Can AI Make Decisions in Customer Service? Art. 22 DSGVO for Chatbots, Voicebots and AI Agents
Art. 22 DSGVO governs automated decisions. When chatbots, voicebots and AI agents in customer service may decide on their own, which exceptions apply and what the human escalation path has to look like.
Liam van der Viven
Co-Founder & CEO at botBrains
Note: This article looks at the German legal framework. It refers to the DSGVO, the German term for the GDPR, and to German supplementary law such as the BDSG. Other EU member states apply the same regulation but may have different national provisions.
AI agents answer customer requests today via chat, email and phone. They check orders, handle complaints, answer questions and can carry out actions in connected systems.
How far may this automation go? May a chatbot reject a refund? May an AI phone assistant decide on a cancellation without a human looking at it first? The answer lies in Art. 22 DSGVO.
The short answer: Yes, AI may generally act on its own in customer service. Most automated processes in customer service do not fall under Art. 22 DSGVO at all. For decisions with legal or similarly significant effect, however, additional requirements apply.
When does Art. 22 DSGVO apply to AI in customer service?
Art. 22 DSGVO does not cover every decision an AI makes. The provision applies when a person is subject to a decision that is based solely on automated processing and that produces legal effects concerning them or similarly significantly affects them. Both conditions have to be met.
1. The decision is made solely by automated means
A chatbot, voicebot or AI agent makes the decision on its own, without a human reviewing its substance and deciding on it beforehand.
Purely formal human involvement is not enough. If an employee merely confirms an automatically generated decision without being able to assess and change it independently, the decision still counts as solely automated.
2. The decision has a legal or similarly significant effect
Not every automated reply is an automated decision within the meaning of Art. 22 DSGVO. The provision becomes relevant when the decision changes a person's legal position or affects them in a comparably significant way.
The question is therefore not whether an AI sent the reply, but whether the AI independently made a decision about the person that has legal or similarly significant consequences.
Which customer service decisions usually do not fall under Art. 22 DSGVO?
A large part of what an AI agent does in customer service does not reach this threshold. When an AI chatbot answers a question about a product, an AI email agent reports the order status or a voicebot retrieves information from a customer system, no decision with legal or similarly significant effect is made about the person. The same applies to categorising and routing tickets, asking for missing information, filling in ticket fields or answering general service questions.
Art. 22 DSGVO is therefore not a general ban on automated customer communication. An AI agent does not need human oversight just because it formulates a reply or carries out an action on its own.
Which decisions by an AI agent can fall under Art. 22 DSGVO?
It can look different when an AI agent actually decides on a customer's rights, claims or other essential interests. Depending on the case, this can include rejecting a refund claim, rejecting a cancellation, suspending a customer account, charging a fee or a comparably significant decision.
The specific case is decisive. Suspending an unimportant community account carries a different weight than suspending an account that is needed to access an essential service.
A decision that is favourable to the customer does not automatically fall outside Art. 22 either. The wording of the DSGVO focuses on the legal or similarly significant effect of the decision, not on whether the outcome is positive or negative.
May an AI still make such decisions automatically?
Yes, under certain conditions. Art. 22 DSGVO is sometimes read as if an AI could never independently make a legally relevant decision. Art. 22 para. 2 DSGVO, however, provides three exceptions under which a solely automated decision is permitted.
Overview: legal grounds for automated decisions
| Legal ground | Requirement | Safeguards under Art. 22 para. 3 | Example in customer service |
|---|---|---|---|
| Art. 22 para. 2 lit. a: Necessary for entering into or performing a contract | The automated decision has to be genuinely necessary for entering into or performing a contract between the customer and the company. Faster, cheaper or more convenient is not enough. | Yes. The customer must be able to obtain human intervention, express their point of view and contest the decision. | Automatic check whether a return is within the return period, followed by release of the refund. |
| Art. 22 para. 2 lit. b: Authorised by EU or member state law | A law explicitly permits the automated decision and itself lays down suitable measures to safeguard the rights of the data subject. | Not via Art. 22 para. 3, but via the respective law. | Rare in customer service. In Germany, for instance, § 37 BDSG for benefit decisions by private insurers. |
| Art. 22 para. 2 lit. c: Explicit consent | The customer has explicitly consented to the automated decision. Consent has to be freely given, informed and revocable at any time. | Yes. The customer must be able to obtain human intervention, express their point of view and contest the decision. | The customer deliberately chooses immediate automated handling of their complaint in self-service instead of manual review. |
If the decision is based on special categories of personal data such as health data, additional restrictions apply under Art. 22 para. 4 DSGVO.
For customer service, Art. 22 para. 2 lit. a DSGVO is the most relevant ground, that is, necessity for entering into or performing a contract. "Necessary" means more than merely "practical". The fact that a fully automated decision is faster, cheaper or easier is not enough. Companies have to assess for each use case whether the automated decision is genuinely necessary for entering into or performing the contract.
Does a human have to be able to review the decision?
