Automated decision-making
In short
Automated decision-making (ADM) is when a computer system, such as an algorithm or AI model, makes a decision about a person with no meaningful human involvement. UK data law adds safeguards when such decisions significantly affect people.
- Also called
- ADM, Automated decisions, Solely automated decision-making, Article 22
- Topic
- Law, policy and the UK
- Level
- Some background helps
- First described
- The UK version of the right comes from Article 22 of the EU GDPR, Regulation (EU) 2016/679, which the UK kept after Brexit and then rewrote in the Data (Use and Access) Act 20251.
Plenty of software makes choices: a bank's system scoring a loan application, a recruitment tool filtering CVs. In law, the question is whether a human genuinely takes part in the decision or simply rubber-stamps it.
Until 2026 the UK GDPR's Article 22 gave people "the right not to be subject to a decision based solely on automated processing" where it had legal or similarly significant effects1. Organisations could only rely on such decisions in limited cases.
The Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D, in force from 5 February 20262. A decision counts as solely automated if there is "no meaningful human involvement", and as significant if it has a legal or similarly significant effect on the person2. The government describes the result as "a more permissive framework"3.
The new rules flip the default. Significant automated decisions are generally allowed, but the organisation must put safeguards in place: tell the person about the decision, let them make representations, let them ask for human intervention, and let them contest it2. Tighter limits remain where the decision uses special category data, such as health or ethnicity, which generally needs explicit consent or a legal basis2.
ADM is not the same as AI. A simple rule in a spreadsheet can be automated decision-making, and an AI tool that only advises a human who genuinely decides may not be. The ICO publishes guidance on explaining AI-assisted decisions to the people they affect4.
Example
If an online lender's software rejects your loan application on its own, the lender must tell you, let you give your side, and let you ask for a person to look at it again2.
Why it matters
More decisions about jobs, credit and benefits are being made by software. These rules decide when you can ask for a human to step in.
Questions people ask
Can a company make decisions about me using only AI?
In the UK, generally yes since 5 February 2026, even for significant decisions, provided it offers safeguards: telling you, hearing your views, offering human intervention and letting you contest the decision2. Decisions using sensitive data such as health information face tighter limits2.
What counts as meaningful human involvement?
The law says a decision is solely automated if there is "no meaningful human involvement", and that profiling must be considered when judging this2. A person who just clicks approve on whatever the system suggests is unlikely to count. Ministers can make regulations clarifying the test2.
Is automated decision-making the same as profiling?
No. Profiling is analysing personal data to evaluate or predict things about a person. It can feed into an automated decision, and the UK test for human involvement explicitly considers how far profiling was used2.
Related terms
Sources
- UK GDPR Article 22 as it stood on 18 June 2025 (point-in-time text), legislation.gov.uk
- Data (Use and Access) Act 2025, section 80, inserting UK GDPR Articles 22A to 22D (in force 5 February 2026 by S.I. 2026/82)
- DSIT, Data (Use and Access) Act 2025: data protection and privacy changes, gov.uk
- ICO, Artificial intelligence guidance hub (incl. Explaining decisions made with AI)