Automated decision-making under UK GDPR changed on 5 February 2026. The old Article 22, which gave people a right not to be subject to a solely automated decision with legal or similarly significant effects, was replaced by Articles 22A to 22D. Most such decisions are now allowed, provided the business gives the person four safeguards: information, a chance to make representations, human intervention and a way to contest. Special category data stays restricted. Below are the tests for small businesses whose AI tools screen or approve people.
The rules below come from the Data (Use and Access) Act 2025 and its commencement regulations on legislation.gov.uk, and from guidance and reports published by the Information Commissioner’s Office (ICO). The worked example uses an invented business to show how the tests apply.
What changed, and from when
Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with four new articles. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, made on 29 January 2026, brought section 80 into force on 5 February 2026 (regulation 2(j)). Regulation 5 keeps the old Article 22 for decisions taken before that date, so a challenge to a decision made in January 2026 is judged under the previous rule.
| Old Article 22 (to 4 February 2026) | Articles 22A to 22D (from 5 February 2026) | |
|---|---|---|
| Starting point | A right not to be subject to a solely automated decision with legal or similarly significant effects | Such decisions may be taken if safeguards are in place |
| When allowed | Necessary for a contract, authorised by law, or explicit consent | Any lawful basis, except recognised legitimate interests |
| Special category data | Restricted | Still restricted: explicit consent, or contract or law plus substantial public interest |
| Safeguards | Human intervention, expressing a view, contesting | Information, representations, human intervention, contesting |
The comparison column for the old rule follows the adopted text of Article 22. Businesses that also serve people in the EU should note that the EU GDPR still contains the original Article 22; the UK change does not alter it.
The two tests: solely automated, and significant
Article 22A defines the scope. Both tests have to be met before the new rules apply.
Solely automated. A decision is based solely on automated processing if there is no meaningful human involvement in taking it. Article 22A(2) adds that when deciding whether human involvement is meaningful, you must consider the extent to which the decision is reached by means of profiling.
Significant. A decision is a significant decision if it produces a legal effect for the person or has a similarly significant effect for them.
The Act does not list examples. In practice, small businesses meet these tests in a few common places:
- shortlisting or rejecting job applicants with a screening tool;
- approving or declining credit, payment terms or a tenancy application;
- setting individual prices or refusing service based on a risk score;
- flagging a customer or employee for fraud and freezing their account automatically.
A tool that sorts support tickets or drafts emails for staff to edit is unlikely to make significant decisions about anyone. A tool that sends rejection emails to candidates with no person looking at the case probably does.
What “meaningful human involvement” means in practice
This phrase decides whether you are inside or outside the new articles, and it is where most small businesses will need to look hardest.
The ICO’s existing guidance on individual rights in AI systems sets out what a meaningful human review looks like. The page is marked as under review following the 2025 Act, but its description of human review is the most detailed the ICO has published. It says reviewers should:
- be active in their review of a decision, not apply automated outputs as a token gesture;
- have the authority and competence to go against the recommendation;
- weigh and interpret the recommendation, consider all available input data and take other additional factors into account.
The same guidance says that if a person only rubber-stamps the system’s output, the decision is still solely automated. A manager who clicks “approve” on every recommendation without seeing the underlying information does not take the decision out of scope.
Article 22D lets the Secretary of State make regulations saying when there is, or is not, meaningful human involvement, and which kinds of decision do or do not have a similarly significant effect. The ICO consulted on draft guidance on automated decision-making, including profiling between 31 March and 29 May 2026. Its guidance plans page lists the final version for winter 2026. Until then, the existing AI guidance is the best published reference for how the ICO assesses human review.
The four safeguards for solely automated decisions
Where a significant decision is solely automated, Article 22C requires the controller to have safeguards in place for the person’s rights, freedoms and legitimate interests. Those safeguards must include measures that:
- provide the person with information about decisions of this kind taken in relation to them;
- enable the person to make representations about such decisions;
- enable the person to obtain human intervention on the controller’s part in relation to such decisions;
- enable the person to contest such decisions.
For a small business, each of these becomes a concrete task.
| Safeguard | What it means operationally |
|---|---|
| Information | Tell people, at the point of the decision or before, that a decision is made automatically and what it covers. Put it in the privacy notice and in the decision message. |
| Representations | Give a route for the person to add information the system did not see, such as a reply address or form. |
| Human intervention | Name who reviews a case on request, and give that person the authority to change the outcome. |
| Contest | Explain how to challenge the decision and what happens next, including a timescale you can keep. |
These safeguards apply to each solely automated significant decision, not only when someone complains. If your tool rejects a hundred applicants a week, each rejection needs to carry the information and the routes.
Special category data and recognised legitimate interests
Article 22B adds restrictions on top of the safeguards.
Special category data. A significant decision based entirely or partly on special category data, such as health, ethnic origin, religious beliefs or trade union membership, may not be taken solely by automated processing unless one of two conditions is met: the decision is based entirely on data the person has explicitly consented to, or the decision is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies. For most small businesses, this means keeping such data out of automated decision tools altogether unless explicit consent has been properly obtained.
