Your automation said no. The customer can ask for a person
The order was cancelled overnight by a workflow that watches the fraud score; the reason on the record reads "Customer changed/canceled order", which is the default. Ninety seconds after one screening question went the wrong way, the applicant had a polite rejection in the inbox. The tenant's reference "failed" and the page offers no address to write to. Each of them replies, and the reply lands with someone who can see the decision and has no way to change it.
In the European Union that person may have a right the automation was never told about: to human intervention in an automated decision. The right sits in one paragraph of the General Data Protection Regulation (GDPR), Article 22, and the step it asks for is the one most tools leave for the owner to add. Every document quoted was read on 12 September 2026. I am not a lawyer.
The right is one paragraph long
Article 22 gives a person "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Where such a decision is allowed at all, because it is necessary for a contract or the person consented, the third paragraph sets the floor:
"the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision."
Regulation (EU) 2016/679, Article 22(3)
The guidelines of the Article 29 Working Party, the EU data protection authorities, revised in 2018, add that the controller "must provide a simple way for the data subject to exercise these rights". Recital 71 of the regulation names fraud prevention among the things a national law may authorise; a rule a shop switched on in its own dashboard has no such law behind it and needs the Article 22(3) safeguards like any other automated refusal.
A score becomes a decision when you lean on it
The score usually arrives bundled with a tool the business already pays for, the payment processor or the screening service, and nobody in the business has seen how it is built. In December 2023 the Court of Justice held that the score can be the decision:
"the automated establishment, by a credit information agency, of a probability value ... constitutes 'automated individual decision-making' within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person."
Court of Justice of the EU, Case C-634/21, SCHUFA Holding, 7 December 2023, operative part
If your workflow cancels on a "high" flag without anyone reading the order, the workflow draws strongly on the flag. The UK regulator, the ICO, describes the shape in its draft guidance: "No human reviews the individual case unless the customer challenges the outcome. Because the decision is based entirely on profiling and executed automatically, it lacks meaningful human involvement."
Which of your refusals qualify
The threshold is high. The Working Party's guidelines say "only serious impactful effects will be covered by Article 22", and list decisions "that affect someone's financial circumstances, such as their eligibility to credit", "that deny someone an employment opportunity", "that affect someone's access to education", along with "cancellation of a contract" as a legal effect. Their example of an effect that does not qualify is an ordinary targeted advert.
Tenancy, a job application, a credit line, and a block that keeps a person out of a service they rely on sit inside those lists. One refused order for a small amount sits well below the bar on its own. The right belongs to natural persons, so it covers the individual who books, applies or pays for themselves and leaves out a company whose purchase order was refused.
The human has to be real. The guidelines: "any oversight of the decision is meaningful, rather than just a token gesture. It should be carried out by someone who has the authority and competence to change the decision." A person who can read the rejection but only forward it fails that test.
In five tools the refusal is built in and the route back is a setting
I read the documentation of five tools on 12 September 2026, looking for where each one sends the person it has just refused.
| Tool | The "no" | Where the person goes |
|---|---|---|
| Stripe Radar | "Block if :risk_level: = 'highest'", enabled by default (the page marks the rule deprecated and leaves it on); review rules for "elevated" | Blocked payments never reach the review queue; the recommended message is a generic decline and "The customer needs to contact their card issuer", although for a Radar block Stripe "doesn't obtain authorization from the card issuer" |
| Shopify Flow | "Cancel order" on high-risk orders, from a template; Shopify itself does not cancel flagged orders by default | "Send a notification to the customer" is a checkbox; the reason defaults to "Customer changed/canceled order" |
| Recruitee | Knockout questions "automatically disqualify and notify candidates" | The rejection email is sent "without any manual work"; no review step is part of the feature |
| Intercom Fin | Close the conversation | Escalation to a human is the default; "close conversation and offer other ways for the customer to get help" is the alternative setting |
| Zapier | A Filter step | "the filter stops the Zap and no further actions are performed" |
Across the five, the refusal comes ready-made and the review afterwards is left to whoever sets the tool up; Intercom is the one that sets it up for you. What the customer sees when that setting is left off is the default reason on the record and a support reply that confirms the order was flagged, with nothing about what a customer is supposed to do next.
The missing step is a route back and someone who can reverse the call
The step the law describes fits in one line of your flow's documentation: every automatic "no" writes a record of which rule fired and on what data, the message the person receives names an address that a human reads, and that human has the authority to reverse the decision. That step exists for the tenant whose freelance income the referencing tool could not account for: bank statements in a reply settle it, if the reply has somewhere to go. The record also protects the business, because an automation that refuses people quietly is a close relative of one that fails without telling you, and the business answers for what its automation told the customer either way. Which of your flows can say no on their own is one of the questions a process audit is built to answer.
Where this leaves you
In the United Kingdom the rule changed on 5 February 2026, when Article 22 was replaced by Articles 22A to 22D of the UK GDPR. The new articles keep four safeguards (information, representations, human intervention and the right to contest) for any "significant decision" taken by automated processing alone.
Does this "no" reach the threshold? It does when money, housing, work, education or an ended contract is on the other side, or when the same person keeps getting locked out; one small order sits below it, and a route back costs almost nothing anyway. Write the address into the message, because the tool's default reason and its notification checkbox leave it out.
Who can change the decision, and do they know it is theirs? The register of what is automated has a column for the owner of each flow. For a flow that refuses, write the owner's name against the review step too, and tell them before the first reply arrives.
If you would rather have someone map which of your automations can say no, on whose data, and who stands behind each one: that is part of the process audit. $299, three business days, and a written map you keep whether or not you hire us.
Nothing here is legal advice.
Related: what happens to customer data you paste into an AI tool covers the other direction of the same data.