Automated decision-making

What it means

Say you apply for a loan online and get an answer within seconds. No person has looked at your application. A system read your data and decided. That is automated decision-making: a decision made "through the processing of data by automated means and without review or intervention by a natural person," in the words of a United Nations policy.¹

The word matters most when the decision has real weight. Europe's data protection law gives people "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."²

Where the word comes from

We could not find a source we could open that shows who first used the phrase, so we start with the law that made it a term executives see every day. In April 2016 the European Union adopted the General Data Protection Regulation (GDPR).³ One of its articles has the title "Automated individual decision-making, including profiling."² The GDPR replaced an older European law: "Directive 95/46/EC is repealed with effect from 25 May 2018."³

Since then the meaning has widened. The GDPR is about decisions made "solely" by machines.² Canada's government guidance also covers decisions that a machine only helps to make: "A decision is partially automated when the system contributes to making the decision."⁴ California's privacy regulator, announcing new rules in 2025, says that "Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027."⁵ ADMT is short for automated decisionmaking technology.

How others define it

• European Union (GDPR, Article 22): "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."²
• United Nations Secretariat (ST/SGB/2024/1): "Automated decision-making is the process of making a decision through the processing of data by automated means and without review or intervention by a natural person."¹
• Government of Canada: "Automated decision systems include those that rely on artificial intelligence (AI) and other technologies." And: "A decision is partially automated when the system contributes to making the decision."⁴

Where they agree and differ

They agree that the core case is a decision about a person that a machine makes from data, with no person reviewing it.¹² They also agree that the answer is a person who can step in. Under the GDPR, where automated decisions are allowed, the organization must give "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision."²

They differ on how much of the decision the machine has to make. The GDPR and the UN cover decisions made solely by machine.¹² Canada's guidance also covers systems that only contribute.⁴ That gap matters for AI agents, because most of them advise people rather than decide alone.

The strongest opposing view is that automated decisions are not a problem in themselves. The GDPR agrees in part: it allows them when the decision "is necessary for entering into, or performance of, a contract," when law authorizes it with safeguards, or when it "is based on the data subject's explicit consent."² We take that seriously. Our view, which we are still testing, is that the safeguard counts for more than the ban: is there a person someone can turn to? If cases showed that systems with no person reviewing them treated people as fairly as systems with one, we would change our view.

In the news

The best-known recent case concerns credit scores. "On December 7, 2023, the Court of Justice of the European Union ("CJEU") ruled that credit scoring constitutes automated decision-making, which is prohibited under Article 22 of the EU General Data Protection Regulation ("GDPR") unless certain conditions are met."⁶ The case grew out of "consumer complaints against German credit bureau SCHUFA."⁶ The court found that "the company's reliance on fully automated processes to calculate creditworthiness and extend credit constitutes automated decision-making which produces a legal or similarly significant effect within the meaning of Article 22 of the GDPR."⁶ So a score can count as the decision even when a bank, not the score's maker, gives the final answer.

In the United States, California's privacy regulator announced on September 23, 2025, that state officials had approved rules covering "automated decisionmaking technology (ADMT)," with compliance required from January 1, 2027.⁵

What it means for your organization

If an AI agent screens applicants, scores customers, or approves claims, it may be making automated decisions under these laws, even when a person signs off at the end. The SCHUFA ruling shows that a score people rely on can count as the decision.⁶ The working rule is to keep a real person in the middle: someone who can review the decision, hear the person affected, and change the outcome. See [a person in the middle](/definitions/a-person-in-the-middle) and [human in the loop](/definitions/human-in-the-loop).

One question to ask your team: Which decisions about customers, employees, or applicants does a system make or shape today, and for each one, who can a person ask to review it?