EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
This shift unfolds within an expanding Union regula - tory framework. The AI Act subjects certain decision- making systems to enhanced governance where they qualify as “high risk”, including systems used in cred - itworthiness assessments, employment, access to essential services and other consequential contexts. Such systems are subject to structured obligations relating to risk management, technical documenta - tion, data governance and human oversight. However, the growing operational autonomy of enter - prise AI systems materially heightens exposure under Article 22 (1) GDPR, which grants individuals the right not to be subject to decisions based solely on auto - mated processing that produce legal or similarly sig - nificant effects without human intervention. The quali - fication of a system as “high-risk” under the AI Act does not exhaust the legal analysis. Article 22 oper - ates independently and may apply irrespective of AI Act classification. Article 22 was historically under-litigated. That posi - tion shifted with SCHUFA (Case C-634/21), where the CJEU adopted a functional approach, holding that automated credit scoring which plays a decisive role in lending decisions may fall within Article 22. The Court emphasised the real influence of algorith - mic outputs, rather than the formal allocation of final decision-making authority. The inquiry thus focused on practical effect. This reasoning is directly relevant to contemporary enterprise AI agents. Systems determining eligibility thresholds, dynamic pricing parameters, workforce scoring, procurement prioritisation or access con - trols may, depending on their operational influence, fall within Article 22 even where nominal human vali - dation exists. Supervisory authorities increasingly assess whether human oversight is meaningful in sub - stance. A nominal “human in the loop” who routinely validates automated outputs without critical review may not prevent classification as solely automated processing: the assessment is functional rather than merely formal. At the same time, the enterprise deployment of AI agents now extends beyond clearly “decisional” systems. In commercial contexts, AI agents increas -
ingly generate tailored proposals, negotiate pricing structures and conclude transactions through con - versational interfaces. In some sectors, agent-based interaction is beginning to displace traditional web infrastructure: users interact with agents that access structured datasets and generate executable out - puts, with transactional completion occurring with - in the interface itself. In these models, the website becomes secondary; the dataset and agent architec - ture become primary. Many such systems may fall outside the strict scope of Article 22 where outputs are advisory, iterative or optimisation-driven rather than determinative of legal rights. Yet this does not remove them from the GDPR framework. Where personal data is processed, the core principles of Articles 5 and 6 remain fully engaged. The compliance analysis shifts from deci - sional effect to structural processing risks. In agent-based architectures, particular attention must be paid to data minimisation in large-scale ingestion models; purpose limitation where datasets are repurposed across agentic workflows; transpar - ency obligations where decision logic is mediated through conversational interfaces rather than static disclosures; and accuracy where systems dynamically update or synthesise data in real time. The increas - ing autonomy of enterprise AI heightens exposure not solely because Article 22 is triggered, but because processing becomes persistent, embedded and opaque within organisational infrastructure. The result is a layered regulatory interaction. The AI Act structures governance at the level of system design and risk categorisation. Article 22 GDPR oper - ates as a rights-based constraint where automated outputs materially affect individuals. Beyond Article 22, the broader GDPR principles continue to regulate the scale, architecture and accountability of enterprise AI systems. Compliance with one regime does not displace the other. Enterprise AI governance therefore requires simultaneous attention to decisional effects, structural data flows and architectural autonomy.
105 CHAMBERS.COM
Powered by FlippingBook