GDPR Accountability Obligations for Automated AI Decision-Making

GDPR accountability for automated AI decision-making is a duty to produce evidence. Article 5(2) requires organizations to prove compliance. Decision pipelines must be documentable, auditable, and contestable before a regulator asks.

Why GDPR's accountability principle is harder to satisfy than most organizations assume

Prove is the operative word in Article 5(2). An organization must be able to demonstrate compliance on demand. A description of how decisions should work does not establish how a particular decision actually worked.

Oleg Solozobov’s governance evidence framework identifies this gap in organizations that appear formally compliant but cannot reconstruct what happened or why. For automated AI decisions, the evidence must connect a specific outcome to the processing and safeguards behind it. A policy cannot supply that missing chain. The practical requirement is therefore an evidence-producing pipeline, rather than an investigation assembled after the regulator’s letter arrives.

What Article 22 actually prohibits and what triggers it in practice

Article 22(1) establishes a qualified prohibition on decisions based solely on automated processing that produce legal effects or similarly significant effects on a person. The trigger concerns the decision’s substance and consequences. It does not turn simply on whether an organization calls its system advisory or places a person somewhere in the workflow.

The CJEU’s ruling in SCHUFA Holding in December 2023 established that automated credit scoring can fall within Article 22(1) even when a human formally makes the final credit decision. That applies where the third party draws strongly on the automated score. The Netherlands AP’s 2026 prior-consultation advice on Microsoft 365 Copilot for the municipality of Haarlemmermeer applied the same concern to generative AI. Where the system plays a decisive role, the decision is solely automated, and the authority asked for periodic checks that the human factor genuinely remains decisive.

The Dutch AP’s 2026 €824.99 million fine against Uber shows how much enforcement can cost. The authority found that driver accounts were suspended fully automatically for suspected fraud or low ratings, with no human review before the accounts were suspended. Uber says that finding is wrong, especially for permanent deactivations. The alleged failure is nevertheless structurally familiar. The automated output becomes an operational decision before a person meaningfully examines it.

The three lawful exceptions and the safeguards each one requires

Article 22(2) allows solely automated decisions in exactly three cases: when there is contract necessity, when there is legal authorization with appropriate safeguards, or when the data subject gives explicit consent. None removes the general duty to demonstrate compliance, and legal authorization must itself provide appropriate safeguards.

For the contract and consent exceptions, Article 22(3) establishes a minimum safeguard floor. The person must be able to obtain human intervention from the controller, express their point of view and provide additional context before the decision is final, and contest the decision. Contestation is not just a contact address. It requires an organization to make the decision sufficiently accessible to challenge, with a route through which a person’s objections can receive human consideration.

Special-category data imposes a further restriction on these permissions. Inputs including race, ethnicity, religion, biometric data, and health data are subject to the strictly limited circumstances in Article 9(2)(a) or (g), even where an Article 22(2) exception applies. An exception is not a general-purpose permission slip. The organization must establish the applicable permission, operate the required safeguards, and retain evidence that both were present.

Why the human oversight obligation is substantive, not formal

Human involvement changes the Article 22 analysis only when it is meaningful. A person who merely accepts an algorithm’s recommendation does not turn automated processing into substantive human judgment. The possibility of intervention becomes a substantive safeguard when evidence shows that someone actually reviewed the decision before it took effect.

Automation bias makes that distinction difficult to maintain. Reviewers who see an algorithmic output and recommendation may defer to them, leaving oversight formally present but substantively absent. Solozobov’s analysis finds that it is unclear how much human involvement is required and says it is almost impossible for someone outside the organization to prove that a human actually made the decision. A “human in the loop” diagram therefore establishes less than its reassuring arrows suggest.

The Foodinho/Glovo enforcement history illustrates the persistence of governance failures. The company’s later changes sat on top of a scoring and dispatch system the Garante had already found deficient. Review after an account suspension, loan refusal, or cancelled shift does not retroactively make the original decision human-reviewed, even though human intervention remains a safeguard under the lawful exceptions.

What the DPIA obligation demands across a system's lifecycle

Article 35(3)(a) requires a Data Protection Impact Assessment before Article 22 systems are deployed if they involve systematic and extensive evaluation that is likely to result in high risk. The assessment must address accuracy, bias and discrimination risk, transparency, data quality, and security.

Foodinho added biometric identity verification to its already deficient scoring and dispatch system without a fresh risk assessment covering the biometrics or the underlying system change. The assessment had not kept pace with the system. Material changes, including new data inputs, new model versions, or expanded scope, therefore require a fresh or updated DPIA.

