Automated decision-making (ADM) is a significant decision about a person that is based solely on automated processing, meaning no meaningful human involvement in the taking of the decision, and that produces a legal effect or a similarly significant effect for the data subject, per Article 22A of the UK GDPR.
That statutory sense of the term is narrower than the everyday one, which treats any software step inside a workflow as an automated decision. Only the data protection sense triggers duties, and the first limb turns on quality rather than presence: when considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling, which is the steer Article 22A(2) supplies.
Key Takeaways
- Section 4A replaced the article most explainers still quote. Section 4A was substituted for Article 22 of the UK GDPR by the Data (Use and Access) Act 2025, in force 5 February 2026 so far as not already in force.
- The general regime is a safeguards duty, built on 4 measures, according to Article 22C. The safeguards must consist of or include measures which provide the data subject with information about decisions, enable the data subject to make representations about such decisions, enable the data subject to obtain human intervention on the part of the controller, and enable the data subject to contest such decisions.
- Only special-category decisions carry a bar, and it lifts on 2 conditions, per Article 9(1). A significant decision based entirely or partly on processing of special categories of personal data may not be taken based solely on automated processing, unless one of the following conditions is met.
- The regulator now has a statutory code to write, per Regulation 2. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 were made on 16 April 2026, laid before Parliament on 21 April 2026, and came into force on 12 May 2026.
- Policing runs on a separate, narrower test under sections 50A to 50C of the Data Protection Act 2018, where a decision is a significant decision if it produces an adverse legal effect for the data subject, or it has a similarly significant adverse effect for the data subject.
How Does Automated Decision-Making Work?
A system ingests personal data, produces an output, and that output becomes the decision. The law then asks one question about the process rather than the technology: did a person meaningfully shape the result? Article 22A splits that question into 2 limbs, and both have to be met before any duty attaches.
Picture a turnstile that reads a pass and either opens or stays shut. A supervisor may be standing beside it, but the gate is only human-supervised if that person can actually override it. Presence is not involvement, and the statutory wording is built around exactly that gap.
1. Personal Data Enters the System
Data protection scope is wider than the restriction itself, according to ICO guidance. The UK GDPR applies to all automated individual decision-making and profiling, so ordinary data protection obligations sit underneath every model output regardless of how significant the result is.
2. Profiling May Shape the Output
Profiling is the evaluative layer, not the decision itself. Profiling is automated processing of personal data to evaluate certain things about an individual, and profiling can be part of an automated decision-making process. A model that scores an applicant is profiling; the refusal that follows is the decision.
3. The Output Becomes the Decision
Significance turns on effect rather than technical sophistication. A decision qualifies as significant where it produces a legal effect for the data subject, or it has a similarly significant effect for the data subject, which covers outcomes such as access to credit, employment, or a service.
4. The Human-Involvement Test Is Applied
Human involvement decides most borderline cases. A decision is based solely on automated processing where there is no meaningful human involvement in the taking of the decision, and the assessor is directed to weigh the extent to which the decision is reached by means of profiling.
5. The Safeguards Attach
Meeting both limbs switches on the duty in Article 22C(1). Where a significant decision is based entirely or partly on personal data, and based solely on automated processing, the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place.
| Statutory phrase | Where it sits | What it fixes |
|---|---|---|
| Based solely on automated processing | Article 22A(1)(a) | No meaningful human involvement in the taking of the decision |
| Significant decision | Article 22A(1)(b) | A legal effect, or a similarly significant effect, for the data subject |
| Meaningful human involvement | Article 22A(2) | Weigh the extent to which the decision is reached by means of profiling |
| Safeguards duty | Article 22C(2) | Information, representations, human intervention, and the ability to contest |
| Special-category restriction | Section 4A, restrictions Article | No solely automated significant decision on special category data unless a condition is met |
Source: UK GDPR Articles 22A to 22C, legislation.gov.uk
What Counts as Meaningful Human Involvement?
No statutory definition exists yet. Article 22A(2) directs the assessor to weigh how far profiling drove the outcome, and Article 22D reserves the rest for regulations: the Secretary of State may by regulations provide that there is, or is not, to be taken to be meaningful human involvement in the taking of a decision in cases described in the regulations.
Why Does Automated Decision-Making Matter?
Meeting the definition converts a design choice into a set of duties owed to the individual. Article 22C(2) states what those duties look like in practice, and one of them is expressed as a right to reach a person: enable the data subject to obtain human intervention on the part of the controller.
The four measures a controller must provide or include are:
- Information about the decisions taken in relation to the data subject.
- A route to make representations about those decisions.
- Human intervention on the part of the controller.
- The ability to contest the decision.
Our AI coverage keeps landing on the same fault line: oversight labeled as human review often carries no authority to change the outcome. The move from human involvement to meaningful human involvement is the substantive change in the 2026 regime, not a drafting tidy-up. The same question drives the AI autonomy and oversight data we track across agentic systems, where the gap between a monitored process and a controllable one keeps widening.
Is Automated Decision-Making Banned Under UK Law?
Not as a general matter. The bar is targeted: a significant decision based entirely or partly on processing of special categories of personal data may not be taken based solely on automated processing unless a condition applies. Everything outside that category sits under the Article 22C safeguards duty instead of a prohibition.
