Automated decisions with AI under UK data law: where a person must still decide

Automated decisions with AI under UK data law are allowed for ordinary personal data, even when they significantly affect a person. The condition is that you give that person the Article 22C safeguards: information, a chance to make representations, human intervention and a right to contest. Special category data still falls under a stricter rule.

The rules sit in Articles 22A to 22D of the UK GDPR. Section 80 of the Data (Use and Access) Act 2025 inserted them, and they apply from 5 February 2026. A Claude agent may therefore approve, refuse or score something about a person without a human in the loop. It may only do so inside that framework.

For most small and mid-sized companies we recommend a simpler design. Routine work stays fully automated, such as routing a support ticket in Zoho Desk. Decisions that change someone's legal position or prospects keep a person who genuinely decides. That person works from a log of what the AI proposed, and the affected individual has a route to challenge the outcome. This guide explains where the line falls and how to build each part.

The UK rules on automated decisions apply only when a decision passes two tests. Under Article 22A(1), a significant decision is one that produces a legal effect for the person or has a similarly significant effect. A decision is based solely on automated processing when there is no meaningful human involvement in taking it.

A solely automated significant decision is a decision that meets both tests. Articles 22B and 22C are written for that combination. Before the reform, commentators gave credit scoring and employment as typical examples of decisions with legal or similarly significant effects.

What counts as meaningful human involvement

The ICO describes meaningful human involvement as active and genuine involvement. The human must be able to influence the decision before it takes effect and must have the authority to change the outcome. The extent of profiling used is one factor in judging whether that involvement was real.

Definitions may still be refined

Article 22D allows the Secretary of State to make regulations defining "meaningful human involvement" and "similarly significant effect", and to add safeguards. Any such regulations need Parliament's approval under the affirmative resolution procedure. Design your system so that a stricter definition would not force a rebuild.

The old Article 22 of the UK GDPR gave people a general right not to be subject to solely automated decisions with legal or similarly significant effects. A company could take such a decision only under an exception: necessity for a contract, authorisation by domestic law, or explicit consent. That right applied until 5 February 2026.

The Data (Use and Access) Bill received Royal Assent on 19 June 2025. Section 80 of the Act replaced Article 22 with Articles 22A to 22D from 5 February 2026, under SI 2026/82. When we read legislation.gov.uk for this guide, it reported no known outstanding effects for the Act.

The new framework turns the old approach around. The general prohibition on solely automated significant decisions now applies only where special category data is involved or where the processing relies on recognised legitimate interests. For other personal data, such decisions are permitted if the Article 22C safeguards are in place. Those safeguards build on the ones previously found in Article 22(3) and add a duty to give people information about the decisions.

At the time of writing, the EU GDPR had not followed. It keeps the Article 22 prohibition, which matters if your system also makes decisions about people covered by EU law. For the wider set of articles an AI project touches, see our annotated guide to UK GDPR for AI.

A significant solely automated decision cannot rest on the new "recognised legitimate interests" basis. Article 22B(4) bars such a decision where the processing relies entirely or partly on Article 6(1)(ea). Ordinary legitimate interests remain available for non-special category data, provided suitable safeguards are in place.

Recognised legitimate interests is a lawful basis added on 5 February 2026. It removes the balancing test but applies only where the processing meets one of the five conditions in Annex 1. Its addition takes the lawful bases in Article 6(1) to seven. Because it skips the balancing test, it is easy to reach for and wrong to use here.

Recruitment shows how much the change matters. Before the reform, employers could take solely automated recruitment decisions only under an exception. The decision had to be necessary for a contract, authorised by law or based on explicit consent. Now, with no special category data involved, they need an ordinary lawful basis such as legitimate interests, plus the Article 22C safeguards.

The practical step is simple. For each decision a Claude agent will take or propose, write down the lawful basis before anyone builds anything. If the answer is "recognised legitimate interests", the decision needs a person to take it.

