GDPR Article 22: the right to a human, not a number
Automated decisions and the explanation that follows — what Art. 22 actually reaches for.
Article 22 of the GDPR is the provision everyone quotes and few read. It is not a right to a correct decision. It is a right to a human one — and the explanation that follows is what makes the human real.
GDPR Article 22 grants a data subject the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and the right to obtain human intervention, to express a point of view, and to contest the decision. That is binding law in the EU — not supervisory guidance, not voluntary framework. The article does not require the decision to be right. It requires the decision to be contestable, which is a different shape of obligation entirely, and one most model documentation is not built to answer.
This post maps what Art. 22 reaches for to the fields of a per-output audit manifest — the artifact we are building (BR-842). We are pre-revenue and building the POC; the manifest attests provenance and reproducibility, never truth. What follows is a field map, not a law summary.
The right that is not about accuracy
The first mistake compliance teams make with Art. 22 is to treat it as an accuracy obligation. It is not. A model can be perfectly calibrated and still violate Art. 22 if no human can intervene, if the data subject cannot contest, or if the explanation of how the decision was reached is not producible. The right is to a human in the loop and to an explanation after the fact — and an explanation is only credible if it reconstructs what actually happened, not what someone believes happened.
Article 22 does not require the decision to be right. It requires it to be contestable — and contestability is a shape of record, not a property of the model.
Human intervention has to be a recorded act
A human in the loop who is not recorded is not a human in the loop for audit purposes. The manifest carries an AxisOverride field — a typed, recorded override that seals who changed what, when, into the hash chain. An override is a first-class value, not a comment in a Slack thread. When a reviewer contests a decision and a human intervenes, that intervention is part of the provenance: it links to the NodeVersions the model read, the output it produced, and the corrected output the human entered. The chain verifies that the intervention happened and that nothing was backdated.
The explanation the article reaches for
The explanation Art. 22 reaches for is not a narrative someone writes after the fact. It is a reconstruction: which model, which version, which input NodeVersions (L1 through L4 of the GNL), which of the 23 A2A agents participated in what order, what the output was, and a replay anchor that lets a third party reproduce the computation bit-for-bit. The manifest carries each of these as a field. The explanation is not written; it is pointed at. "Which model? This field. Which inputs? These versions. Can I replay it? Here is the hash."
- Human intervention is an AxisOverride — typed, recorded, hash-linked, not inferred from memory.
- The explanation is a reconstruction from manifest fields, not a narrative composed after the fact.
- The replay anchor turns "can you explain?" into "can you reproduce?" — the stronger question, and the one Art. 22 is pointing at.
- The manifest attests provenance and reproducibility; it does not attest that the decision was correct.
What Art. 22 does not get you
A manifest that satisfies Art. 22 does not satisfy the EU AI Act risk-assessment obligation, the fundamental-rights impact assessment, or the transparency obligations for high-risk systems under the Act. Those are separate work on a separate timeline. Art. 22 is the floor for solely automated decisions with significant effects; the AI Act raises the ceiling for a broader class. The manifest is built for the binding tier first; the voluntary tier (NIST AI RMF, ISO/IEC 42001) is documentation on top, and it is useful precisely because it is not oversold as a substitute for law.
The right to a human is the right to a recorded human. A human whose intervention is not in the chain is, for audit purposes, a human who was not there.
— GDPR Art. 22 compliance note
The honest scope
We do not claim the manifest makes a decision defensible under Art. 22; we claim it makes a decision reconstructable, which is the part of defensibility that most teams cannot do today. Calibration of the underlying model is a separate, gated loop (Gate 1b) — the manifest is the audit story, not the accuracy story. The right Art. 22 grants is to contest, and contestability lives in the record, not in the score.