Automated yes/no decisions about people: a GDPR Article 22 decision sheet for small EU businesses using AI (credit checks, CV filters, fraud blocks, personal prices)
What you get: a finished automated decision sheet: 17 lines to fill in once for each automated yes/no your business makes about a person (a credit or pay-later check, a CV filter, a fraud block, a personalised price, a shift-allocation tool), each tied to the GDPR, EU AI Act or Court of Justice source it rests on. Plus a two-question test for whether Article 22 applies, paste-ready notice and reply lines, an explanation pack template for "why did your system say no?" requests, a decision list with three made-up rows, and a short list of what to do this week.
The short answer
The GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them (Article 22(1)). Recital 71 gives two everyday examples: automatic refusal of an online credit application, and e-recruiting without any human intervention. Such a decision is only allowed if it is necessary for a contract with the person, authorised by EU or national law with safeguards, or based on explicit consent (Article 22(2)). In the contract and consent cases you must at least offer human intervention, a way for the person to express their view and a way to contest the decision (Article 22(3)), and you must tell people about it up front (Articles 13(2)(f) and 14(2)(g)).
Two Court of Justice rulings matter for small businesses. In SCHUFA (C-634/21, 7 December 2023) the Court held that an agency's automated credit score is itself an automated decision where the business that receives it draws strongly on it to establish, implement or terminate a contract. In Dun & Bradstreet Austria (C-203/22, 27 February 2025) it held that a person asking about an automated decision is owed an explanation of the procedure and principles actually applied to their data, concise and intelligible, and that a complex formula or a description of every technical step is not enough.
The EU AI Act adds a second layer only for some uses: hiring and worker management, creditworthiness of individuals and life or health insurance pricing are high-risk under Annex III. After the Digital Omnibus on AI, the high-risk duties for these uses apply from 2 December 2027 (Article 113(c)(i)). The GDPR rules above apply now.
Two-question test: is this an Article 22 decision?
- Is it solely automated? Yes, unless a person with the authority and skill to change the outcome actually reviews each case before it takes effect. Rubber-stamping, or a person who always follows the score, counts as automated. A bought-in score you rely on strongly counts too (SCHUFA).
- Does it have a legal or similarly significant effect? Yes for refusing credit or pay-later, rejecting a job applicant, ending a contract, cutting someone off from a service they depend on, or decisions about housing, work or education. Usually not for an ordinary product recommendation; write down your reasoning for anything in between.
Two yes answers: fill all 17 lines below. One or no yes: still fill lines 1 to 5 and 13, so you can show why Article 22 does not apply, and keep the normal GDPR duties (legal basis, notice, access requests) in place.
Automated decision sheet (fill once per decision)
| # | Line | What to write down | Source |
|---|---|---|---|
| 1 | The decision | Write it as a yes/no or a number about one person: 'approve purchase on invoice', 'reject job application at screening stage', 'block customer account', 'set this customer's price', 'assign weekend shifts'. | Art. 22(1) GDPR; Art. 4(4) (profiling) |
| 2 | About whom | Customers who are individuals or sole traders, job applicants, staff, tenants. Decisions about companies only are outside the GDPR unless they turn on data about a named person (for example a sole trader or the director's own credit record). | Art. 4(1) GDPR (personal data) |
| 3 | Tool and supplier | Name the AI tool, scoring service or rule engine, and who supplies it. Note whether you buy in a score (credit agency, fraud tool) or the tool decides inside your own system. | Art. 28 GDPR (processor) or separate controller; your AI register entry |
| 4 | Solely automated? (Y/N) | Answer Y unless a person reviews each case before it takes effect, has the authority and skill to change the result, and actually looks at the case rather than clicking 'confirm'. The WP29 guidelines endorsed by the EDPB say token human involvement does not count. A bought-in score you 'draw strongly' on counts as automated (SCHUFA, C-634/21). | Art. 22(1); WP29 guidelines on automated decision-making (WP251rev.01); CJEU C-634/21 |
| 5 | Legal or similarly significant effect? (Y/N/unsure) | Y for refusals of credit or pay-later, job rejections, contract terminations, account bans that cut someone off, and anything that decides access to housing, work, education or essential services. A cancelled single order or a marketing segment is usually lower impact; write down why you said N. | Art. 22(1); recital 71 (online credit refusal, e-recruiting examples) |
| 6 | If 4 and 5 are both Y: which exception | Pick one and write the reason: (a) necessary to enter into or perform a contract with this person; (b) authorised by EU or national law that also sets safeguards; (c) the person's explicit consent. If none fits, put a person in the loop (row 4 becomes N) or stop the automated decision. | Art. 22(2)(a)-(c) |
