GDPR & AI: What Your Legal Team Isn't Telling Engineering

Article 22: Automated Decision-Making

GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing. If your AI system makes or significantly influences decisions about people, you need to understand the technical implications.

What Engineering Needs to Know

The legal text translates to concrete technical requirements:

1. Explainability: You must be able to explain how the model reached a decision
2. Human-in-the-loop: Purely automated decisions require explicit consent
3. Right to contest: Users can challenge automated decisions, so you need audit logs
4. Data minimization: Only process the data strictly necessary for the task

Technical Implementation

Audit Logging

Every inference request should produce an immutable audit trail containing the input features used, the model version, confidence scores, and the final output. This trail must be queryable and retainable for the statutory period.

Model Cards

Document your models with standardized model cards that describe training data sources, known biases, performance metrics across demographic groups, and intended use cases.

Data Residency

For EU-based processing, model weights and inference must happen within EU borders. This is where local deployment becomes not just a performance choice but a compliance requirement.

The Bottom Line

GDPR compliance isn’t optional, and the technical requirements are more demanding than most engineering teams realize. Local-first inference architectures naturally satisfy many of these requirements by keeping data within your control perimeter.