# Standards and Regulatory References — AI Automated Decisions

## Primary Legislation

### GDPR — Automated Decision-Making

- **Art. 22(1)**: The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
- **Art. 22(2)**: Paragraph 1 shall not apply if the decision is (a) necessary for a contract, (b) authorised by Union or Member State law, or (c) based on explicit consent.
- **Art. 22(3)**: In cases (a) and (c), the controller shall implement suitable measures to safeguard data subject rights including at least the right to obtain human intervention, to express his or her point of view, and to contest the decision.
- **Art. 22(4)**: Decisions under paragraph 2 shall not be based on special categories of data unless Art. 9(2)(a) or (g) applies and suitable measures are in place.
- **Art. 4(4)**: "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.
- **Art. 13(2)(f)**: Information to data subjects must include existence of automated decision-making and meaningful information about logic involved.
- **Art. 15(1)(h)**: Right of access includes information about automated decision-making and meaningful information about the logic involved.
- **Recital 71**: The data subject should have the right not to be subject to a decision evaluating personal aspects concerning him or her. Such processing should be subject to suitable safeguards including specific information, right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached.

### EU AI Act

- **Art. 14(1)**: High-risk AI systems shall be designed to be effectively overseen by natural persons during the period they are in use.
- **Art. 14(2)**: Human oversight shall aim to prevent or minimise risks to health, safety, or fundamental rights.
- **Art. 14(3)**: Oversight measures shall enable the individual overseeing to: (a) fully understand capabilities and limitations, (b) properly monitor, (c) detect anomalies, (d) correctly interpret outputs, (e) decide not to use or override, (f) intervene or stop.
- **Art. 14(4)**: Human oversight measures shall be commensurate with the risks, level of autonomy, and context of use.
- **Art. 86**: Right to explanation of individual decision-making — affected persons have the right to clear and meaningful explanations of the role of the AI system and main decision elements.

## EDPB Guidance

### EDPB Guidelines 06/2020 — Automated Decision-Making and Profiling (WP251rev.01)

Key provisions:
- Art. 22 applies when the decision is based "solely" on automated processing — nominal human involvement does not remove Art. 22 applicability.
- "Meaningful human intervention" requires the reviewer to have authority, competence, and genuine ability to change the decision.
- "Similarly significantly affects" includes denial of services, price discrimination, systematic targeting, effects on health, financial circumstances, or access to education.
- Controllers relying on exceptions must implement Art. 22(3) safeguards as a minimum.
- Explanation of logic should enable the data subject to understand the reasons behind the decision and challenge it.
- Right to explanation exists both proactively (Art. 13-14 at time of data collection) and reactively (Art. 15 right of access).

### EDPB Guidelines 04/2025 — AI Processing

- AI model outputs feeding directly into decisions trigger Art. 22 assessment.
- Foundation model outputs may constitute profiling where they evaluate personal aspects.
- Human oversight of AI decisions must be designed to counteract automation bias.
- The EDPB emphasises that the mere presence of a human in the process does not automatically exclude Art. 22 applicability.

## National DPA Guidance

### ICO — Rights Related to Automated Decision-Making and Profiling (2023)

- Provides detailed guidance on when automated AI decisions trigger Art. 22.
- Defines meaningful human involvement as requiring genuine discretion and authority.
- Recommends documenting the human oversight process and measuring its effectiveness.
- Override rates below 5% may indicate that human review is not meaningful.

### CNIL — Automated Decision-Making Recommendations (2023)

- Emphasises proportionality of automated decisions to the purpose.
- Requires contestation mechanisms to be accessible and effective.
- Recommends tiered human oversight based on decision severity.

### BfDI (Germany) — AI and Art. 22 Position (2024)

- AI-driven employment decisions (screening, performance evaluation) trigger Art. 22.
- Works councils must be consulted on AI deployment in the workplace.
- Employees must be informed about AI involvement in employment decisions.

## Technical Standards

### ISO/IEC 42001:2023 — AI Management System

- Section 8.4: Requirements for human oversight in AI system operation.
- Annex B: Risk assessment for automated decision-making.

### IEEE 7001-2021 — Transparency of Autonomous Systems

- Provides framework for designing human oversight of autonomous decision-making systems.
- Levels of transparency and oversight appropriate to different autonomy levels.

## Enforcement Decisions

- **AEPD v. CaixaBank (PS/00421/2020, 2021)**: EUR 6M — automated credit decisions without Art. 22 safeguards.
- **Italian DPA v. Deliveroo (2021)**: EUR 2.5M — algorithmic worker management constituted Art. 22 automated decision-making.
- **Dutch Court v. SyRI (2020)**: Automated fraud detection system struck down — no meaningful human oversight.
- **Austrian DPA v. CRIF (2023)**: Automated credit scoring without meaningful explanation of logic.
- **Hungarian DPA v. Bank (2019)**: Automated credit denial without contestation mechanism or logic explanation.
- **French Conseil d'Etat v. Parcoursup (2019)**: University admissions algorithm upheld because meaningful human review was conducted.
- **Polish DPA (ZSPR.421.25.2019, 2019)**: PLN 943K fine for automated scoring without Art. 14 transparency or Art. 22 safeguards.