ARCHETYPAL

Protect against solely automated significant decisions

AIR-0156EA65AB · version 2 · Governance · candidate interpretation

Data controllers must protect against solely automated significant decisions.

Situation & purpose

An AI system or employee activity involves against solely automated significant decisions. Confirm the actor and source conditions before using this template.

Provide a traceable control for the action: protect against solely automated significant decisions.

Examples

Meets the rule
Data controllers performs the required action "protect" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.
Does not meet the rule
Data controllers omits the required action "protect" for against solely automated significant decisions while those source conditions apply.
Outside scope
The actor, activity, jurisdiction, or applicability conditions in this source variant do not match.

Evidence & enforcement

  • Dated record of the action
  • Responsible actor and approval, where required
  • Applicable source edition and scope

Human or authorized system adapter required. Machine-executable: no. Convert to a reviewed organization contract and validate the adapter before deployment.

Limits

A rule card is an interpretation aid, not an applicability determination.

Equivalent intent does not make different source obligations interchangeable.

Owner review

Record your interpretation decision. This does not adopt a policy for an organization.

Owner sign-in

JSON rule card
{
  "id": "AIR-0156EA65AB",
  "version": 2,
  "title": "Protect against solely automated significant decisions",
  "text": "Data controllers must protect against solely automated significant decisions.",
  "topic": "Governance",
  "intent": "protect against solely automated significant decisions",
  "status": "candidate",
  "semanticStatus": "human-validation-required",
  "variants": [
    {
      "sourceId": "eu-gdpr",
      "control": "Article 22(1)",
      "sourceVersion": "Regulation 2016/679",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
      "actor": "Data controllers",
      "modality": "must",
      "action": "protect",
      "object": "against solely automated significant decisions",
      "condition": "Subject to Article 22 exceptions and safeguards",
      "exception": "See article-specific exceptions and safeguards",
      "timing": null,
      "authority": "binding-within-scope",
      "jurisdiction": "European Union",
      "checkedAt": "2026-10-03",
      "status": "interpretation-needs-review",
      "examples": {
        "meetsRule": "Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.",
        "doesNotMeetRule": "Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.",
        "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
      }
    }
  ],
  "situation": "An AI system or employee activity involves against solely automated significant decisions. Confirm the actor and source conditions before using this template.",
  "purpose": "Provide a traceable control for the action: protect against solely automated significant decisions.",
  "examples": {
    "meetsRule": "Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.",
    "doesNotMeetRule": "Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.",
    "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
  },
  "evidence": [
    "Dated record of the action",
    "Responsible actor and approval, where required",
    "Applicable source edition and scope"
  ],
  "enforcement": {
    "mode": "policy-template",
    "adapter": "Human or authorized system adapter required",
    "machineExecutable": false
  },
  "limitations": [
    "A rule card is an interpretation aid, not an applicability determination.",
    "Equivalent intent does not make different source obligations interchangeable."
  ],
  "createdAt": "2026-10-03",
  "updatedAt": "2026-10-03"
}
Back to registry