How do we show that a human made the decision? GDPR Article 22 and AI

GDPR and AILast updated 11 October 20266 min read

Short answer

If a decision has legal or similarly significant effects on a person – turning down a job application, for example – it must not be based solely on automated processing (Article 22 GDPR). A human with the competence and authority to do so must genuinely assess the case and be able to go against the AI's recommendation. Record who decided, when, on what basis and why. From 2 December 2027, the EU AI Act also requires human oversight of high-risk AI such as recruitment.

When does Article 22 apply?

Article 22 GDPR covers decisions based solely on automated processing that have legal or similarly significant effects on the person. Turning down a job application, a dismissal or a pay decision are typical examples. GDPR itself mentions e-recruiting without any human intervention.

If you let the AI screen out applicants without a human genuinely looking at the case, you are in Article 22 territory. If the AI recommends and a human decides, you are not – provided the human actually assesses the case.

What is a meaningful human assessment?

It is not enough for a human to sign off on what the AI has decided. The European data protection authorities' guidelines point to three things:

The person has the authority to change the decision.
The person has the competence to assess the case.
The person considers all the relevant information – not just the AI's conclusion.

That is why GoalCube Human Decision shows the facts of the case next to the AI's recommendation, one case at a time, and the human can approve, choose a different decision or ask for more information. Try it:

GoalCube Human DecisionFictitious data

Case 1 of 3Position: Financial controller

Case facts

Louise Brennan

Current title: Senior controller
Experience: 12 years
CV: Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.

The AI’s recommendation

Invite to interview

Reasoning: 12 years' experience in budgeting and reporting, has implemented an ERP system and comes from a manufacturing company.

Audit log

Decisions are saved here with the time and a timestamp.

Fictional candidates. In GoalCube, the decision also requires a passkey, and the log gets an independent timestamp.

What does the EU AI Act require?

AI for recruitment and for decisions about employment relationships is high-risk under the AI Act (Annex III, point 4). Following the Digital Omnibus, the rules apply from 2 December 2027. Businesses that use such AI must, among other things:

assign human oversight to people with the necessary competence, training and authority (Article 26)
inform workers' representatives and the affected workers before AI is put into use in the workplace (Article 26)
be able to give an explanation to anyone affected by a decision (Article 86)

The AI system must also be designed so that humans can oversee it and stay aware of the risk of relying too much on the AI (Article 14).

What do you need to be able to show?

If an applicant, an employee or a supervisory authority asks, you need to be able to answer:

Question	What you need to have stored
Who decided the case?	Name or role and a secure login, such as a passkey
When?	The time, ideally with an independent timestamp
On what basis?	The facts of the case and the AI's recommendation with reasons
Why?	The human's decision and reasons
Could it have been changed afterwards?	A log that cannot be changed without it showing

What to do

Find where AI helps with decisions about people.Typically recruitment, promotion, dismissal, pay, task allocation and customer cases that end in a refusal.
Let the AI recommend – not decide.The AI may prepare the case and give a recommendation with reasons. The decision belongs to a human.
Choose who decides.The person must know the area and be allowed to go against the AI's recommendation. Clicking 'approve' on autopilot is not enough.
Show the facts next to the recommendation, one case at a time.The person deciding must see the basis – not just the AI's conclusion – and have time to assess each case.
Store the decision so it cannot be changed afterwards.Who, when, what the AI recommended, what the human decided and why. An independent timestamp makes it stronger.
Tell the people affected.They have the right to know that AI is involved, to have a human look at the case and to contest the decision.

What the law says

Article 22 GDPR – automated individual decision-making: The right not to be subject to a decision based solely on automated processing where it has legal or similarly significant effects. The exceptions require, among other things, the right to human intervention and to contest the decision.
Recital 71 GDPR: Mentions e-recruiting practices without any human intervention as an example.
Articles 13, 14 and 15 GDPR: People must be told about automated decision-making and given meaningful information about the logic involved.
Annex III, point 4, AI Act – employment: AI for recruitment and selection, and for decisions about employment relationships, is high-risk. Following the Digital Omnibus, the rules apply from 2 December 2027.
Articles 14 and 26 AI Act – human oversight: High-risk AI must be designed so that humans can oversee it, and the business must assign oversight to people with the necessary competence, training and authority. Staff must be informed before AI is put into use in the workplace.
Article 86 AI Act – right to explanation: A person affected by a decision based on high-risk AI can obtain a clear explanation of the AI's role and the main elements of the decision.

Questions and answers

Is it enough for a manager to click 'approve'?

No, not if approval is a mere formality in practice. According to the European data protection authorities' guidelines, the human assessment must be meaningful: the person must have the authority and competence to change the decision and must consider all the relevant information.

Does this apply to small businesses too?

Yes. Article 22 GDPR applies regardless of the size of the business, and it already applies today. The EU AI Act's rules for high-risk AI apply from 2 December 2027.

Is an AI score a decision, even if a human signs off?

It can be. In the SCHUFA case (C-634/21) in 2023, the Court of Justice of the EU held that an automatically calculated score can itself be a decision if it plays a decisive role in the final outcome.

Should we keep the AI's recommendation?

It's a good idea. It lets you show that the human assessed the case – even when the human agreed with the AI – and explain the decision if the person asks.

What if the human disagrees with the AI?

Then the human decides differently and writes down why. That is exactly what shows the assessment is real. The AI must never change the human's decision afterwards.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.