The UK rules since February 2026

Until 5 February 2026, Article 22 of the UK GDPR gave people a right not to be subject to a decision based solely on automated processing that had legal or similarly significant effects, with narrow exceptions. Section 80 of the Data (Use and Access) Act 2025 replaced it with Articles 22A to 22D, which flip the default.

  • Article 22A defines the terms. A decision is based solely on automated processing if there is no meaningful human involvement in taking it. A significant decision is one with a legal or similarly significant effect on the person.
  • Article 22B keeps the old restriction where special category data (health, ethnicity, biometrics and similar) is involved: a significant decision based on it is allowed only with the person's explicit consent or on a narrow necessity ground.
  • Article 22C sets the safeguards that every other significant automated decision needs: telling the person about the decision, letting them make representations, letting them obtain human intervention, and letting them contest it.
  • Article 22D lets the Secretary of State make regulations clarifying these terms and the safeguards.

The practical shift is from prohibition with exceptions to permission with safeguards. A firm can now automate significant decisions more freely, but only if it can deliver the safeguards at scale.

What meaningful human involvement means

Whether a decision is solely automated turns on the word meaningful. A person who rubber-stamps the system's output, lacks the authority or information to disagree, or cannot realistically review the volume in front of them does not provide meaningful involvement, and the decision counts as automated. That is automation bias with a legal consequence.

The ICO consulted on draft guidance on automated decision-making in 2026, with final guidance expected later in the year, and a statutory code of practice on AI and automated decision-making is in preparation. Until both are final, the safest reading is the one the ICO has long applied: involvement is meaningful when the reviewer considers the relevant information, has the authority to change the outcome, and actually does so when warranted. See human-in-the-loop.

How it differs from profiling and from EU AI Act high-risk status

Profiling is automated processing to evaluate or predict aspects of a person, such as creditworthiness or behaviour. It is often the input to an automated decision, but profiling alone is not a decision, and an automated decision need not involve profiling.

EU AI Act high-risk status depends on the use (Annex III), not on whether a human is in the loop. A credit-scoring model used to inform a human underwriter is still a high-risk AI system under the Act, while under UK data protection law the same decision may not be solely automated at all. A UK firm with EU customers has to answer both questions separately.

Outside the UK

The same idea is spreading under the label automated decision-making technology (ADMT).

  • California: regulations from the California Privacy Protection Agency, approved in September 2025, require businesses using ADMT for significant decisions about consumers to give pre-use notices, opt-out and access rights, and to carry out risk assessments. Existing uses must comply by 1 January 2027.
  • Colorado: SB 26-189, signed on 14 May 2026, repealed the state's original AI Act before it took effect and replaced it with an ADMT notice regime for consequential decisions from 1 January 2027. Its enforcement is the subject of litigation.
  • EU: Article 22 of the EU GDPR has taken the older prohibition-with-exceptions approach, so a firm serving both markets should check which rule governs each decision.

What good looks like

  • Know which decisions are automated. Record in the AI inventory every significant decision an AI system takes or shapes, and whether a human is meaningfully involved.
  • Build the four safeguards into the journey, not into a policy document: an explanation at the point of decision, a route to make representations, a real human review on request, and a way to contest.
  • Test the human involvement you rely on: override rates, time spent per review, and whether reviewers can say why they agreed.
  • Treat special category data separately, because Article 22B still restricts it.

The register entry is automated decision-making without safeguards; the control is automated decision-making safeguards.

Frequently asked questions

What is automated decision-making under UK GDPR? A decision about a person taken by technological means with no meaningful human involvement. Where it has a legal or similarly significant effect, Articles 22A to 22D apply.

Did the Data (Use and Access) Act 2025 ban automated decisions? No, it relaxed the rules. Since 5 February 2026 significant automated decisions are allowed, with safeguards, except where they are based on special category data.

What safeguards are required? Information about the decision, the opportunity to make representations, human intervention, and the right to contest the decision.

What is ADMT? Automated decision-making technology, the term used in California's privacy regulations and Colorado's 2026 law for systems that make or substantially shape consequential decisions about people.

Where it sits in the register

Automated decision-making without safeguards is the gap the UK rules target, and inadequate explainability for affected individuals is what makes the first safeguard fail. The controls are automated decision-making safeguards and human-in-the-loop review.