What it asks for. Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Exceptions exist where the decision is necessary for a contract, authorised by law or based on explicit consent, but in the contract and consent cases the controller must provide safeguards, including at least the right to obtain human intervention, express a view and contest the decision.
In practice. Organisations identify automated decisions in their processing, assess whether they fall within the article and, where they do, provide meaningful human review and a way to challenge outcomes. Transparency obligations require meaningful information about the logic involved. Evidence includes an inventory of automated decisions, DPIAs and records of human reviews.
Common gaps. Human involvement is sometimes nominal, with reviewers who approve outputs without real authority. The use of AI models in hiring, credit or fraud decisions is often not assessed against this article.