Key Audit Considerations for Solely Automated Decision Making AI System

Automated AI decision-making without meaningful human intervention triggers a complex web of GDPR obligations that are challenging to implement in practice. For Internal Auditors, it’s critical to ensure a proper balance between automation and human oversight—especially when personal data is involved. Ask your Chief AI Officer how these safeguards are enforced to maintain compliance and protect individual rights.

Article Structure:

Introduction
Understanding Solely Automated Decisions under GDPR
Key GDPR Obligations for Solely Automated Decisions
Why This Matters for Internal Audit
Questions to Ask Your Chief AI Officer (CAIO)

Introduction

As AI increasingly drives business decisions, Internal Auditors play a critical role in verifying compliance with the UK GDPR, particularly concerning solely automated decisions. These are decisions made entirely by AI systems about individuals without meaningful human input. Misclassification or misunderstanding of such decisions can expose the organization to regulatory risk, reputational damage, and financial penalties.

This article equips Heads of Internal Audit with the essential GDPR requirements around automated decision-making, focusing on the key audit consideration: distinguishing between solely automated decisions and human-influenced decision-support. The ultimate aim is to empower you to pose the right question to your Chief AI Officer (CAIO) to assess compliance.

Under UK GDPR Article 22, a decision is solely automated if there is no meaningful human input or intervention in the final outcome concerning an individual. Simply put:

A human’s presence alone is not sufficient to remove a decision from this category if their role is merely to “rubber-stamp” or formally approve an AI-derived result without substantive review or influence.
The quality and degree of human involvement are decisive. Only genuine, substantive human review—such as the ability to override, modify, or reject the automated outcome—transforms an AI system from an automated decision-maker into a decision-support tool.
If the decision affects individuals legally or has similarly significant impacts (e.g., hiring, loan approvals or rejections), it falls within the scope of Article 22 and must comply with its stricter requirements.

Where solely automated decisions have significant effects:

Organizations must have a lawful basis for such processing, often requiring explicit consent or contractual necessity.
Individuals must be informed transparently about the use of automated decision-making and its logic.
There must be rights for individuals to:
- Obtain human intervention.
- Express their point of view.
- Challenge and seek reconsideration of the decision.
A Data Protection Impact Assessment (DPIA) must be conducted to assess and mitigate risks.
Controls must be in place to ensure accuracy, fairness, and non-discrimination in decision-making algorithms.

Why This Matters for Internal Auditors

Misclassifying an automated decision as simply decision-support because a human signs off superficially can lead to:

Non-compliance with stricter GDPR requirements.
Increased regulatory scrutiny.
Potential data subject complaints and legal challenges.

Auditors must scrutinize the organization’s AI governance to ensure the human oversight process is meaningful and effective and the appropriate GDPR controls are implemented.

The Question to Ask Your Chief AI Officer

To kickstart an internal audit and compliance check, pose this question to your CAIO:

“Can you demonstrate how the organization ensures that any AI-driven decisions with legal or significant effects are not solely automated? Specifically, how do you define and enforce meaningful human involvement in those decisions to comply with Article 22 of UK GDPR?

Can you provide evidence of Data Protection Impact Assessments, documented controls for oversight, and mechanisms that empower individuals to challenge or seek human review of automated decisions?”

Their answer will reveal:

Whether the human review process in AI decision-making is substantive or just formal.
The extent of documented controls, DPIAs, and compliance measures.
How well the organization safeguards data subjects’ rights under GDPR.

Conclusion

As AI continues to shape critical decisions, Internal Audit must rigorously evaluate the boundary between solely automated and supported decisions. Asking your Chief AI Officer about the meaningfulness of human intervention in AI processes is the first step towards ensuring GDPR compliance, protecting individuals’ rights, and managing organizational risk.

Armed with this insight, audit teams can then plan focused reviews, prioritize high-risk AI deployments, and drive stronger governance across AI and data protection functions.

Further Resources:

ICO Guidance on Automated Decision-Making and Profiling
UK GDPR Article 22 Requirements
ICO Data Protection Impact Assessment (DPIA) Templates and Guidance