What is automated decision-making?
Automated decision-making (ADM) is the use of software, whether a rules engine, a statistical model, or an AI system, to reach a decision without meaningful human involvement. In data protection law the term refers to decisions about individuals, such as approving credit, pricing an insurance policy, rejecting a job application, or closing an account. ADM often relies on profiling, the automated evaluation of personal characteristics such as creditworthiness or reliability.
The test is whether a person genuinely weighs the case. A reviewer who confirms every recommendation without the information or authority to disagree does not make the decision human. A decision support system that informs a person who makes the real choice generally falls outside the definition.
Why automated decision-making matters
Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on them. Such a decision is permitted only when it is necessary for a contract with the person, authorized by EU or member state law, or based on explicit consent. In the contract and consent cases, the organization must at least let the person obtain human intervention, express a point of view, and contest the decision. Decisions based on sensitive data such as health information face tighter limits, and people must be told when ADM is used and given meaningful information about the logic involved.
The EU Court of Justice has ruled that a credit score can itself be an automated decision when a lender relies heavily on it. The EU AI Act adds a right to an explanation for decisions based on many high-risk systems, and several US state privacy laws let consumers opt out of profiling used for significant decisions.
Automated decision-making in practice
A consumer lender approves small personal loans online within seconds and relies on the contract exception. Declined applicants receive the main reasons for the outcome and a way to request review by a credit analyst, who can reverse the decision. The lender’s data protection impact assessment records the model, the legal basis, and how often analysts overturn declines.
What to watch for
- Map every point where a model’s output determines an outcome for a person, including scores that staff almost never override.
- Give reviewers enough information and authority to change the outcome, or regulators may treat the decision as solely automated.
- Prepare a plain-language explanation of the main factors behind a decision before the first request arrives.
- Check whether the same system is high-risk under the EU AI Act, which adds its own oversight and documentation duties.