Does Article 22 GDPR apply when an employee only signs off on an algorithm's output?

Imagine you are the data protection officer (DPO) of a Dutch municipality. The Work and Income department uses a vendor's model that gives every social assistance file a risk score. Files above the threshold go to a review, sometimes with a home visit. Every morning an employee receives the list, rarely opens the files and clicks approve. According to the team there is no problem: "There is always a human in between, so Article 22 GDPR does not apply."

That is the question we hear most often about automated decisions. The short answer: what matters is not whether a human sits somewhere in the process, but what that human actually does.

Lesson 1: Article 22 has three conditions

The Court of Justice listed them in the SCHUFA judgment (C-634/21, paragraph 43). There must be a decision, that decision must be based solely on automated processing, including profiling, and it must produce legal effects concerning the data subject or similarly significantly affect them. The Court calls Article 22(1) a prohibition in principle whose infringement does not need to be invoked individually by the data subject (paragraph 52). So it is not a right that only comes into play once a resident objects.

A risk model in social assistance is profiling: it evaluates personal aspects to predict behaviour or someone's economic situation (Article 4(4) GDPR). The question then is mainly whether a genuine human decision remains.

Lesson 2: signing off is not human intervention

The guidelines on automated individual decision-making and profiling (WP251rev.01, endorsed by the European data protection authorities in the EDPB) are clear (pages 20 and 21). A controller cannot avoid Article 22 by fabricating human involvement. Someone who routinely applies automatically generated profiles to individuals, without any actual influence on the result, still takes a decision based solely on automated processing.

According to the guidelines, genuine intervention requires three things:

1. Oversight is meaningful, not just a token gesture.
2. It is carried out by someone who has the authority and competence to change the decision.
3. That person considers all the relevant data, not just the score.

The guidelines also ask controllers to record in the DPIA the degree of human involvement and at what stage it takes place. A DPIA is mandatory for such a model (Article 35(3)(a) GDPR). In our example the municipality falls short at least on meaningfulness and data: the employee rarely opens the files and clicks approve.

Lesson 3: the score itself can be the decision

SCHUFA concerned a credit agency that calculated a score, after which a bank decided on a loan. A restrictive reading would treat the score as a preparatory act and only the bank's decision as the decision. The Court rejected that reading: it would risk circumventing Article 22 and leave a lacuna in legal protection (paragraphs 61 and 62). Where a third party draws strongly on the score to decide how to act, establishing that score is itself a decision within the meaning of Article 22 (paragraphs 46 to 50 and the operative part).

SCHUFA concerns three parties. In a municipality, the model and the decision are usually in one hand, and the question is then whether the decision is based solely on automated processing. The guidelines answer that question: if the employee signs off without any actual influence on the result, the decision is solely automated. In our reading, the SCHUFA logic can weigh in as well: if what follows depends mainly on the score, establishing the score can itself count as the decision. What counts is the actual role of the score, not the organisation chart. A good test: how often does the employee deviate from the model, and can they explain why they did not in a specific file?

Lesson 4: a review can also significantly affect someone

That withdrawing or recovering a benefit produces legal effects is clear. The guidelines even cite entitlement to a social benefit granted by law as an example of a legal effect (page 21). The selection for a review is harder. On its own it often does not yet change the benefit. But Article 22 also covers decisions that similarly significantly affect someone. According to the guidelines that is the case when the decision has the potential to significantly affect someone's circumstances, behaviour or choices, to have a prolonged or permanent impact or, at its most extreme, to lead to exclusion or discrimination. The bar is high: the effect must be similar to that of a legal effect (page 21).

In our reading, a review with a home visit, a request for bank statements or a suspension of payments can significantly affect a person on social assistance. The Court has not yet ruled on this. Treat the selection as a moment that needs genuine human review, not only the final decision.

Lesson 5: Article 40 UAVG does not save a risk model

Article 22(2) has three exceptions: a contract, explicit consent, or Union or Member State law that authorises the decision and lays down suitable measures. Consent and contracts rarely fit a municipality deciding on a benefit. For the third route the Netherlands has Article 40 UAVG. Under paragraph 1, the prohibition in Article 22(1) does not apply where automated decision-making, other than on the basis of profiling, is necessary to comply with a legal obligation or to perform a task carried out in the public interest. Even then the municipality must take suitable measures to protect the resident's rights (paragraph 2). The minimum list in paragraph 3 (human intervention, expressing one's point of view and contesting the decision) only applies to controllers that are not administrative authorities. A municipality must therefore show itself that its safeguards, including objection and appeal, are suitable.

