European Union · Binding regulation
GDPR and AI: automated decisions, DPIAs, and fairness evidence
The GDPR applies to any AI system that processes personal data of people in the EU. Its fairness and accuracy principles, rules on solely automated decisions, and impact assessment duty all bear directly on how AI models are built and run.
What the GDPR asks of AI systems
The obligations most relevant to bias, risk, and accountability, summarised from the General Data Protection Regulation (GDPR).
- Art. 5Fairness and accuracy
- Process personal data fairly and keep it accurate.
- Art. 22Automated decisions
- Rights around decisions based solely on automated processing with legal or similarly significant effects.
- Art. 25Data protection by design
- Build safeguards into systems from the start.
- Art. 35Impact assessments
- A DPIA where processing is likely to pose a high risk to individuals.
Evidence FairMind helps you produce
FairMind links technical evidence to GDPR obligations for a human reviewer to accept. It is not legal advice and does not decide compliance.
- Fairness evaluations supporting DPIAs
- Human oversight records for decisions with significant effects
- Model version and data lineage for each system
- Exports your DPO can attach to a DPIA
GDPR questions
Does GDPR ban automated decision-making?
Article 22 restricts decisions based solely on automated processing that have legal or similarly significant effects, unless an exception applies and safeguards such as human intervention are in place.
Is a DPIA required for AI?
Often. A DPIA is required when processing is likely to result in high risk, and supervisory authorities commonly list AI-driven profiling and evaluation of individuals as high risk.