AI agents and GDPR Article 22: no hard stop, no consent fix

A recruitment platform rolls out an agent that reads every incoming application, checks it against the vacancy criteria, writes to candidates who clearly do not qualify and books interviews for the rest. Nobody at the company looks at the rejections: the agent sends them itself, at two in the morning, with a friendly closing line. A month later a rejected candidate asks why. The HR lead looks at the legal team, the legal team looks at the vendor, and the vendor points to the terms, which say the candidate "consented" when uploading a CV.

That scenario sits right on top of a recurring debate. One camp says GDPR Article 22 is a hard stop: never let an agent take decisions that create or end legal arrangements with people. The other says there is a way through: collect explicit, informed consent from the customer before the agent starts. Both start from something true. The first correctly reads Article 22 as a prohibition rather than a right to object; the second points to an exception the GDPR really contains. But both conclusions are too absolute. The direct answer: Article 22 prohibits solely automated decisions with legal or similarly significant effects unless an exception applies; most agent actions are not such decisions, explicit consent is rarely the right exception, and whichever route you use, safeguards and the explanation duty remain.

What GDPR Article 22 actually says: a prohibition in principle

Article 22(1) gives the data subject "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". The phrasing as a "right" led many practitioners to treat it as an opt-out: the provision bites only when someone objects. That reading has not survived. In SCHUFA (C-634/21, 7 December 2023) the Court of Justice held that Article 22(1) lays down a prohibition in principle, the infringement of which does not need to be invoked individually by the person concerned (para 52). Such decisions are only allowed in the cases listed in Article 22(2), and then only if the safeguards in Article 22(3) and the limits in Article 22(4) are respected (paras 53 and 64).

This is not new doctrine invented for the AI age. The Article 29 Working Party guidelines on automated decision-making and profiling (WP251rev.01), endorsed by the EDPB in May 2018, already took the prohibition reading (pp. 19 and 20). The EDPB and EDPS confirmed it in their Joint Opinion 2/2026 on the Digital Omnibus (paras 66 and 67), adding that Article 22 is at the same time a right the data subject can invoke. So the "hard stop" camp is right on the starting point: an organisation that lets an agent take solely automated decisions with significant effects, without an exception, is in breach, whether or not anyone complains.

The official text, recitals and case law are collected on our Article 22 reference page. The harder question is how the three building blocks (a decision, solely automated, with legal or similarly significant effect) map onto a system that plans, calls tools and hands work to other agents.

Is an AI agent's action an automated decision under Article 22?

An agent does a lot of things that are not decisions about a person. The Spanish data protection authority (AEPD) makes this point explicitly in its guidance on agentic AI from a data protection perspective (version 1.1, February 2026, section V.F). Adding an agent to a processing operation "may involve automation", but it will not always involve automated decisions within the meaning of Article 22. Its example is an agent that tracks events on the internet, writes summaries and sends them to employees based on their declared interests: plenty of personal data, no Article 22 decision.

The AEPD then names a second category that is easy to overlook: "other automated actions". An agent that sends information by email or file transfer may never decide anything about anyone in the Article 22 sense, yet it can still harm the people whose data it handles; the same goes for deleting records or making payments. Those actions fall, in our reading, under Articles 5, 25 and 32; the AEPD asks for them to be covered in risk management and for reversibility to be designed in from the start. The alarm of the Dutch data protection authority (Autoriteit Persoonsgegevens, AP) about agents with broad system access, discussed in our piece on the AP warning about AI agent security risks, is an Article 32 problem, not an Article 22 one. Article 22 regulates a narrow and important slice of what agents do; the rest of the GDPR regulates everything else.

The broad concept of "decision" and agent chains

Where an agent does touch decisions, the concept is wider than many engineers expect. In SCHUFA the Court read "decision" broadly: it covers acts that may affect the data subject in many ways, and it includes a credit score when a third party draws strongly on that score to establish, implement or terminate a contract (paras 44 to 50 and 73). The Court rejected a narrow reading in three-party settings because it would leave a lacuna in legal protection: the party computing the score would escape Article 22 while the party relying on it would not have the information to comply (paras 61 to 63).

Applied to agents, in our reading, this has a clear consequence for orchestrator and sub-agent architectures. If a screening sub-agent produces a ranking or a "reject" flag and the orchestrator, or a downstream agent, acts on it more or less automatically, that intermediate output can itself be the Article 22 decision. Calling it "preparatory" does not help when, in practice, it determines the outcome. This draws on the logic of SCHUFA, but the transfer is not one to one. SCHUFA concerned two separate organisations; the reasoning carries over most directly where the screening or scoring step is run by a different controller, such as an external screening service. Within one organisation's own pipeline the practical point is the same: if no one genuinely reviews the intermediate output, the decision is solely automated end to end. This has not been tested by a court. It matches how the Commission's draft AI Act guidelines treat split architectures (more on that below). The reverse also holds: a pre-selection that only routes cases to meaningful human review is not itself a prohibited decision, as the AP noted in its 2024 advice discussed below.