The words "other than on the basis of profiling" are the core. A simple calculation rule, such as automatically computing an allowance from an established income, can fall under Article 40. A risk model that scores residents is profiling and does not. Anyone who still wants to rely on Article 22(2)(b) must be able to point to another statutory provision that authorises such decisions and contains safeguards. If there is none, only one route remains: make sure there is a genuine human decision.

Lesson 6: make the intervention real, and be able to explain

Genuine human intervention is mostly a matter of organisation:

• Authority. The employee may deviate from the score, without having to justify that upwards.
• Information. They see the file and the data the score is based on, not just the number.
• Time. The number of files per day allows a substantive review.
• Measurement. Track how often employees deviate. If nobody ever does, that is a sign that in fact they only sign off.
• Reasons. The duty of care in Article 3:2 of the Dutch General Administrative Law Act (the necessary knowledge of the facts and interests) also applies to the selection, even if it is not a formal decision (Article 3:1(2)). The decision to withdraw or recover must also rest on proper reasons (Article 3:46). "The model gave a high score" is not a reason.

If the decision falls under Article 22 and no exception applies, it is prohibited (SCHUFA, paragraph 64). If an exception does apply, you inform residents in advance of the existence of automated decision-making (Articles 13(2)(f) and 14(2)(g) GDPR), give meaningful information about the logic involved on request (Article 15(1)(h)), and the decision may rest on special categories of data, such as health data in a welfare file, only under strict conditions (Article 22(4)). In Dun & Bradstreet Austria (C-203/22, 27 February 2025) the Court held that you must explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied to obtain the result. The Court mentions one option: explaining to what extent a different result would have been obtained with other data (paragraph 62). Invoking the vendor's trade secrets is not the end of it: you then submit the information to the supervisory authority or the court, which balances the interests. So agree with the vendor in advance on what explanation you can give.

What the AI Act adds

If the model is a high-risk system under Annex III, the AI Act applies on top. Annex III, point 5(a), covers systems intended to be used by or on behalf of public authorities to evaluate eligibility for benefits, or to reduce, revoke or reclaim them. In our reading, a selection model for reviews falls under it. Because it profiles, the municipality cannot rely on the exception in Article 6(3): an Annex III system that profiles is always high-risk (Article 6(3), last subparagraph). The provider must design the system so that the employee, as appropriate and proportionate, understands how it works, remains aware of the tendency to over-rely on the output ("automation bias") and can disregard or reverse the output (Article 14(4)). The municipality assigns oversight to people with the necessary competence, training and authority, who receive the necessary support (Article 26(2)), and informs residents that a high-risk system that makes or assists in making decisions about them is used on them (Article 26(11)).

These duties apply from 2 December 2027. If the system was already in use before that date, they only apply after a significant change in its design, and for systems intended to be used by public authorities by 2 August 2030 at the latest (Article 111(2)). The right to an explanation in Article 86 has formally applied since 2 August 2026, but in practice can only be invoked for a decision based on a high-risk system under Annex III. Article 86 only applies to the extent that Union law does not already provide such a right (paragraph 3). The GDPR does so through Article 15(1)(h), but only for decisions covered by Article 22. If the municipality organises genuine human intervention, the decision falls outside Article 22, but for an Annex III system the resident keeps the right to an explanation in Article 86. The GDPR applies today. You do not need to wait for 2027.

Our article on AI for fraud signals in social assistance sets out the DPIA and FRIA duties that come with such a model.

Also for banks, employers and schools

For a bank, SCHUFA is closest: if the credit decision depends mainly on a score, that score is the decision. The automatic refusal of an online credit application is the example in recital 71 GDPR. For employers, the same recital mentions e-recruiting practices without any human intervention. A recruiter who never looks at the candidates a system rejected is in fact only signing off. For a university that pre-selects admissions with a model, the guidelines cite access to education as an example of a decision that can significantly affect someone.

What to do now

1. For each algorithm, describe briefly what the employee does with the output: which data do they see, how much time do they have, may they deviate?
2. Measure how often employees deviate from the output. If (almost) never, treat the decision as automated.
3. Establish whether the model profiles. If so, Article 40 UAVG does not help.
4. Carry out the DPIA (mandatory for such a model) and record in it at which stage and how the human review takes place, as the guidelines ask.
5. Agree with the vendor on what explanation of the logic you can give residents.
6. Want to see quickly which duties apply to your use case? Run the case check.