We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKAI and Automated Decisions

UK GDPR AI and Automated Decisions

Since 5 February 2026, Articles 22A to 22D govern significant decisions made without .

The rules apply to the decision, not to every use of AI. Start with the legal or similarly significant effect and the reality of human involvement.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
4 sections7 primary sources
Overview

A model score, recommendation, or profile is not automatically an Article 22A decision. Map the final outcome, who makes it, and its effect on the person. A has no , and a produces a legal or similarly significant effect. Significant solely automated decisions require Article 22C safeguards, while Article 22B adds restrictions for and .

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

When do Articles 22A to 22D apply?

Identify the decision made about a person, such as refusing credit, rejecting an application, changing access to an essential service, or imposing another outcome with a legal or comparably serious effect. A low-impact recommendation or internal score may fall outside Article 22A if it does not determine or materially shape such an outcome, but the rest of UK GDPR still applies.

Human involvement must affect the decision in practice. A person who automatically accepts a score, lacks authority to change the outcome, or sees too little information to assess it may not provide meaningful involvement. Article 22A requires consideration of the extent to which profiling produced the decision.

  • Record the decision, affected person, effect, data inputs, model output, and final decision-maker.
  • Document the that prevents the final outcome from being solely automated.
  • Test whether a human can understand the relevant factors, question the output, and accept, reject, or change the result.
  • Separate automated support from the final decision and test whether the human review works under real workload and time constraints.
  • Reassess when a model, threshold, user journey, data source, or reviewer authority changes.
Question 2

Which automated decisions are restricted?

Article 22B restricts a significant based entirely or partly on special-category processing. It is allowed only where the person explicitly consented to all personal-data processing on which the decision is based, or where the decision is necessary for a contract or required or authorised by law and Article 9(2)(g) substantial public interest applies.

A significant also cannot rely entirely or partly on Article 6(1)(ea), the basis. Other significant solely automated decisions are no longer limited to the former contract, law, or explicit-consent routes, but they still need an Article 6 basis and must satisfy fairness, transparency, minimisation, accuracy, security, and other applicable UK GDPR duties.

  • Identify every Article 6 basis and, for , the Article 9 condition and any DPA 2018 Schedule 1 requirement.
  • Do not use for processing used to make a significant .
  • Complete a DPIA before likely high-risk processing and address discrimination, accuracy, explainability, security, and vulnerable-person risks.
  • Do not treat Article 22C safeguards as permission for processing that lacks a lawful basis or fails another UK GDPR requirement.
Question 3

What safeguards and evidence are required?

For every significant based on personal data, Article 22C requires measures that provide the person with information about the decision and enable them to make representations, obtain human intervention from the controller, and contest the decision. Build these routes into the service rather than relying on a general contact address that cannot pause or change the outcome.

Keep a decision inventory, significance and human-involvement analysis, lawful-basis record, DPIA, data and model documentation, accuracy and bias tests, monitoring results, notices, representation and contest workflows, reviewer instructions, response records, and change history.

  • Tell the person that the was automated and give information they can use to understand and challenge it.
  • Route representations to a reviewer with authority, relevant information, time, and freedom to change the outcome.
  • Record the review, evidence considered, conclusion, communication, and any correction or model-control change.
  • Monitor outcomes and complaints for drift, systematic error, and unequal effects.
Recommended next step

Map the decision before assessing the model

Record the effect, human authority, legal bases, safeguards, DPIA, testing, monitoring, and contest route for each automated decision.

Assessment workflow
Open Assessment Autopilot for UK GDPR

Turn Articles 22A to 22C into decision, evidence, and safeguard checks.

Explore next step
Research workflow
Review UK GDPR source evidence

Use Research Copilot to check an automated-decision question against the current law and ICO material.

Explore next step
Talk to Sorena
Talk through implementation

Review your decision flow, human role, safeguards, and next actions with Sorena.

Explore next step
Question 4

Questions and answers

Does any human click make the decision non-automated?

No. The human involvement must be meaningful. Assess whether the reviewer understands the relevant information, can question the automated output, and has real authority to change the decision. A rubber-stamp step or review that cannot affect the outcome may still leave the decision solely automated.

Do Articles 22A to 22D apply to every AI system?

No. They apply when personal data is used for a and no exists. AI systems outside that test remain subject to the rest of UK GDPR when they process personal data, including lawful basis, fairness, transparency, accuracy, security, rights, accountability, and DPIA duties.

Primary sources

References and citations

Related guides

How do you choose a lawful basis under the UK GDPR?

Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.

UK Children's Code: Scope and 15 Standards

Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.

UK GDPR 72-Hour Breach Reporting: Decision Guide

Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.

UK GDPR Adequacy: When Can You Rely on It?

Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.

UK GDPR Article 30 Records: What to Document

See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.

UK GDPR Controller or Processor: How to Decide

Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.

Show all related guides (40)

UK GDPR DPIA: When It Is Required and What to Record

Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.

UK GDPR DPO: When Appointment Is Mandatory

Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.

UK IDTA, Addendum, and Transfer Risk Assessment Guide

Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.

When do PECR cookie rules require consent?

Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.

UK GDPR 72-hour Breach Reporting Guide

Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.

UK GDPR Adequacy Guide

Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.

UK GDPR AI and Automated Decisions Guide

Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.

UK GDPR Applicability Test Guide

Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.

UK GDPR Article 30 Records Guide

Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.

UK GDPR Breach Notification Guide

Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.

UK GDPR Breach Workflow Guide

Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.

UK GDPR Children and Age Appropriate Design Guide

Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.

UK GDPR Children's Code Guide

A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.

UK GDPR Compliance Checklist

A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.

UK GDPR Compliance FAQ: Duties, Rights, and Decisions

Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.

UK GDPR Compliance Guide

Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.

UK GDPR Controller and Processor Status Guide

Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.

UK GDPR Data Subject Rights Guide

Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.

UK GDPR Deadlines and Compliance Calendar Guide

Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.

UK GDPR DPIA Workflow Guide

Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.

UK GDPR DPIAs and DPOs Guide

Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.

UK GDPR DSAR Workflow Guide

Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.

UK GDPR IDTA Addendum and Transfer Risk Assessment Guide

Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.

UK GDPR Lawful Bases Guide

Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.

UK GDPR PECR Cookies Guide

UK GDPR and PECR cookie guidance with practical consent, exemption, evidence, and cited implementation decisions.

UK GDPR Penalties and Fines: Maximums and ICO Factors

Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.

UK GDPR Requirements Guide

Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.

UK GDPR Transfer Workflow Guide

Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.

UK GDPR Transfers, IDTA, and UK Addendum Guide

Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.

UK GDPR vs Data Protection Act 2018: How They Work Together

See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.

UK GDPR vs EU GDPR: Scope, Regulators and Transfers

Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.

UK IDTA vs EU SCCs: Which Transfer Contract to Use

Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.

UK vs EU GDPR Differences After the 2025 UK Reforms

Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.

UK vs EU GDPR Operations: Regulators, Breaches and Transfers

Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.