The AP points in the same direction. In its prior-consultation advice (case 2025018225) on Microsoft 365 Copilot for the municipality of Haarlemmermeer, the AP takes the view that where a generative AI system plays a decisive role in decision-making, the decision is solely automated, and it asks for periodic checks that the human factor genuinely remains decisive.

"Solely automated": what meaningful human involvement looks like for agents

The easiest way out of Article 22 is not an exception at all. A decision that is not based solely on automated processing falls outside the prohibition. But the human involvement must be real. WP251 is blunt about this (p. 21): a controller cannot avoid Article 22 by fabricating human involvement. Oversight must be carried out by someone who has the authority and competence to change the decision and who considers all the relevant data. A person who routinely applies whatever the system produces, without any actual influence on the result, does not count.

The AEPD (section VII.F) lists criteria for assessing human intervention in agent workflows: competence and authority to alter the outcome, training, independence, diligence (in particular resistance to automation bias), and the means to act, meaning timely intervention points, the necessary information and enough time per decision. The AP's practical guidance on meaningful human intervention (Handvatten betekenisvolle menselijke tussenkomst, 23 July 2025) looks in the same way at the human, the technology and design, the process and the governance around the decision.

A reviewer who clears two hundred agent rejections in an hour, seeing only a one-line summary, is not meaningful involvement. A recruiter who sees the full application, the criteria applied and the agent's reasoning, and who regularly overturns agent proposals, probably is. How to measure that in practice is worked out in our article on meaningful human oversight in practice.

One distinction trips up many governance frameworks. Human involvement before the decision takes it out of Article 22 altogether. Human intervention under Article 22(3) is something else: a safeguard after a solely automated decision has been taken under the contract or consent exception. Saying that "human in the loop is always required" therefore overstates the law. The law allows fully automated decisions in the exception cases and, under contract or consent, then requires a route to a human afterwards.

The three exceptions, and why explicit consent is the weakest route for agents

Article 22(2) lifts the prohibition in three cases. The decision is necessary for entering into or performing a contract between the data subject and the controller (point a); it is authorised by Union or Member State law that also lays down suitable safeguards (point b); or it is based on the data subject's explicit consent (point c).

Contract necessity is narrower than it sounds. Necessity is a strict test: WP251 (p. 23) asks whether a less privacy-intrusive method could be used. It does accept that high volumes can make automation necessary, giving the example of a company that receives tens of thousands of applications for a vacancy and uses automated means to draw up a shortlist. Authorisation by law is mostly relevant to public bodies and regulated sectors, and in the Netherlands it is shaped by Article 40 of the GDPR Implementation Act (see below).

Which leaves explicit consent, the route the "consent fixes it" camp relies on. It is a genuine exception. But for agents it is usually the weakest one. Seven points explain why, and one of them shows when you cannot avoid it anyway.

First, consent must be freely given under Article 4(11) and Article 7. The EDPB Guidelines 05/2020 on consent (paras 21 and 22) state that employers processing data of current or future employees can rely on consent only in exceptional circumstances, because of the imbalance of power. An applicant who wants the job is rarely free to refuse. Article 7(4) adds that bundling consent with a service it is not necessary for weighs heavily against free consent.

Second, consent must be specific and informed. A single up-front consent covering whatever an autonomous agent later decides, with tools and sub-agents chosen at runtime, is in our reading hard to square with specificity. The more open-ended the agent, the less a person can know what they are agreeing to.

Third, consent can be withdrawn at any time, as easily as it was given (Article 7(3)). A controller that relies on consent therefore needs a non-automated route ready for everyone who withdraws. If that route exists anyway, the question becomes why consent was needed.

Fourth, and specific to agents: the user who consents to the agent cannot, as a rule, consent on behalf of other people the agent decides about (legal representation, such as parental responsibility, aside). When a company deploys a claims agent, the policyholder is the data subject. When a hiring manager uses a screening agent, the candidates are. Consent from the person instructing the agent is not consent from the person affected. This is our analysis rather than settled case law, but it follows directly from the definition of consent as an indication of the data subject's own wishes.

Fifth, special category data. Here consent is not an alternative but often an extra requirement. Article 22(4) allows decisions based on such data, such as health data, only with explicit consent under Article 9(2)(a) or a substantial public interest law under Article 9(2)(g), with suitable safeguards. A private controller using health data therefore usually needs explicit consent on top of contract necessity, with all the weaknesses above.

Sixth, recital 71 says that solely automated decisions with significant effects should not concern a child, and WP251 (p. 28) advises against relying on the exceptions for children.

