AI Decision Support in Healthcare: GDPR Article 22 and Human Oversight

Software that scores, flags, ranks or recommends is spreading through health and social care. Two EU frameworks speak to the question of who is really making the decision: Article 22 of the GDPR, which limits decisions based solely on automated processing, and the AI Act, which requires human oversight of high-risk systems. This guide sets out what the Data Protection Commission (DPC), the EU legislation and HIQA say about AI clinical decision support, GDPR Article 22 and human oversight, for Irish health employers and managers. It is about governance and workforce responsibilities, not clinical practice, and it is not legal advice.

The GDPR rule is explained in general employment terms in our guide to Article 22 and automated decision-making in Irish workplaces. Here we apply the same ideas to health settings.

What the DPC says about Article 22

The DPC page "Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)" says individuals have the right "to not be subject to a decision based solely on automated processing." It explains that processing is "automated" in this sense where it is carried out without human intervention and produces legal effects or significantly affects the person, and that it includes profiling. The page shows no date, so check it for current wording.

It says automated processing of this kind is permitted with the person's express consent, where necessary for the performance of a contract, or where authorised by Union or Member State law, and that suitable safeguards must then protect the person's rights, freedoms and legitimate interests. Those may include the right to obtain human intervention, to present a point of view and to challenge the decision.

The most relevant line for health services is about special category data. The DPC page says automated processing of these data is lawful only with express consent or where necessary for reasons of substantial public interest.

The word that matters: "solely"

Article 22 is about decisions made without human intervention. Some AI tools are described as supporting a person who then decides. The DPC page does not say how much human involvement is enough to take a process outside the Article 22 description, and it gives no examples from the health sector. The European Data Protection Board's list of endorsed guidelines includes the guidelines on automated individual decision-making and profiling (WP251rev.01), but we could not open the text of those guidelines, so we do not summarise what they say about meaningful human involvement. Read them directly.

What we can say is that the question is one of substance. Our suggestion: for any tool that influences a decision about a person, ask whether the person making the decision can in practice disagree with the tool, understands what it does, and has the time and authority to override it. If the honest answer is no, treat the process as potentially automated for Article 22 purposes and get advice.

What the AI Act says about human oversight

For high-risk AI systems, the AI Act sets its own human oversight rules. Article 14 of the consolidated text of Regulation (EU) 2024/1689 on EUR-Lex (version of 27 July 2026) says such systems must be designed so that natural persons can effectively oversee them in use. Oversight aims to prevent or minimise risks to health, safety or fundamental rights, and measures must match the system's risks, level of autonomy and context. The system must be provided to deployers so that the people assigned oversight can, as appropriate and proportionate:

• understand the system's capacities and limitations, monitor its operation and detect anomalies, dysfunctions and unexpected performance;
• stay aware of automation bias, the tendency to rely too heavily on the output, especially where it gives recommendations for human decisions;
• correctly interpret the output;
• decide not to use the system, or to disregard, override or reverse its output; and
• intervene in the system or halt it through a "stop" button or similar procedure.

On the organisation using the system, Article 26(2) requires deployers to assign human oversight to people with the necessary competence, training, authority and support. Recital 91 of the original text adds that those people should have "an adequate level of AI literacy". Our guide to deployer obligations and human oversight under Article 26 covers the rest of the deployer duties.

These provisions apply to high-risk systems. Whether a particular clinical decision support tool is high-risk depends on matters we cover in our other posts, including its status under product legislation. The Commission's AI Act page (last updated 3 August 2026) lists 2 December 2027 for high-risk use-case rules and 2 August 2028 for regulated products, following the Digital Omnibus. Check the current dates.

How the two frameworks fit together

They ask different questions. Article 22 is a data protection right of the individual about decisions made solely by automated means. Human oversight under the AI Act is a design and deployment requirement for high-risk systems, meant to ensure that people can watch, interpret, override and stop the system. A tool can raise one, both or neither. We have not found an official source in the material we read that sets out how the two are applied together in health settings, so take advice on specific tools.

What HIQA's guidance adds

HIQA published national guidance on the responsible and safe use of AI in health and social care services on 29 July 2026, according to its announcement. It is organised around four principles (accountability, a human rights-based approach, safety and wellbeing, and responsiveness), emphasises that robust governance and clear lines of accountability need to be embedded when AI is used, and says health and social care is safety-critical so technology must be shown to be safe and trustworthy before use. It mentions examples of existing uses such as streamlining administration and supporting diagnostics through scan analysis. Our summary of HIQA's national AI guidance for health and social care gives more detail.

The announcement does not call the guidance mandatory and says AI use must comply with legal obligations including the EU AI Act. We read the announcement but not the full guidance document, so we do not describe its detailed expectations on human oversight.

A practical checklist for managers

These steps are our suggestions, not legal requirements:

• Map decisions. For each AI-enabled tool, write down what decision it informs, who makes that decision and what happens to the tool's output.
• Name the overseer. Identify the role responsible for oversight, and make sure that person has the competence and authority to challenge the output.
• Train for automation bias. Include examples of over-reliance in staff training and discuss what to do when output and judgement differ.
• Make override easy and recorded. Where a person disregards or reverses output, consider recording it in a way that fits your governance, so you can learn from it.
• Check the data protection basics. Where personal data is processed, consider a data protection impact assessment and your lawful basis.
• Tell people. Be open with patients and service users about the use of AI in line with your privacy notices and HIQA's emphasis on transparency.
• Review. Revisit the arrangement when the tool, its use or the law changes.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does Article 22 apply to every AI tool used in a hospital or clinic?

No. According to the DPC, it concerns decisions based solely on automated processing that have legal effects or significantly affect the person. Whether a tool falls within it depends on how it is used and who decides, which is why mapping decisions is useful.

Is health data treated differently under Article 22?

The DPC page says automated processing of special category data is lawful only with express consent or where necessary for reasons of substantial public interest.

What does human oversight require under the AI Act?

For high-risk systems, Article 14 requires that oversight persons can understand the system, be aware of automation bias, interpret output, override it and stop the system, as appropriate and proportionate.

Is HIQA's AI guidance legally binding?

HIQA's announcement does not describe it as mandatory, and says AI use must comply with legal obligations including the EU AI Act.

Where does clinical responsibility sit?

That is a professional and regulatory question outside this guide. Check your professional body and regulator, and your own governance arrangements.

Whatever tools you use, being able to show who oversees each one is a good place to start.