| 7 | Special category data used? | Health, ethnicity, religion, union membership, biometrics, sex life or orientation, or close proxies for them. If yes, an Article 22 decision needs explicit consent or a substantial-public-interest law plus safeguards. Simplest: remove those inputs. | Art. 22(4); Art. 9(1), 9(2)(a) and (g) |
| 8 | Human review route | Name the person or role who re-checks a case on request, how fast (for example 5 working days), and the contact. The minimum for exceptions (a) and (c): human intervention, a way to give their view, a way to contest. | Art. 22(3); Art. 12(3) (one month to act on requests) |
| 9 | Notice before the decision | Add a line to the application form, checkout or job ad that automated decision-making is used, the main logic in plain words, and what it means for the person. Use the paste-ready lines below. | Art. 13(2)(f); Art. 14(2)(g) if data come from elsewhere |
| 10 | Explanation pack | Prepare a half-page per decision: which data are used, the 3 to 5 factors that matter most and in which direction, what a person can do to change the outcome, and how to ask for a human. This is what you send when someone asks why. | Art. 15(1)(h); CJEU C-203/22 Dun & Bradstreet Austria, paras 58-59 |
| 11 | Right to object | If you rely on legitimate interests for the profiling, people can object and you must stop unless you show compelling grounds. Profiling for direct marketing stops on request, no balancing. | Art. 21(1)-(2) |
| 12 | DPIA | A DPIA is required for systematic and extensive evaluation of personal aspects based on automated processing on which decisions with legal or similarly significant effects are based. If row 4 and 5 are Y, do one. Check your national authority's DPIA list too. | Art. 35(3)(a); Art. 35(4) |
| 13 | EU AI Act high-risk flag | Mark Y if the tool is used for: recruitment or selection, filtering applications, evaluating candidates (Annex III 4(a)); decisions on promotion, termination, task allocation or monitoring of workers (4(b)); creditworthiness or credit scores of individuals, except fraud detection (5(b)); life or health insurance risk and pricing for individuals (5(c)). If Y, run the high-risk check: deployer duties apply from 2 December 2027. | AI Act Annex III; Art. 113(c)(i) as amended by the Digital Omnibus |
| 14 | AI Act notice and explanation (if row 13 = Y) | From 2 December 2027, tell people that a high-risk system is used in decisions about them (Article 26(11)) and tell workers and their representatives before using one at work (Article 26(7)). Article 86 gives a right to a clear explanation of the AI's role in a decision with adverse effects, but only where EU law such as the GDPR does not already give that right (Article 86(3)). | AI Act Art. 26(7), 26(11), 86 |
| 15 | Consumer credit flag | If you give consumers credit or pay-later terms yourself, the new Consumer Credit Directive applies through national law from 20 November 2026: where a creditworthiness assessment is automated, the consumer can ask for human intervention, an explanation, to give their view and a review. Check your national transposing law and whether your offer is in scope. | Directive (EU) 2023/2225, Art. 18(8)-(9), Art. 48(1) |
| 16 | Personalised prices | If an algorithm sets a price for this customer based on their profile, the online offer must say that the price was personalised on the basis of automated decision-making. Check the official source for your country's wording. | Directive 2011/83/EU Art. 6(1)(ea), inserted by Directive (EU) 2019/2161 |
| 17 | Review log | Every quarter: number of automated refusals, number of human reviews requested, how many were changed, any complaints. A high change rate means the tool or its inputs need fixing. | Accountability Art. 5(2), 24; accuracy Art. 5(1)(d) |
Keep the filled sheet with the tool's entry in your AI register, together with the supplier's description of how the tool works. If a supplier cannot tell you the main factors its score uses, you will not be able to answer an Article 15(1)(h) request; record that and ask them in writing (see the AI vendor questions).
Paste-ready lines
Notice line (application form, checkout or job ad)
We use automated checks, including [a credit score from [agency] / an AI screening tool from [supplier]], to decide [whether we can offer purchase on invoice / which applications go to interview]. The main factors are [for example: payment history with us, the address check, the score from [agency]]. If the result is a no, you can ask a member of our team to look at your case again, tell us your side and challenge the decision by writing to [contact] within [30] days. More information: [link to privacy notice].
Reply when someone asks "why did your system say no?"
Thank you for your message. Your [application / order on invoice] was assessed automatically using [tool]. The decision was mainly based on: [factor 1, and how it counted], [factor 2], [factor 3]. The data we used were [list] from [source]. [Name/role] has now reviewed your case [and confirmed / changed] the result because [reason]. If you disagree, you can reply with any information you want us to consider, or complain to [your data protection authority].
