Automated decision-making

First ask whether a person really decides

Automated decision-making is not every use of software or artificial intelligence. It becomes solely automated when no person has meaningful involvement in taking the decision. A manager who simply accepts a score without authority, time or information to change it is not necessarily providing meaningful review.

A decision is significant when it produces a legal or similarly significant effect. Rejecting an applicant, ending employment or determining access to an important workplace benefit can be significant. Sorting a list for genuine human assessment may not be.

Use the rules now in force

The Data (Use and Access) Act 2025 replaced the previous UK GDPR Article 22 structure. The relevant Part 5 provisions came into force on 5 February 2026, as the official commencement record confirms. Significant decisions based solely on automated processing can now be made in wider circumstances when a valid lawful basis and required safeguards are present.

Special category data remains more restricted. The section 80 explanatory notes explain the retained conditions and the need to consider profiling when deciding whether human involvement is meaningful.

Design the challenge before deployment

Map the input data, purpose, lawful basis, logic, effect and people affected. Test accuracy, bias, accessibility and unusual cases. A data protection impact assessment should establish whether the use is necessary and proportionate, not merely record that a tool has already been bought.

Give the reviewer enough authority and context to reconsider the decision. Record the original result, the person's representations, the human assessment and the final outcome. Review this process when the model, data, threshold or employment use changes.