Pros, Cons, and Risks
Automation changes what a decision costs and what it hides. Both sides of that trade sit inside the same statutory frame.
Advantages
- Consistency at volume, because a documented rule set applies the same criteria to every case.
- Speed, since a decision that once queued behind a caseworker can resolve in seconds.
- Auditability, as the inputs and thresholds behind an outcome can be recorded and re-run.
- A statutory route back to a person, given that the safeguards must enable the data subject to obtain human intervention on the part of the controller.
Trade-offs and Risks
- Explainability, since profiling-driven outputs resist plain-language reconstruction.
- The special-category restriction, which bites hardest on health, biometric, and similar data.
- An open definitional question, because meaningful human involvement has a statutory steer but no statutory definition.
- Regulator lag: the ICO’s published guidance still describes Article 22 of the UK GDPR as the source of the additional rules for solely automated decisions with legal or similarly significant effects, wording the substitution has overtaken.
Hiring shows the tension most clearly, and AI recruitment screening data tracks how far automated filtering already reaches into shortlisting before any human opens a file.
Types of Automated Decision-Making Under UK Law
Two regimes carry the term, and a further restriction sits across both. Read them as two rulebooks bound into one volume: the same words are measured against a different mark depending on who is taking the decision and why.
| Regime | Governing provisions | Significance test |
|---|---|---|
| General processing | UK GDPR Articles 22A to 22C | A legal effect, or a similarly significant effect, for the data subject |
| Law enforcement processing | Data Protection Act 2018, sections 50A to 50C | An adverse legal effect, or a similarly significant adverse effect |
| Special-category decisions | UK GDPR Section 4A, restrictions Article | Restricted unless explicit consent, or the contract-or-law condition with Article 9(2)(g) |
Source: legislation.gov.uk, UK GDPR Articles 22A to 22D; Data (Use and Access) Act 2025 section 80
The text sets out 2 escape routes precisely. The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent, and the second condition is that the decision is necessary for entering into, or performing, a contract between the data subject and a controller, or required or authorised by law, and point (g) of Article 9(2) applies.
Article 22D leaves the definitional gaps to secondary legislation, with limits written into the section itself. Regulations may not amend Article 22C, and regulations under this Article are subject to the affirmative resolution procedure. The EU AI Act runs alongside data protection law as a separate regime, and EU AI Act compliance cost data tracks the reported cost of meeting it.
Real-World Applications
The ICO Code of Practice on AI and Automated Decision-Making
The statutory instrument that created this duty is specific about its subject matter. The Commissioner must prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data in relation to developing and using artificial intelligence, and automated decision-making, and the code of practice must include guidance as to good practice in the processing of children’s personal data.
The code has to cover three things:
- Good practice in developing and using artificial intelligence.
- Good practice in automated decision-making.
- Good practice in the processing of children’s personal data.
Scrutiny of the draft carries one express limit: The panel must not consider or report on any aspect of the code relating to national security. The regulator has confirmed the workstream on its own pages, where its current areas of focus include a Code of Practice on AI and Automated Decision Making and Automated Decision-Making systems.
Our AI compliance cost data tracks the spending side of duties like this one.
Credit Scoring After the Schufa Judgment
Credit scoring is the clearest worked example a court has produced, though it comes from EU rather than UK case law. In Case C-634/21, decided on 7 December 2023, the Court of Justice held that scoring must be regarded as an ‘automated individual decision’ prohibited in principle by the GDPR, in so far as SCHUFA’s clients, such as banks, attribute to it a determining role in the granting of credit.
That judgment interprets the EU GDPR and the predecessor provision, so it reads as persuasive context for the UK position rather than binding authority on it.
Scenario: An Application Refused Overnight
An applicant submits a form at midnight. A model scores the file against historic repayment data, the score falls below a threshold, and a refusal email goes out before anyone reads the case.
No person reviewed the file, so the human-involvement limb is met. The refusal decides access to credit, so the significance limb is met too.
Which system produced that score matters to the profiling question, and our AI model tracker follows the models most often embedded in decision workflows.
What Is the Difference Between Profiling and Automated Decision-Making?
Profiling evaluates a person; automated decision-making acts on that evaluation. The regulator draws the line the same way, describing automated individual decision-making as making a decision solely by automated means without any human involvement, and profiling as automated processing of personal data to evaluate certain things about an individual.
The two overlap without being the same thing. Profiling can be part of an automated decision-making process, and a profile that never drives an outcome stays outside the Article 22C safeguards duty while remaining subject to the rest of data protection law.
Conclusion
Automated decision-making is now defined by statute rather than by inference. Section 4A was substituted for Article 22 with effect from 5 February 2026 so far as not already in force; the two-limb test in Article 22A decides what counts, the restrictions Article bars special-category decisions from solely automated processing, and Article 22C attaches the four safeguards to everything else that clears both limbs.
Two gaps stay open. Article 22D reserves the meaning of meaningful human involvement for regulations, and the code of practice remains an open regulator workstream: its current areas of focus include a Code of Practice on AI and Automated Decision Making. Until both land, the sharpest question in the definition, how much human involvement is enough, rests on the profiling steer in Article 22A(2) alone.