Recognised legitimate interests. The 2025 Act added a new lawful basis, recognised legitimate interests, in Article 6(1)(ea). Article 22B(4) says a significant decision based solely on automated processing cannot rely on that basis. You need another lawful basis, such as contract or ordinary legitimate interests, and you still need the Article 22C safeguards.
A new complaints duty from 19 June 2026
A separate change matters for anyone who contests an automated decision. Section 103 of the 2025 Act inserted a new section 164A into the Data Protection Act 2018. It gives people the right to complain to the controller about an infringement of the UK GDPR, and requires the controller to:
- facilitate complaints, for example by providing a complaint form that can be completed electronically;
- acknowledge a complaint within 30 days of receiving it;
- take appropriate steps to respond without undue delay, including making appropriate enquiries;
- inform the complainant of the outcome without undue delay.
The commencement regulations brought this duty into force on 19 June 2026 (regulation 3), and regulation 7 applies it to complaints received from that date. A business that makes automated decisions should route contests and complaints through the same process, so the 30-day acknowledgement is not missed.
What the ICO found in recruitment
Recruitment is where the ICO has looked most closely. Its Recruitment rewired review gathered evidence from more than 30 employers between March 2025 and January 2026. It found that many were likely to be relying on solely automated decisions in hiring, and said that transparency needed to improve, that human involvement needed to be applied consistently, and that employers should monitor their tools for bias.
In an accompanying blog post, the ICO said it had written to 16 organisations about their practices. The expectations it set out were to monitor for bias, be transparent with candidates and explain how they can challenge a decision.
For a small employer buying a screening product, the practical message is that the supplier’s tool may be making the decision in law even if you think of it as an assistant. If candidates are rejected automatically, the four safeguards apply to you as the controller.
A worked example: an AI shortlisting tool
The business below is invented. A 25-person design studio in Manchester receives about 200 applications for each junior role. It buys an applicant tracking system that scores CVs against the job description and can send rejection emails automatically to anyone below a threshold score.
Step 1: Is the decision significant? Rejecting a job application affects the person’s access to work. The studio treats it as a decision with a similarly significant effect.
Step 2: Is there meaningful human involvement? In the default set-up, applicants below the threshold receive a rejection with no person looking at their CV. That is solely automated. Applicants above the threshold are reviewed by the studio’s lead designer, who reads each CV and decides who to interview.
Step 3: Choose a design. The studio has two options.
- Option A: keep automatic rejections and add the safeguards. The rejection email says the decision was made automatically, explains in plain words what the score is based on, invites the applicant to add information and gives an address where they can ask for a person to review the decision or contest it. The studio names who handles these requests and sets a turnaround it can keep.
- Option B: put a meaningful review in front of every rejection. The lead designer sees the low-scoring CVs in a list with the reasons the tool gave, has the authority to move anyone forward, and opens a sample of them every round. Rejections are only sent after that review.
Option B takes more time but may take the decision outside Article 22A, provided the review is genuine. Option A keeps the time saving but requires the safeguards on every rejection. Either way, the studio checks that its tool does not use special category data, such as information inferred about health or ethnicity, and keeps a record of how it monitors outcomes for bias, as the ICO expects.
Step 4: Complaints. Since 19 June 2026 the studio must also acknowledge any data protection complaint within 30 days. It adds a complaint form to its careers page and logs the date each complaint arrives.
How this fits with the EU AI Act
A business that hires or serves people in the EU may also fall under the EU AI Act. Annex III of Regulation (EU) 2024/1689 lists AI systems used to filter job applications and evaluate candidates among high-risk uses, with duties for deployers such as human oversight. Our guide to the EU AI Act for small businesses covers those duties. The two regimes overlap in spirit but are separate: meeting one does not show compliance with the other.
A checklist for automated decisions
- List every place a tool decides about a person. Include supplier tools, not only systems you built.
- Mark which decisions are significant. Look for legal effects or similarly significant ones, such as jobs, credit, tenancy, pricing and account access.
- Test the human review. Does the reviewer see the inputs, have authority to change the result and actually use it? A rubber stamp does not count.
- Pick a lawful basis. Do not rely on recognised legitimate interests for solely automated significant decisions.
- Keep special category data out, unless you have explicit consent or a legal condition plus substantial public interest.
- Build the four safeguards into the decision message: information, representations, human intervention and a contest route.
- Run a complaints process that acknowledges within 30 days and records outcomes.
- Monitor and document. Check outcomes for bias and keep notes of what you checked and when.
Human review also matters for AI tools that do not decide about people. Our guide to AI invoice review with human checks shows how to design review steps for a finance workflow, and the guide to AI agent tests covers testing a tool before it touches real accounts.
Sources and document dates
Checked 13 October 2026. Legislation: Data (Use and Access) Act 2025, section 80 (Articles 22A to 22D); Data (Use and Access) Act 2025, section 103 (Data Protection Act 2018, section 164A); SI 2026/82, made 29 January 2026 (regulations 2(j), 3, 5 and 7); UK GDPR Article 22 as adopted. ICO: How do we ensure individual rights in our AI systems? (marked under review); consultation on draft guidance on automated decision-making, March 2026; plans for new and updated technology guidance; Recruitment rewired; blog: automated decisions in hiring, March 2026. EU: Regulation (EU) 2024/1689, Annex III.
