Artifact GuideUKAI And Automated Decisions

UK GDPR AI And Automated Decisions

AI and automated decision-making under the UK GDPR should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

This guide converts requirements into implementation-ready ownership, evidence, and review decisions. It is practical guidance, supporting implementation planning and should be validated against jurisdiction-specific legal, contractual, and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This UK GDPR page maps AI And Automated Decisions into a trigger, owner, deadline, required evidence, and review path so legal, privacy, security, and compliance teams can execute consistently.

Section 1

What should teams decide about AI And Automated Decisions under the UK GDPR?

Start by deciding whether the issue affects controller/processor roles, lawful basis, transparency, DPIA, data-subject rights, breach notification, IDTA/Addendum transfers, children data, or ICO enforcement exposure. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

Keep the UK GDPR source, DPA 2018 context, role map, lawful-basis analysis, DPIA/rights/breach/transfer evidence, and ICO-facing record together.

Define the exact AI And Automated Decisions trigger and the business process it affects.
Record which role, product, system, customer group, or data flow is in scope.
Attach the source-linked rule, the owner, and the evidence field before approving the control.
Escalate uncertainty when the facts depend on thresholds, exemptions, cross-border activity, vulnerable users, or enforcement-sensitive wording.

Sources for this answer

ICO guidance on automated decision-making and profiling

ICO guidance explains when Article 22 applies to solely automated individual decision-making, including profiling, with legal or similarly significant effects.

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

The UK approach to international data transfers

Primary source support for the AI And Automated Decisions decision.

Section 2

Who should own AI And Automated Decisions, and what evidence should prove the decision?

Ownership should sit with the team that controls the processing purpose, system behavior, vendor terms, transfer mechanism, rights channel, breach process, or child-user journey.

Evidence should show role mapping, lawful basis, Article 9/10 basis where needed, transparency wording, DPIA outcome, DSAR response, breach assessment, transfer mechanism, processor terms, and ICO escalation note.

Name one accountable owner and one reviewer for the AI And Automated Decisions workflow.
Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.

Sources for this answer

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

The UK approach to international data transfers

Evidence and ownership support for UK GDPR.

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

Section 3

Which edge cases should teams check before relying on an AI And Automated Decisions decision?

Most UK GDPR mistakes happen at the boundary between UK GDPR, DPA 2018, PECR, EU GDPR divergence, IDTA/Addendum transfer rules, children data, and processor/subprocessor duties.

Use this section before approving a new processing purpose, vendor, transfer, profiling flow, DSAR workflow, breach process, or child-facing product change.

Check whether the rule changes for minors, consumers, business users, public-sector bodies, regulated sectors, high-risk services, or cross-border transfers.
Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
Track unresolved assumptions in an open-questions section and route legal interpretation points for review.

Sources for this answer

ICO guidance on automated decision-making and profiling

ICO guidance explains when Article 22 applies to solely automated individual decision-making, including profiling, with legal or similarly significant effects.

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

The UK approach to international data transfers

Boundary and edge-case support for this artifact page.

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

Section 4

How should teams operationalize AI And Automated Decisions with proportionate controls?

Use a UK GDPR workflow that captures role, purpose, lawful basis, special-category status, DPIA trigger, rights/breach/transfer trigger, evidence, owner, and review date.

The output should be a lawful-basis note, DPIA decision, privacy notice update, DSAR record, breach assessment, transfer pack, processor clause map, or ICO response record.

Create a short intake question that identifies the AI And Automated Decisions scenario.
Map the answer to a required action, evidence field, owner, reviewer, and review date.
Link related artifact pages with descriptive anchors so users can move from scope to deadlines, controls, penalties, and templates.
Update the workflow when official source material changes or when internal evidence shows recurring exceptions.

Sources for this answer

ICO guidance on automated decision-making and profiling

ICO guidance explains when Article 22 applies to solely automated individual decision-making, including profiling, with legal or similarly significant effects.

ICO guidance on artificial intelligence

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

The UK approach to international data transfers

Operational implementation support for AI And Automated Decisions.

Recommended next step

Turn UK GDPR AI And Automated Decisions into assigned work

This UK GDPR guide turns AI And Automated Decisions into owners, evidence requests, review checkpoints, and reusable operating records for implementation execution.

Assessment workflow

Open Assessment Autopilot for UK GDPR

Turn AI And Automated Decisions into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK GDPR source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

Article 30 Record of Processing Activities

ico.org.uk

Referenced sections

Supports AI And Automated Decisions under the UK GDPR.

"This is an Article 30 Record of Processing Activities table"

ICO guidance on artificial intelligence

ico.org.uk

Referenced sections

ICO AI guidance links UK GDPR principles, accountability, transparency, and risk assessment to the design and operation of AI systems.

"how to apply the principles of the UK GDPR to the use of information in AI systems"

ICO guidance on automated decision-making and profiling

ico.org.uk

Referenced sections

ICO guidance explains when Article 22 applies to solely automated individual decision-making, including profiling, with legal or similarly significant effects.