Article 30 separately requires processing records that show what personal data is collected, why it is collected, and with whom it is shared. Regulators can ask for these records even if no incident has occurred. Decision logic must also be recorded in a form that supports contestation, because a person cannot meaningfully challenge an undocumented rationale. The Dun & Bradstreet ruling confirms that this logic must be disclosable to supervisory authorities. Version-controlled documentation connects those records to the system actually operating.

How the EU AI Act layers additional proactive obligations on top of GDPR's reactive framework

Its duties for high-risk systems take effect on December 2, 2027. The frameworks are not interchangeable. GDPR’s right to contest a decision cannot, by itself, satisfy the Act’s requirements for how a system is designed.

Article 14 requires high-risk systems to have human-machine interaction tools that give people enough oversight to deal with the risks those systems pose. GDPR already requires work before deployment through DPIAs, but the AI Act also requires oversight to be built into the system, beyond what a working contestation channel alone can provide.

The AI Act also requires Fundamental Rights Impact Assessments for high-risk systems in addition to DPIAs. Neither assessment substitutes for the other, although running them in parallel avoids duplicated work. AI used to manage workers in the gig economy falls into the Act’s Annex III high-risk category from 2 December 2027. Platforms of the kind involved in the Foodinho and Uber enforcement actions therefore face the full conformity-assessment regime as well as existing GDPR accountability duties. For that sector, the additional planning deadline is explicit.

Where the compliance model has genuine technical limits

Explainable AI is needed for contestation to work, but an explanation alone does not prove accountability. Alongside an explanation artifact, there must be real human oversight, a challenge process that works, a DPIA, and work to meet AI Act obligations. The institutional machinery must work as well. Otherwise, the organization has explained a decision without giving anyone an effective way to question it.

Agentic systems make that machinery harder to construct. Solozobov’s analysis identifies decision diffusion, where there is no single decision event to trace, and evidence fragmentation, where evidence is split across agents and APIs. It also identifies responsibility ambiguity, because delegation across orchestrators and plugins obscures who holds decision rights.

The same analysis finds that deterministic rule engines have almost all the required accountability properties built in, classical ML has very few, and agentic AI has structural breaks that need extensions built for that purpose. That is an assessment of the framework’s reach, leaving open whether such systems are capable of compliance. The distinction is important and limits the conclusion. Agentic decisions increasingly occur outside the window in which humans can reliably intervene, while fragmented decisions make even the location of a meaningful review point unclear. The field has not yet resolved how to supply the required evidence and control consistently in those conditions.

The UK divergence and the EU reform debate organizations need to track

The UK’s Data (Use and Access) Act 2025 changed the shared regulatory baseline. Section 80 came into force on 5 February 2026 and replaced UK GDPR Article 22 with Articles 22A to 22D. For most non-special-category personal data, solely automated decisions with significant effects are now permitted when controllers implement the required safeguards. Decisions based entirely or partly on special-category data remain subject to a stricter regime and are prohibited unless a specified condition is met.

The EU retains its prohibition-in-principle structure, so a system meeting UK requirements may not meet EU Article 22. The Commission’s Digital Omnibus proposal, COM(2025) 837, would have replaced Article 22(1) and (2) with a closed list of permitted solely automated decisions. It would also have treated contract necessity as applicable regardless of whether a decision could be taken by other means. That would have materially changed the permission boundary.

The EDPB and EDPS opposed key aspects in their Joint Opinion adopted on 10 February 2026. They said Article 22 must keep its prohibition, with exceptions only under specific conditions, and rejected wording that could allow automated decisions by default when a contract is involved. For planning purposes, organizations should distinguish the UK’s actual change from the EU’s contested proposal, without assuming that either framework will converge with the other.

What satisfying the accountability obligation structurally requires

The operational response is to build evidence capture into the decision pipeline. Every automated decision event needs a reproducible record of the inputs used, the logic applied, and the output produced. Solozobov’s decision trace schema sets out minimum evidence properties across different architectures. Records must also show whether the required safeguards worked when the decision was made. Logging that starts after a complaint cannot bring back evidence the system never kept.

Where human involvement is relied on to prevent a decision from being solely automated, it must be substantive and precede operational effect. When an exception allows automation, people must still be able to use their rights to intervention and contestation. Explanations must support a meaningful challenge. Decision logic must also be available to supervisory authorities despite trade-secret claims.

The DPIA must be kept up to date when inputs are added, models are updated, or the system’s scope grows, and the AI Act quality management obligation includes version-controlled documentation of the system. Runtime monitoring adds the forward-looking component by detecting anomalous behavior and departures from documented policy before violations accumulate. For agentic systems, that means being able to see what each agent does, keeping a complete audit log of actions, and having policy constraints that can be enforced before decisions take effect.