Automated Decision-Making (ADM)

A decision-making process — typically affecting an individual — produced solely or significantly by automated processing of personal data. Hub concept for the legal-risk cluster.

Definitions across regimes

Regime	Definition / scope
GDPR Art. 22	Decision based solely on automated processing (incl. profiling) producing legal or similarly significant effects
CCPA proposed § 7001(f)	"Automated Decision-Making Technology" (ADMT) — tools that replace human judgment or are a key factor in significant decisions; excludes mere assistive systems
EU AI Act	"AI system" definition (Art. 3) — systems generating output influencing decisions; "high-risk AI systems" subject to Art. 14 oversight obligations
Council of Europe (Conv. 108+)	Right not to be subject to a decision significantly affecting one without one's views taken into consideration

ADM is hybrid socio-technical

Per Lazcoz & de Hert 2023 (citing Spielkamp 2019): ADM systems are hybrid systems, involving humans and artificial agents in a particular socio-technological framework. The proliferation of AI is automating decision-making in more and more domains, with increasing reliance on delegation of tasks coupled with an expectation of trust in such delegation.

Three types of ADM decisions (per Art. 22 framing)

No-Art. 22 decisions — no legal/significant effect → out of scope (e.g. routine product recommendations).
Art. 22(1) decisions — solely automated + legal/significant effect → prohibited unless prior meaningful human intervention.
Art. 22(2) decisions — meet contractual necessity / explicit consent / law-authorisation exception → allowed, but require Art. 22(3) safeguards.

Examples in process-automation

Credit scoring (CJEU SCHUFA C-634/21) — qualifies as Art. 22 ADM even when scoring is performed by a third-party vendor.
Loan and insurance underwriting — Art. 22 + likely high-risk AI Act.
Employment decisions — recruitment, promotion, dismissal — Art. 22 + AI Act high-risk Annex III.
Platform deactivation — Amsterdam Uber deactivation case C/13/692003.
Welfare allocation — Hague SyRI judgment 2020.
Customer offboarding — frequently structured as Art. 22(2)(a) contractual necessity, but the safeguard duties apply.

Profiling vs ADM

Profiling (Art. 4(4) GDPR) is one form of ADM but not the only one. Not all profiling triggers Art. 22 — only profiling that produces legal/significant effects does. Pure classification for statistical/aggregate purposes (without individual decisioning) is profiling but not Art. 22 ADM.

Operational risk surface

ADM in process-automation contexts is the regulatory pivot point that determines whether:

A DPIA is mandatory (Art. 35(3)(a)).
Human-in-the-loop is required (Art. 22(1)).
Article 9 special-category data restrictions apply.
Cross-border transfer requires Chapter V safeguards.
AI Act Art. 14 oversight obligations stack on top.

concepts/gdpr-article-22 · concepts/profiling · concepts/human-oversight · concepts/dpia · concepts/eu-ai-act · concepts/automation-bias