Automated decision-making

In plain English

You apply for an apartment online and get a rejection seconds later. No person read your application. Software scored it, and the score decided. That is automated decision-making.

Not every use of an algorithm is ADM in the legal sense. Three questions matter:

• Is there a decision about a person?
• Is it solely automated, with no human who has the authority, information and time to change it?
• Does it have a legal or similarly significant effect, such as on credit, work, housing, insurance or benefits?

A human who rubber-stamps every output does not make the decision any less automated. Meaningful review needs someone who can weigh the facts and overturn the result. See human oversight.

Example

Kittering Rentals, a fictional letting platform in the EU, automatically rejects tenant applications that score below 40. Its privacy team reviews the process against GDPR Art. 22:

Kittering redesigns. Low scores now go to a trained letting agent who sees the full file and can approve the application. Applicants are told scoring is used, given the main factors behind their result and offered a way to contest it. The tool now supports the decision instead of making it.

Why it matters

• GDPR Art. 22. People have the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects (GDPR). It is allowed only if necessary for a contract, authorized by law, or based on explicit consent. Arts. 13 to 15 add a right to meaningful information about the logic involved.
• Court rulings. In SCHUFA (C-634/21, December 2023), the EU's top court held that a credit score can itself be the decision when a lender relies on it heavily. In Dun & Bradstreet Austria (C-203/22, February 2025), it said explanations must cover the procedure and principles actually applied.
• EU AI Act. Deployers of Annex III high-risk systems that make or assist decisions about people must inform those people (Art. 26(11)). Art. 86 adds a right to an explanation of the AI's role and the main elements of certain decisions.
• US. Colorado's SB 26-189 regulates automated decision-making technology in consequential decisions from 1 Jan 2027. Deployers owe notice, an explanation within 30 days of an adverse outcome, data correction and human review. California's ADMT regulations add notice, opt-out and access rights, with ADMT duties from 1 Jan 2027.

How the AIGP exam tests it

Lesson II.A.4 covers Art. 22 alongside data subject rights.

• Both conditions. Art. 22 needs a solely automated decision and a legal or similarly significant effect. Ordinary AI use on personal data does not trigger it, though the rest of the GDPR still applies.
• Rubber stamps. A reviewer without authority, information or time does not break the "solely" chain.
• The exceptions. Contract, law and explicit consent. Legitimate interests and a consent box buried in the terms of service are distractors.
• The safeguards. Human intervention, a chance to express a view and a right to contest. Not access to source code, and not automatic reversal.