AI in course platforms and GDPR Article 22 — what's actually required.

What Article 22 actually says

GDPR Article 22(1) reads:

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

In plain English: if a computer makes a decision about an EU resident that has a legal or similarly significant effect, the EU resident has a right to have a human review that decision.

Two phrases matter.

"Solely automated processing" means the decision was made without meaningful human involvement. A human rubber-stamping a list of computer-generated decisions doesn't qualify. A human reviewing each decision before it's actioned does.

"Legal or similarly significant effect" is a high bar. The European Data Protection Board has guidance on what qualifies. Things that clearly qualify: credit decisions, hiring decisions, denial of access to a service, exam grading that determines certification. Things that clearly don't qualify: product recommendations, search results, marketing personalisation.

The grey area in course platforms is where this gets interesting.

What this means for AI in a course platform

Most AI features in course platforms fall on the safe side of Article 22. Some don't. The honest map:

Generally safe — augmentation features

Semantic search across course content. Surfacing the lesson clip that answers a student's question is not a decision; it's discovery. No Article 22 issue.

Content recommendations ("students who finished this also took..."). Suggestion, not decision.

Automated transcription. Mechanical processing, no decision.

Summary generation. Producing a summary of a lesson is not a decision about a student.

Quiz feedback that explains why an answer was wrong. Augmenting the student's learning, not deciding anything.

These features can be shipped without Article 22 concerns. The remaining GDPR questions are about training data, inference location, and consent — important, but not Article 22.

Article 22 territory — decision features

Automated grading that determines course completion. If passing the auto-graded quiz determines whether the student receives a certificate that has value in the labour market, that's a decision with "similarly significant effect."

Automated admission decisions to a cohort or programme.

Automated denial of access based on engagement scores or behavioural signals.

Automated proctoring that flags students as cheating.

AI-powered certification without human review.

These features are not banned by Article 22. They are governed by it. To deploy them legally, the platform needs to provide:

1. Meaningful human review (the human must have authority and information to override).
2. The right of the data subject to express their view.
3. The right to contest the decision.
4. Transparency about the logic involved.

In practice most AI-powered grading and admission features being shipped in 2025-2026 do not meet this bar. Some don't pretend to. Some do pretend to and don't actually deliver. This is the next wave of GDPR enforcement, and most course platforms are not ready for it.

The three commitments any AI course platform should make

If you're picking a course platform with AI features, here are three commitments worth asking for in writing:

1. No training on customer content without explicit consent

The single biggest concern most creators have about AI in course platforms is whether their content is training models. The default-off posture is rare; the default-on posture is common.

The right answer is contractual. The platform should commit, in writing, that customer content is not used to train any third-party model unless the customer explicitly opts in. The commitment should be enforceable, not aspirational.

2. Human-in-the-loop for any decision affecting access or completion

If the platform's AI is making decisions that fall within Article 22 territory — grading that determines certification, admission decisions, access denials — there should be a documented human review step. The platform should be able to show you the workflow and the audit log.

3. Transparent model lineage

You should be able to find out, without a sales call:

• Which model is running for each AI feature.
• Where the model is hosted (region).
• Whether the model provider has access to your data.
• How long embeddings, transcripts, and other AI-derived artefacts are retained.

If your platform can't tell you this, the platform itself probably doesn't know. That's a problem.

What lernaura's AI does — and doesn't do

We built lernaura's AI in 2024 with Article 22 in mind. The decisions:

Semantic search runs on Mistral-hosted embeddings in France. Students ask questions in natural language; the system surfaces the exact lesson clip, transcript moment, or community thread. This is augmentation; no Article 22 issue.

Content recommendations suggest next lessons and related community discussions. Suggestion, not decision.

Transcription happens on EU-resident infrastructure. Mechanical processing.

We do not do automated grading that determines certification. Quizzes are graded automatically only for non-stakes feedback. Where assessment determines completion or certification, a human educator (the creator) approves before it's final.

We do not do automated admission decisions. Access to a course is the creator's call, supported by the platform but not made by it.

We do not do automated denial of access based on engagement scores or other behavioural signals.

We do not use customer content to train any third-party model. This is contractual with Mistral and applies to every customer on every plan.

The pattern: AI as augmentation, not as decision-making. Where decisions happen, humans make them with platform support — not the other way around.

This isn't a constraint we resent. It's the architectural choice we'd make even if Article 22 didn't exist, because the alternative — AI making decisions about students without accountability — is a product we don't want to ship.

What to ask any AI course platform

Six questions, in priority order:

1. Where does inference run? (Region. Specific provider.)
2. Is customer content used to train any third-party model? (Yes / No. Contractually.)
3. Do any AI features make decisions about students that affect access, grading, or certification? (If yes, what's the human review workflow?)
4. How long are AI-derived artefacts (embeddings, transcripts) retained?
5. Is the AI subprocessor in your published subprocessor list?
6. What's your stance on Article 22 specifically?

A platform that has thought about this will have prepared answers. A platform that hasn't will improvise. The difference is meaningful.

Beyond Article 22 — the EU AI Act layer

Article 22 is the GDPR's automated-decision-making provision. The EU AI Act (in force from 2024, phased applicability through 2026-2027) layers on top with documentation requirements that affect every AI feature on a platform, not just decision-making.

For a platform with AI bolted onto an existing architecture in 2023, this is a documentation crisis. For a platform built AI-first on the assumption that this regulation was coming, it's just how the system already works.

lernaura runs every AI invocation as a versioned skill — a documented, auditable unit that records:

• Which model was used (Mistral, Gladia, or the specific embedding model), and its version
• The data and inputs the model received
• The output it produced
• Timestamp, context, and the skill version in effect

This means EU AI Act documentation isn't something we reconstruct from logs when asked. The documentation is the architecture, and audit trails are exportable on request. For B2B procurement teams and DPOs starting to ask AI Act-shaped questions in 2026, that's the answer that lets the deal continue.

The longer arc

GDPR Article 22 has been quietly underused since 2018. The European Data Protection Board has been clear since 2023 that they expect more enforcement as AI becomes pervasive, and 2025-2026 have seen the first significant fines for non-compliant automated decision-making in adjacent industries (insurance, HR tech, credit).

Course platforms are next. The first creator to challenge an automated grading decision through their national data protection authority is going to start a wave that reshapes how platforms build these features. Better to be on the right side of it now than to discover you're on the wrong side after the fact.