When an automated decision is based on Art. 22 para. 2 lit. a or lit. c DSGVO, Art. 22 para. 3 requires additional safeguards. The DSGVO explicitly names the data subject's right to obtain human intervention, to express their point of view and to contest the decision.
This does not mean that every reply from an AI agent has to be approved by an employee first. But if a solely automated decision falls under Art. 22 and is permitted under one of the exceptions, the data subject needs an effective way to have the decision reviewed by a human. The human escalation path is therefore part of the technical implementation.
Human in the loop or human on demand?
Two models are relevant for the technical design of AI in customer service.
Human review before the decision
If an employee reviews a proposed decision before it takes effect, assesses it themselves and can change it, there is no longer a solely automated decision. The human has to actually decide, though. Automatically waving through an AI recommendation is not the same as an independent review.
Human review at the customer's request
Alternatively, a decision can initially be made automatically. If Art. 22 applies to this decision, one of the exceptions in Art. 22 para. 2 has to apply. In the cases under lit. a and lit. c, the customer must then be able to request a human review.
The customer therefore does not have to talk to an employee before every decision. But they have to be given the option to contest the automated decision and obtain a genuine human reassessment.
Does Art. 22 DSGVO also apply to chatbots?
Yes. The same rules apply to an AI chatbot in customer service. What matters is not the channel the conversation takes place on, but what the chatbot does.
If the chatbot answers questions, looks up information or takes in a request, Art. 22 often does not apply at all. If, on the other hand, the chatbot independently decides on a legally relevant claim of the customer, it has to be assessed whether the conditions of Art. 22 are met.
Does Art. 22 DSGVO apply to voicebots and AI phone assistants?
The same principles apply to a voicebot or AI phone assistant. An AI phone assistant can independently read out the order status, take in information, schedule an appointment or route a case to the right department. Such processes are not problematic just because no employee is on the line.
It can look different if the voicebot independently makes a decision with legal or similarly significant effect during the call. For such cases, the AI phone assistant should offer a clear handoff to a human.
Does Art. 22 DSGVO apply to AI agents for email?
An AI agent for email in customer service may also handle and answer customer requests on its own. Whether Art. 22 DSGVO applies does not depend on the medium.
An AI email agent can retrieve information from CRM, ERP or shop systems, draft replies, ask follow-up questions and categorise tickets without this creating a decision within the meaning of Art. 22. Art. 22 only becomes relevant once the AI agent independently makes a correspondingly significant decision about the customer.
How can human escalation be implemented technically?
A company that lets AI agents handle customer requests on their own should provide a clear path to an employee for relevant decisions.
With botBrains, this escalation path can be implemented differently depending on the channel, for example via @human in Zendesk, further processing of a customer reply in Salesforce, a handoff to an employee in the AI phone assistant or an explicit request for a human in the chatbot.
It is not enough that an employee is theoretically reachable somewhere. For a decision that falls under Art. 22, the data subject has to be able to obtain an actual human review, and the employee has to be able to reassess the substance of the decision and change it where necessary.
May an AI reject a refund?
An automated rejection of a refund can fall under Art. 22 DSGVO, particularly when it decides on a legal claim of the customer. This does not mean such a decision by AI is prohibited.
It has to be assessed whether Art. 22 applies in the specific case and, if so, whether one of the exceptions in Art. 22 para. 2 applies. For a decision based on contractual necessity or explicit consent, the safeguards under Art. 22 para. 3 also have to be guaranteed.
May an AI reject a cancellation?
Here too, the specific process matters. If an AI agent independently decides that a cancellation is invalid and therefore treats the contract as continuing, this can constitute a legally relevant automated decision.
Art. 22 DSGVO does not lead to a complete ban here either. What matters are the conditions of Art. 22 and the exceptions that may apply.
Does every reply from an AI agent have to be reviewed by a human?
No. Art. 22 DSGVO contains no general obligation to have every reply from a chatbot, voicebot or AI agent in customer service approved by a human. The provision covers a much narrower area: solely automated decisions with legal or similarly significant effect. For many classic use cases of AI in customer service, Art. 22 therefore does not apply at all.
Conclusion: AI may do more in customer service than often assumed
The DSGVO prohibits neither AI in customer service nor automated decisions as such. For most tasks of a chatbot, voicebot, AI phone assistant or email agent, Art. 22 DSGVO is not relevant because no legal or similarly significant decision about the customer is made.
Art. 22 becomes relevant where an AI agent independently makes decisions with such effects. Even those decisions are not prohibited across the board. Art. 22 para. 2 DSGVO provides exceptions. Where Art. 22 para. 3 applies, it has to be ensured that the customer can obtain a human review, express their point of view and contest the decision.
The decisive question when introducing AI agents is therefore not whether the AI may reply on its own, but which decisions it may make in this process, what legal effect those decisions have and how human escalation works.
Disclaimer: This article gives a general overview of Art. 22 DSGVO in the context of AI in customer service under German law and does not replace legal advice for a specific use case.