The reply follows what the Court described in C-203/22: the procedure and principles actually applied to this person's data, in plain words. Check the official source and adapt to your case; national law may add rules.
Explanation pack template (half a page per decision)
- Purpose: what the decision is for, in one sentence
- Data used: each input and where it comes from (form, your records, agency, device data)
- Main factors: the 3 to 5 inputs that move the result most, and in which direction
- Thresholds: in words, for example "a score below the supplier's 'high risk' band leads to a refusal of invoice payment; other payment methods stay available"
- What the person can do: correct wrong data, give context, choose another option
- Human review: who, how fast, how to ask
- Not used: list inputs you deliberately excluded, such as health data or nationality
Decision list (one row per automated decision)
| Decision | Tool | Solely automated? | Significant effect? | Exception / person in loop | Human review contact | AI Act Annex III? | Next review |
|---|---|---|---|---|---|---|---|
| [purchase on invoice for consumers] | [pay-later provider's credit check] | [Y] | [Y: refusal of credit] | [22(2)(a) contract; review route set up] | [orders@...] | [5(b) if the score is about the individual: check, from 2 Dec 2027] | [Jan 2027] |
| [CV screening for warehouse jobs] | [ATS ranking feature] | [N: manager reads every CV before rejecting] | [Y] | [person in loop, logged] | [jobs@...] | [4(a): yes, high-risk check before 2 Dec 2027] | [Dec 2026] |
| [fraud screening at checkout] | [payment provider's fraud tool] | [Y] | [usually N for one cancelled order; Y if accounts are blocked] | [22(2)(a) for blocks; manual review queue] | [support@...] | [N: fraud detection is excluded from 5(b)] | [Mar 2027] |
The three rows above are made-up examples to show how to fill the list, not legal conclusions for your business.
Do this week
- List every place a tool says yes or no about a person without someone reading the case first (SME AI inventory template)
- Run the two-question test on each and fill the sheet for the double-yes ones
- Add the notice line to the form, checkout or job ad, and the paragraph to your privacy notice
- Name the human reviewer and test the route once with a made-up request
- Ask each supplier for its main factors in writing and build the explanation pack
- If you offer consumer credit or pay-later terms yourself, check your national law implementing Directive (EU) 2023/2225 before 20 November 2026
- For hiring, worker-management, credit or insurance tools, run the Annex III high-risk check and plan for 2 December 2027
This sheet is a starting point, not a legal opinion or proof of compliance. AI Act references were checked on 20 October 2026 against the consolidated text on the Commission's AI Act Service Desk (including the Digital Omnibus amendments: Articles 26, 86, 113 and Annex III). The CJEU rulings were checked against the judgment texts published on EUR-Lex (C-634/21 operative part and para 73; C-203/22 paras 55-60). GDPR references are to Regulation (EU) 2016/679; the EUR-Lex GDPR page did not load from our checker on 20 October, so check the official source for exact wording, and check whether any later amendments to Article 22 proposed by the Commission have been adopted. The Consumer Credit Directive applies through national laws, so dates and scope can differ in practice. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often do not see a pay-later check, a fraud filter or an applicant-tracking ranking as "a decision". At the next review, ask the two questions for each tool they use with customers, applicants or staff, hand over this sheet with the client AI inventory workshop, and flag clients that extend credit to consumers for the 20 November 2026 date. Stay inside your professional rules and pass legal drafting to a lawyer.
Keep the sheet with your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each decision tool once, pick your role (usually deployer), and store the filled decision sheet, the notice and the explanation pack as evidence records against it.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill one decision sheet per automated yes/no. Related: Annex III high-risk check · human oversight log · staff and applicant notice · provider or deployer check · AI Act deadline sheet.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 4(4), 5, 9, 12, 13(2)(f), 14(2)(g), 15(1)(h), 21, 22, 24, 28, 35 and recital 71
- CJEU, Case C-634/21, SCHUFA Holding (Scoring), judgment of 7 December 2023
- CJEU, Case C-203/22, Dun & Bradstreet Austria, judgment of 27 February 2025
- Article 29 Working Party: Guidelines on automated individual decision-making and profiling (WP251rev.01), endorsed by the EDPB
- European Commission AI Act Service Desk: Annex III, high-risk AI systems (points 4 and 5)
- AI Act Service Desk: Article 26, obligations of deployers (paragraphs 7 and 11)
- AI Act Service Desk: Article 86, right to explanation of individual decision-making
- AI Act Service Desk: Article 113, application dates (as amended)
- Directive (EU) 2023/2225 on credit agreements for consumers: Article 18(8)-(9), Article 48(1), recital 56
- Directive (EU) 2019/2161, inserting point (ea) in Article 6(1) of Directive 2011/83/EU (personalised prices)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.