Who has to provide human intervention when an automated decision is challenged?

Article 22C(2)(c) requires safeguards enabling the data subject to obtain human intervention on the part of the controller. The obligation sits with the controller that took the decision. Where a lender declines an application using its own automated processing, that is the lender.

Is a lending decision a significant decision under Article 22A?

Article 22A(1)(b) defines a significant decision as one that produces a legal effect for the data subject or has a similarly significant effect for the data subject. Whether any particular decision meets that test is a question about that decision and the circumstances it was taken in.

Does having a human somewhere in the process take a decision outside the rule?

Not on its own. Article 22A(1)(a) provides that a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision. Article 22A(2) requires the extent to which the decision is reached by means of profiling to be considered when assessing whether that involvement is meaningful.

Can a broking firm be the controller of an automated decision?

A firm is a controller in respect of processing where it determines the purposes and the means. Whether any part of a firm's own process amounts to a significant decision taken solely by automated means is a question about that firm's process, and not one that can be answered generally.

The Decline You Have to Explain

A client rings you on a Tuesday afternoon. The application has been declined. They want to know why.

You do not know why. You have a reference number, a decision, and somewhere behind it a model that weighed something and produced an answer. You did not build it. You cannot see inside it. The firm that can see inside it is not the firm your client wants to talk to.

They are not ringing the lender. They are ringing you, because you are the person they met, the person who took their details, the person whose name is on the emails. That is the whole basis of the relationship, and it is the reason they trusted the process in the first place.

So you say the honest thing, which is that you will find out. And then you discover that finding out is harder than it sounded.

What the rule says now

Since 5 February 2026 the automated decision-making provision in the UK GDPR has not been Article 22. Section 80 of the Data (Use and Access) Act 2025 replaced it with Articles 22A to 22D. I decoded that change last week. This piece is about something different: not what the rule says, but who it lands on.

Start with the test for whether a decision counts as automated at all. Article 22A(1)(a):

"a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision"

Meaningful. Not present, and not named on the file. Article 22A(2) then says what has to be weighed when you are working out whether that involvement was meaningful:

"When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling."

Then Article 22C, which is where the safeguards live. Where a significant decision is based entirely or partly on personal data and taken solely by automated processing, the controller

"must ensure that safeguards for the data subject's rights, freedoms and legitimate interests are in place"

And those safeguards are not left to the imagination. Article 22C(2) sets out what they must consist of or include:

"(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject; (b) enable the data subject to make representations about such decisions; (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions."

Your client, sitting on the other end of that Tuesday afternoon phone call, has all four.

Read (c) again

"enable the data subject to obtain human intervention on the part of the controller"

On the part of the controller.

The controller is the party that determined the purposes and the means of the processing. For a decision to lend or not to lend, taken on a lender's system, against a lender's criteria, that is the lender. Article 22C(1) closes the obvious gap too. It speaks of a significant decision "taken by or on behalf of a controller", so a lender that buys in a scoring service has not handed the obligation over with the contract.

Your client has a right to a human. You are a human. You are not the human the right is about.

Your client has a right to a human. You are a human. You are not the human the right is about.

That is not a technicality, and it is certainly not a let-off. It is the shape of the problem. The person with the relationship has no access to the reasoning. The party holding the reasoning has no relationship. And your client, entirely reasonably, experiences the gap between those two facts as you being unable to help them.

The FCA pointed at this ground before the law moved underneath it. Paragraph 3.47 of the AI Update:

"In addition, as set out above, data subjects have the right not to be subject to automated decisions under Article 22 UK GDPR which produce legal or similarly significant effects. Where there are exceptions to this, safeguards must be put in place, including the right to contest automated decisions."

The article number in that sentence is out of date now. The direction it points in is not.

The part that turns round

Here is where I suspect most firms stop reading, and where the question that matters actually starts.

It is comfortable to file this under somebody else's model. The lender declined. The lender holds the reasoning. The lender carries the safeguards. All true, and all of it lets a broking firm put the problem in the drawer marked things done to us.

But Article 22C binds the controller, and a broking firm is a controller in respect of processing where it decides the purposes and the means. So the question is not only whether you are caught by a lender's model. It is whether anything in your own process takes a significant decision about a client with no meaningful human involvement in it.

Criteria filters. Triage rules. Sourcing that rules a case out before it is ever keyed. Automated eligibility checks that come back no and end the conversation there. Some of that is a search and nothing more. Some of it may be a decision. Which one it is does not depend on what the tool is called, or on how it was described to you when you bought it.

I am not going to tell you where your line sits, because it depends entirely on what your process actually does, and I have not seen it. Anyone offering you a general answer to that question is selling something.

Anyone offering you a general answer to that question is selling something.

The uncomfortable bit

The firms most exposed here are not the careless ones.

A firm that does everything by hand has very little to worry about, and very little else besides. The exposure arrives with the efficiency. It arrives in the year the sourcing gets sharper, the triage gets quicker, and the point at which a person genuinely applied their mind moves quietly later in the process than anybody intended.

Nobody sits down and decides to remove meaningful human involvement. It goes the way most things go, which is one sensible improvement at a time.

So the question worth sitting with is not the one about the lender. It is a good deal closer to home, and there is only one honest way to answer it, which is to walk your own process and look.

At what point in it does a person actually decide something.

This article is part of Compliance Reality Check, one of three editorial streams from AI for Brokers. The compliance risks brokers are already carrying without realising. The uncomfortable questions no one else is asking. The scenario in this article is illustrative and does not refer to any real firm or individual.