Seventh, consent never cures other defects. A decision based on inaccurate data or an excessive data set remains unlawful under Article 5, consent or not, and consent does not lift the fairness and minimisation principles.

What you owe even when an exception applies: Article 22(3) safeguards and the right to an explanation

Once an exception applies, the work starts. Under the contract and consent exceptions (points a and c), Article 22(3) requires suitable safeguards, at least the right to obtain human intervention, to express a point of view and to contest the decision; under point b, the authorising law must itself lay down suitable safeguards. Articles 13(2)(f) and 14(2)(g) require you to tell people up front about automated decision-making, with meaningful information about the logic involved and its envisaged consequences; Article 15(1)(h) gives the same information on request.

Dun & Bradstreet Austria (C-203/22, 27 February 2025) turned that last duty into something with teeth. The Court described a genuine right to an explanation of the functioning of the mechanism behind an automated decision (para 57). The controller must explain, concisely and intelligibly, the procedure and principles actually applied, so that the person understands which of their data were used and how. Handing over a complex formula or a step-by-step technical dump is not enough (paras 58, 59 and 61). It may be sufficient to explain to what extent a variation in the personal data taken into account would have led to a different result (para 62). Where trade secrets or third-party data are at stake, the controller must provide the information to the supervisory authority or court, which balances the interests; a blanket national exclusion for trade secrets is not allowed (paras 74 to 76).

For LLM-based agents this has a design consequence that is hard to retrofit. If you cannot reconstruct which inputs, tools, sub-agent outputs and criteria led to a decision, you cannot give the explanation the Court requires or handle a contest. In our reading, decision logs and a record of which human approved what are the precondition for exercising the Article 22(3) rights in practice. The same logs are your evidence when something goes wrong, as discussed in who is responsible when an AI agent makes mistakes.

The Netherlands: why Article 40 UAVG rarely helps private agents

Dutch organisations sometimes look to Article 40 of the GDPR Implementation Act (Uitvoeringswet AVG, UAVG) as the national authorisation under Article 22(2)(b). Read the text closely. Article 40(1) lifts the prohibition only for automated individual decisions not based on profiling (anders dan op basis van profilering) that are necessary to comply with a legal obligation resting on the controller or to perform a task in the public interest. Article 40(2) requires suitable measures, and Article 40(3) adds that, for controllers that are not administrative bodies, suitable measures are in any event taken if the right to human intervention, to express a view and to contest the decision are guaranteed.

For a private HR, insurance or commerce agent this route is almost always closed. Those agents typically profile, which Article 40 excludes, and their decisions are rarely necessary to comply with a legal obligation. They are left with contract necessity or explicit consent. The AP's advice on Article 22 and automated selection tools of 10 October 2024 reads Article 22 as a prohibition in principle and sets out the narrow scope of Article 40 UAVG, mainly in the context of government selection tools.

Three agent use cases worked through

The analysis below applies the sources above to typical deployments. It is our reading, not a ruling, and every real deployment needs its own assessment.

HR screening agent

An agent that rejects applicants, or produces a ranking that recruiters adopt without real scrutiny, is a textbook Article 22 case: recital 71 names "e-recruiting practices without any human intervention". Explicit consent is weak because of the imbalance of power. Contract necessity can work for a first shortlist at very high volumes, following the WP251 example, but only if a less intrusive method would not do and the Article 22(3) safeguards are in place. The more robust design is genuine human review of every negative outcome.

The AI Act adds a second layer. AI systems intended for recruitment and selection, in particular to filter applications and evaluate candidates, are listed in Annex III point 4. Under Regulation (EU) 2026/1744, the high-risk obligations for standalone Annex III systems apply from 2 December 2027. An agent already in use before that date is caught only once its design changes significantly (Article 111(2)), which for frequently updated agents is likely; and because screening agents profile candidates, the Article 6(3) exemption does not apply. Which obligations fall on the company using a procured screening agent is set out in when are you a deployer of an AI agent.

Claims-handling agent

An insurer's agent that reads a claim, checks the policy and pays or refuses it takes a decision with legal effect when it refuses. Contract necessity is the natural exception: the decision is part of performing the insurance contract. But necessity still means the least intrusive effective option, and the Article 22(3) route must be real: a policyholder who contests a refusal reaches a claims handler who can actually change it. Health data in medical or disability claims triggers Article 22(4): contract necessity alone is then not enough, and the insurer needs explicit consent under Article 9(2)(a) or a substantial public interest law under Article 9(2)(g), with safeguards. Article 40 UAVG will rarely help a private insurer: claims handling is not a legal obligation or public task, and claims agents usually profile.

On the AI Act side, Annex III point 5(c) covers AI for risk assessment and pricing in life and health insurance, not claims handling as such. A pure claims agent is therefore not automatically high-risk, but an agent that also re-prices or re-assesses risk for life or health cover may be. Look at what the agent actually does, not what it is called.

