Will AI “Subtly” Take Over Decision-making in the EU Migration Context? Warnings and Lessons from ETIAS and VIS

In 2019, the EU laid down the groundwork for interoperability in the Area of Freedom, Security and Justice, envisaging the use of algorithmic tools that can qualify as AI systems under the AI Act. AI tools used by EU migration databases are subject to the safeguards and the protective measures for individuals provided for under the AI Act, such as art. 86 thereof. However, given the fundamental rights impact of AI technologies processing large amounts of personal data, it is worth focusing on data protection law as one of the main strongholds against violations caused by AI in EU border and migration systems. In this Article we apply data protection provisions on purely automated decisions and the Court of Justice’s case law to the AI-enabled processing envisaged under two information systems, ETIAS and VIS. This processing was conceived as a supporting tool for competent authorities. This Article argues that, despite aiming to avoid solely automated decisions, the ETIAS and VIS processing might inadvertently lead to automation “taking over” the decision-making process. By contrast, a substantive reading of art. 22(1) GDPR (and art. 24(1) EUDPR) should not only prohibit decisions taken without any form of human involvement, but also decisions based on meaningless human involvement. As a result, the ETIAS and VIS processing may progressively reduce the extent to which human caseworkers review and question the AI-generated recommendations. By analysing the implications of the AI-enabled processing envisaged in the current EU border regulation, the Article seeks to draw useful lessons for further adoption of trustworthy AI in the border and security ecosystem.