A dormant right has come awake. The right not to be subject to a decision based solely on automated processing first appeared in Article 15 of the 1995 Data Protection Directive, and for twenty-five years it was a sleeping provision. That dormancy ended on December 7, 2023, when the CJEU First Chamber decided SCHUFA Holding (Case C-634/21, ECLI:EU:C:2023:957). Dun & Bradstreet Austria (Case C-203/22, ECLI:EU:C:2025:140) followed on February 27, 2025. Article 86 of the EU AI Act amplified the right legislatively in 2024, and the Council of Europe's Framework Convention on Artificial Intelligence (CETS No. 225), opened for signature in Vilnius on September 5, 2024, anchored it in the world's first binding AI treaty. Five stages of institutional layering — from SCHUFA in December 2023 to Dun & Bradstreet in February 2025 — built a de facto fundamental right in fifteen months.
The formation inverts the Thaler pattern. In AI copyright, the Thaler v. Perlmutter lineage (130 F.4th 1039, D.C. Cir. 2025; cert. denied, No. 25-449, March 2, 2026) produced surface differentiation, deep convergence — different doctrines, same outcome. Automated decision-making produces the opposite — surface convergence, deep divergence. The EU strengthens the right through the SCHUFA + Dun & Bradstreet + AI Act + Framework Convention build. The U.K. inverted the prohibition default with its 2025 Data Act. The U.S. halted federal rights-formation with the Trump executive orders. China runs a different model entirely.
Why Now — Five Stages of Layering
Three triggers fired in 2022-2023 at once. Gig-economy algorithmic-management disputes targeted Uber, Ola, and Deliveroo. The generative-AI commercial moment (DALL·E 2 to ChatGPT, April-November 2022) put automated decisions in mainstream view. The EU AI Act crossed the legislative finish line. The three combined produced a prepared judicial response — SCHUFA.
Phase 3 and Phase 4 overlapping is the operative move. SCHUFA judicially dismantled the "solely automated" threshold while AI Act Article 86 dismantled it legislatively — Article 86's right to explanation does not include the "solely automated" requirement at all. A right that did not function for twenty-five years was strengthened on two axes in fifteen months.
The Twin Pivots — SCHUFA and Dun & Bradstreet
Not one landmark case, two. SCHUFA decided what counts as a decision. Dun & Bradstreet decided what an explanation has to do.
SCHUFA chose broad construction. Where a third party "draws strongly" on a credit score, the score-generation itself is an Article 22 decision. The Court was explicit about why: a narrower reading would create a "lacuna in legal protection." The Hamburg DPA has stated, in terms, that the principle applies to AI-based decisions generally.
Dun & Bradstreet §§58-59 ended the academic dispute. A controller cannot satisfy Article 15(1)(h) by providing a "complex mathematical formula, such as an algorithm" or a "detailed description of all the steps in automated decision-making." The right is a right to an explanation of "the procedure and principles actually applied" (§58). Seven years of dispute between the Wachter–Mittelstadt–Floridi and Malgieri–Comandé schools (2017) resolved on the Dun & Bradstreet side of the line — the Malgieri school's judicial victory. The anchor in Article 47 of the EU Charter (effective judicial protection) signals the move into fundamental-rights register.
Drivers v. Uber and Ola (Amsterdam Court of Appeal, April 4, 2023) supplied the substantive meaning of "solely automated": nominal human review is "purely symbolic" and cannot defeat Article 22.
Surface Convergence, Deep Divergence — Inverting Thaler
Four patterns at the surface; four incompatible models underneath.
EU prohibition model (strengthening) — GDPR Article 22 + AI Act Article 86 + Convention 108+ + Framework Convention. Four-layer build.
U.K. permissive model (weakening) — DUAA 2025 ss. 22A-22D, in force February 5, 2026. Inverts the prohibition default. The most material post-Brexit doctrinal divergence.
U.S. sectoral-and-state patchwork (diverging) — Colorado SB24-205, California CCPA ADMT, NYC Local Law 144 against EO 14179 (January 23, 2025, "Removing Barriers to American Leadership in AI") and EO 14365 (December 11, 2025, "Ensuring a National Policy Framework for AI" — DOJ AI Litigation Task Force; state-law preemption). In *X.AI LLC v. Weiser* (D. Colo., April 9, 2026), the DOJ intervened on April 24 and Chief Judge Domenico stayed enforcement on April 27 — the first execution of EO 14365, and the first federal-state collision.
Chinese platform-regulation model — PIPL Article 24 plus the Algorithm Recommendation Provisions. Platform regulation rather than individual right.
The doctrinal asymmetry has a source. Informational self-determination (Germany's Volkszählungsurteil, BVerfGE 65, 1, December 15, 1983) and dignity-based theory (Rodotà) converging on the EU side make rights enhancement the natural conclusion. The Anglo-American side has incentive theory alone — and that theory sits comfortably with deregulation. The 19th-century German Persönlichkeitsrecht tradition and the 1710 Statute of Anne's commercial-property tradition arrived at the same destination by accident in Thaler. In automated decision-making, they split along historically predictable lines.
The Tests — Present Tense
Thaler's tests pointed to the future. Automated decision-making's tests are already here.
The spread of U.K. retrenchment. Whether Australia, New Zealand, and Canada follow the U.K. model is the key question of the next 18 months. The Commission's December 19, 2025 renewal of U.K. adequacy is "not materially lower," not equivalence vindication. The December 27, 2031 review reopens the question. Convention 108+ remains short of entry into force — 34 of 38 ratifications. The global rights-formation project is in progress but not finished.
The globalization of U.S. deregulation. The two Trump EOs work together — 14179 (federal deregulation) and 14365 (active attack on state law). *X.AI LLC v. Weiser*'s outcome will signal the direction. If Colorado's AI Act falls on First Amendment grounds, the state-law model takes a decisive hit. The Trump administration's refusal to ratify the Framework Convention is hollowing out the world's first binding AI treaty in real time.
Generative and agentic AI breaking the "decision" category. The Hamburg DPA has stated that mechanically following LLM output triggers Article 22. If agentic AI exceeds the deployer's effective control, the responsibility structure for automated decisions must be rewritten.
A sleeping right awoke. How far the woken right can travel is what is being tested now. The May 7, 2026 Digital Omnibus political agreement delaying AI Act high-risk obligations, the UK DUAA in force, the Trump EOs, and the DOJ intervention are all the present tense of that test.