systematic and extensive evaluation of personal aspects based on automated processing, on which decisions are based producing legal or similarly significant effects, as a case requiring one.
And profiling on pseudonymised data does not take you outside Article 22. The provision is about decisions concerning a person, and pseudonymised data remains data about an identifiable person — a distinction set out in our guide to anonymisation versus pseudonymisation. If a decision reaches an individual, the fact that the pipeline used tokens rather than names does not change the analysis.
Article 22 is one part of a wider set of obligations around algorithmic systems — model governance, bias testing, training data provenance and the newer AI-specific regimes are separate subjects with their own requirements, and our AI compliance guide for SaaS covers that territory. This article is only about the decision.
Common Mistakes With Article 22
Assuming it only applies to AI. The test is whether a decision is solely automated and significantly affects someone. A if score > threshold then suspend rule written years ago meets it exactly as a model would.
Relying on human review that never changes anything. If the reviewer cannot overturn the outcome, cannot see the underlying data, or never does overturn it, the decision remains solely automated and your exception has quietly failed.
Treating explicit consent as the easy option. It must be explicit, specific and freely given, which requires a real alternative. Consent extracted as a condition of using the service is not freely given, and you are left with no exception at all.
Building no route to contest. Article 22(3) requires human intervention, the ability to express a view, and the ability to contest. A product with automated suspension and no appeal path is missing a mandatory safeguard, not a nice-to-have feature.
Disclosing nothing because you will not disclose the source code. Meaningful information about the logic means the factors used and their significance, in terms the person can understand. It has never meant publishing the algorithm, and refusing everything to protect trade secrets fails an obligation that never required them.
FAQ
Does Article 22 apply to rules-based systems, or only to machine learning?
It applies to any decision based solely on automated processing that produces legal or similarly significant effects. Nothing in the wording refers to a technique. A deterministic rules engine that suspends accounts is squarely within scope, and is more likely to be overlooked precisely because nobody thinks of it as an algorithm.
What counts as "similarly significantly affects"?
It turns on the consequences for the individual. Denial of a service they depend on, termination of an account carrying their income, materially different pricing, or exclusion from an opportunity all point toward it. Trivial personalisation such as which banner someone sees generally does not, though intensity and context can shift that.
Do we have to explain how our algorithm works?
You have to provide meaningful information about the logic involved and the significance and envisaged consequences — the factors that carried weight and how they affected the outcome, in language the person can act on. Disclosing source code or model weights has never been the requirement.
Is automated account suspension covered by Article 22?
Very likely, where the suspension is applied without a human deciding and the account matters to the person — a seller's storefront, a professional's client access, a business customer's operations. If so, you need an Article 22(2) exception, the Article 22(3) safeguards including a genuine appeal, and transparency at the point of collection.
Closing Thought
The most common way to breach Article 22 is not to build a controversial scoring system. It is to add a threshold to a rule, ship it, and never think of it as a decision about a person. Nobody writes a design document titled "automated determination affecting individuals"; they write a ticket about reducing fraud, and the effect on the person on the other end appears nowhere in the work.
Which suggests the practical question is not "are we compliant with Article 22" but "what does our software do to people without a human ever looking." Most teams have never made that list. It is usually shorter than feared and longer than expected.
ComplyDog does not audit your decision logic. It handles the compliance records that surround it — records of processing activities, which is where automated decision-making should be documented, subprocessor tracking, DPAs and data subject request handling, all on a portal hosted on your own domain. You can try it free for 14 days, no credit card required.
