Ongoing operations
ADM Register and Human Override
GDPR Article 22 (and UK GDPR Article 22) requires you to record automated decisions that affect people significantly and to provide human intervention and a way to contest them. The ADM Register is that record: one row per automated decision, plus appeal and override lifecycle on the same row so an auditor sees the full story without joining tables.
Transcript
GDPR Article 22 requires a register for automated decisions that affect people significantly, plus human intervention and a contest mechanism.
Each ADM record stores the logic, legal basis, profiling flag and how to contest. One row is both the Article 22 register and the contest log.
With at least one record, adm log exists becomes true, so both GDPR and UK GDPR Article 22 obligations show completed automatically.
Contest a decision from the register with a reason of at least ten characters. The row moves to appealed and awaits human review.
A reviewer records an override decision and chooses upheld or overturned. On overturned the status becomes overridden, the human intervention evidence for Article 22.
Why this is required
An automated decision that is never logged as such cannot be shown to have a contest mechanism, which is exactly what Article 22(3) asks an auditor to verify alongside the human-oversight duty in AI Act Article 14.
Tracking appeals and overrides on the same register row (appealed_at, appeal_reason, human_override_by, override_decision, appeal_outcome) keeps the Art.22(1) register and the Art.22(3) contest log in one place, so the evidence is not split across a document and a spreadsheet.
What EuroCompliant does
ADMRecord (models.py:1007) stores title, automated_logic, legal_basis, profiling_involved, human_intervention_available, contest_mechanism, status (active/appealed/overridden/closed) and the appeal/override lifecycle (appealed_at, appeal_reason, human_override_by, override_decision, appeal_outcome).
Evidence engine _has_adm_log (evidence_engine.py:541) returns true when at least one ADMRecord exists, making gdpr_22 and uk_gdpr_22 platform_managed via adm_log_exists (obligation_meta.py:125/371), completed when the register has ≥1 row, otherwise not_started.
POST/GET /adm/records, GET/PUT /adm/records/{id}, POST /adm/records/{id}/appeal (≥10 chars), POST /adm/records/{id}/override (human_override_by + upheld/overturned), DELETE. All tenant-scoped, audit-logged as adm.record_create/appeal/override. Frontend /adm shows the register, a create form, and contest/override buttons per row.
Walking through it
Create an ADM record
Title, automated logic and contest mechanism are required. Link a system if the decision belongs to a specific AI system, or leave org-wide. Set profiling_involved and human_intervention_available explicitly.
Open /adm →Contest an automated decision
From the register, Contest / Appeal with a reason of at least 10 characters. The row moves to appealed and appeal_outcome becomes pending.
Open /adm →Record a human override
A reviewer with authority records override_decision and chooses upheld or overturned. On overturned the status becomes overridden and the evidence for Art.22(3) human intervention is complete.
Open /adm →The law
Automated individual decision-making, including profiling
Right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects, with safeguards including human intervention and contest.
Human oversight
Borrowed for the human-override element of the Art.22 contest log, the same oversight that satisfies Art.22(3).
Frequently asked
Does one ADMRecord satisfy both gdpr_22 and uk_gdpr_22?
Yes. The register is scoped to the tenant, not a jurisdiction. Any ADMRecord makes adm_log_exists true, so both the EU and UK Article 22 obligations become completed at once if they apply to your profile (processes_personal_data).
Why 10 characters for appeal_reason?
An appeal that says 'bad' is not an auditable record. The 10-character minimum ensures the reason is at least a sentence an auditor can read, without being onerous.
Related guides
GDPR & privacy
How data protection obligations run alongside the AI Act, and the parts of the GDPR that carry operational consequences.
Evidence vault & audit trail
Turning completed checklist items into artefacts a regulator can inspect, and the logging duties behind Articles 12 and 26.
Transparency and Synthetic Content Marking
Disclose AI interaction, mark synthetic content (C2PA/watermark/metadata), and disclose deep-fake provenance, each as a register entry with evidence.
Try it on your own systems
Everything in this guide runs in the live product. Start a free trial and follow along with your own data.
Start free trial