Shopping and commerce agent

Agentic commerce has two sides, and Article 22 applies very differently to each. On the merchant or payment side, an automated refusal of an agent-initiated transaction because of a fraud score or a credit check is classic Article 22: recital 71 names the "automatic refusal of an online credit application". An AI system that assesses a consumer's creditworthiness, for example for buy-now-pay-later, falls under Annex III point 5(b), which excludes systems used to detect financial fraud.

On the user side, the question is genuinely open. When a consumer tells an agent to buy a product within a budget and the agent picks the offer and accepts the terms, is that a "decision concerning" the user taken by a controller, or the user's own delegated choice? No guidance or case law answers this yet. In our reading, the more the agent provider's own ranking and steering determine the outcome, the stronger the case that the provider decides about the user. Separately, Article 50(1) AI Act has applied since 2 August 2026, and the Commission's Article 50 guidelines (point 31) read it as requiring the provider to design such an agent to disclose that it is AI and on whose behalf it acts.

How the EU AI Act adds to Article 22 for agents

The AI Act does not replace Article 22; it stacks on top of it. The Commission's AI Act Service Desk FAQ states that AI agents are not a separate category: the rules for AI systems and general-purpose AI models apply to them as they are. Scope is covered in does an AI agent fall under the EU AI Act, the full picture in our guide to agentic AI under the EU AI Act.

Three points connect directly to Article 22. First, the Commission's draft guidelines on high-risk classification (19 May 2026, point 75) treat several AI systems that together materially influence an individual decision as one AI system, assess split architectures as a whole, and extend this to agentic AI systems. Point 90 adds that a component which would otherwise qualify for the Article 6(3) filter, for example a narrow procedural task, cannot rely on it within such a configuration; point 76 keeps strictly procedural or preparatory functions eligible only where they are genuinely separable and do not feed outputs that materially influence the individual decision. That is the AI Act counterpart of the SCHUFA chain logic. The guidelines are still a draft. Second, under the last subparagraph of Article 6(3), an Annex III system that performs profiling within the meaning of GDPR Article 4(4) is always high-risk. Third, human oversight under Article 14 and the deployer's oversight duty under Article 26, which apply to Annex III systems from 2 December 2027, are not the same as Article 22 human involvement, but one well-designed oversight process can serve both, as explained in Article 14 human oversight under the EU AI Act.

Transparency is already live. Article 50 has applied since 2 August 2026, and the Commission's Article 50 guidelines of 20 July 2026 (C(2026) 5054, point 31) state that AI agents fall under Article 50(1) when they can interact with the people instructing them or with other natural persons while carrying out tasks such as bookings, correspondence, negotiating or concluding contracts and purchases. They must be designed to disclose both their artificial nature and the person on whose behalf they act, also within multi-agent architectures.

Finally, Article 86 gives people affected by a decision based on certain high-risk Annex III systems (point 2 excluded) a right to obtain from the deployer a clear and meaningful explanation of the role of the AI system. In practice this right follows the Annex III high-risk regime, which applies from 2 December 2027. Article 86(3) makes it subsidiary: it applies only where Union law does not already provide that right. For decisions within Article 22, the GDPR explanation route as interpreted in Dun & Bradstreet therefore comes first.

What could change: the Digital Omnibus and the UK contrast

Even under the Commission text, the Article 22(3) safeguards would stay. The proposal and the regulators' response are tracked on our page on the Omnibus changes to automated decisions.

The United Kingdom has already moved: the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A to 22D, in force for decisions taken from 5 February 2026, permitting significant solely automated decisions more widely with safeguards and tighter limits for special category data. It shows that the prohibition is a legislative choice; under the EU GDPR, that choice still stands.

Decision tree: how to check an AI agent against Article 22

Run each agent, and each type of action it can take, through five questions.

How to scope that assessment is covered in when a DPIA is required for AI systems and, where both instruments apply, our practical comparison of the DPIA and the FRIA. For a first structured answer on a concrete case, the case check runs through the GDPR and AI Act questions and can export a DPIA intake. The wider control set for agents (permissions, oversight model, logging, kill switch, review and register) is in agentic AI governance, and the official text with its own decision tree is on the Article 22 reference page. How to make that test a fixed step in the privacy function you already have, with an AI intake and the DPO in an oversight role, is covered in AI governance through the privacy function.

Back to the recruitment platform from the opening. The "consent" in its terms would not have saved it: the candidates were not free to refuse, the consent was not specific, and there was no route to a human. The fix is not to switch the agent off, but to let it shortlist and draft while a recruiter with the full file decides every rejection, with a log that answers the next candidate who asks why. If you want a second pair of eyes on an agent design like this, from the Article 22 analysis to the DPIA and FRIA, you can hire Zahed Ashkara as an AI and privacy legal adviser.