AI & Automated Decision-Making

Is your human oversight actually doing anything?

Article 22 GDPR gives people the right to meaningful human review of automated decisions — not a rubber stamp. This self-assessment is built directly from EDPS guidance on what real oversight requires, and what regulators treat as symbolic.

Based on EDPS TechDispatch #2/2025 — Human Oversight of Automated Decision-Making, and the EDPS Practical Checklist on Human Intervention (May 2026). For guidance purposes — not legal advice.

Start here: the 4-condition test

If any of these is false, EDPS would not consider your oversight "meaningful" — regardless of how the rest of the checklist scores.

Intervention is possible — the system technically allows a human to pause, change, or override the decision.

Information is available — the reviewer can see the reasoning or context behind the output, not just a final score.

Agency is real — the reviewer can override without fear of penalty or being overruled by policy.

Intent is aligned — the reviewer is motivated to catch wrong or unfair outcomes, not just to clear volume.

Governance & Protocol

Whether the rules for human review exist on paper, and whether anything undermines them in practice.

A written protocol defines when human review is mandatory — it isn't left to individual judgment.

The protocol specifies what the reviewer can actually do: approve, reject, escalate, or request more information.

Responsibility for the decision is clearly assigned — not diffused between "the system" and "the reviewer."

No performance metric (speed, throughput, approval rate) implicitly discourages overriding the system.

Affected individuals are told a decision involved automation, and how to request human review.

System & Interface Design

Whether the tool itself helps a human review properly, or quietly pushes them to click "approve."

The interface shows enough reasoning to evaluate the decision — not just a final score or label.

Low-confidence or edge-case outputs are flagged for closer review, rather than shown with equal certainty.

The reviewer has enough time — the workflow isn't built to be approved in seconds by default.

Where appropriate, reviewers form an initial view before seeing the system's recommendation.

The interface doesn't nudge fast acceptance — no one-click "confirm" with friction added only to disagree.

Operator Readiness

Whether the human doing the reviewing is actually equipped to do it.

Reviewers are trained on how the system works, including its known failure modes.

Reviewers have seen real examples of the system being wrong.

Reviewers know what to do when unsure — an escalation path exists and is actually used.

Reviewers have the subject-matter expertise to evaluate the output (legal, financial, medical, etc.).

Audit & Accountability

Whether anyone is checking that oversight stays real over time.

Override and disagreement rates are tracked over time.

An unusually high acceptance rate triggers a review of whether oversight is genuine or symbolic.

There's a channel for affected individuals to flag errors or unfairness.

Audit and complaint findings feed back into system or process changes — not just into a log.

A second person reviews high-stakes decisions before they take effect, where proportionate.

Check the boxes above to see your result

Your answers stay in this browser as you go. Enter your email when you're ready to unlock your personalized result and get a copy sent to you.

Unlock your result

See your personalized oversight assessment now, and we'll email you a copy.

Not sure where the gaps are?

A short audit can tell you exactly which of these controls are missing, and what fixing them actually involves for your business.

Get a GDPR audit

19 items not yet checked
out of 19

Start checking the boxes