Special category data is the personal data listed in Article 9(1) of the UK GDPR. A solely automated significant decision based on it is still prohibited unless a narrow condition applies. The decision must be based entirely on data the person gave explicit consent for. Alternatively, it must be necessary for a contract or required or authorised by law, and a substantial public interest condition under Article 9(2)(g) must apply.

Explicit consent means an express statement of consent by the person concerned. A ticked box buried in terms of business is unlikely to meet that standard. Most companies will not have these conditions in place for routine operations.

That leaves two design choices for a Claude agent. The first is to keep a person deciding wherever special category data could appear in the inputs. The second is to stop that data reaching the model at all. Article 5(1)(c) already requires personal data to be limited to what is necessary for the purpose. Removing fields the decision does not need is good practice in any case.

Check free-text fields as well as structured ones. A note typed by a colleague can carry special category data that no form field was designed to hold.

Article 22C safeguards are mandatory for every significant solely automated decision, whether it uses special category data or regular personal data. The controller must let people do four things. Each one maps to a part of the system you can build:

• Receive information about the decision. Send a notice when the decision is made, in plain language. Article 12(1) asks for concise, transparent, intelligible and easily accessible information.
• Make representations. Give the person a reply route that lands in a named queue, not a general inbox.
• Obtain human intervention. Route that reply to someone with the authority to change the outcome.
• Contest the decision. Record the challenge, the review and the final outcome against the original decision.

Logging connects all four safeguards. For each decision, store what the agent saw, what it proposed, the reasons it gave and who acted on it. Without that record, nobody can explain the logic involved. Article 15 gives people a right to information about that logic.

Explanations are harder with language models than with fixed rules. Ask Claude to output its reasons alongside its recommendation, and store both. A reviewer can then test the reasons against the evidence instead of trusting a score.

Human review counts only when the reviewer actively oversees the decision rather than merely rubber-stamping it. A person who clicks "approve" on every AI recommendation adds no meaningful human involvement. The decision is then still solely automated in law.

Automation bias is the tendency of people working with an automated system to rely too heavily on its recommendations and to hesitate before challenging them. UK government guidance warns that over-reliance on an AI recommendation may make the resulting decision open to legal challenge. A review step designed only to satisfy the rule invites exactly that over-reliance.

At Svennis we build the review step so that the agent cannot complete it. Claude writes a recommendation and its reasons to the record, but only the reviewer's own action sets the final outcome. Reviewers see the underlying evidence next to the recommendation, not the recommendation alone.

Accountability also stays with you. Controller accountability under Article 5(2) does not transfer to the vendor when you buy an AI-enabled product. The same holds when a partner builds the agent for you. Name the role that owns each decision type and the person who reviews it.

Ticket routing, email triage and data extraction can usually run with no person in the loop. Sending a support ticket to the right team rarely produces a legal or similarly significant effect on the person who wrote it. Anthropic positions Claude Haiku 5.5 for exactly this kind of high-volume classification, extraction and routing work.

The test is the effect on the person, not the technology. Routing a complaint to the billing team is routine. Deciding that the same complaint does not qualify for a refund may not be. Draw the line where the agent's output changes what a person receives, owes or is allowed to do.

The rest of the UK GDPR still applies to routine automation. Putting personal data into a prompt is a disclosure to the model provider. You must treat that relationship as a processor relationship or, in some architectures, an independent controller relationship. Our page on where your data sits, layer by layer explains how we handle that layer.

Keeping routine work automated is also where most of the time saving comes from. Our AI automation service describes the agents we build for that work.

A sole trader applies for a credit account with a wholesaler. Credit scoring was a standard example of a significant decision under the old rules, and the applicant's details are personal data. The wholesaler chooses to keep a person deciding rather than rely on the Article 22C route. The process in Zoho CRM runs in six steps:

1. The application arrives and creates a record. No special category fields are passed to the model.
2. A Claude agent on Claude Opus 5.5 reads the application and the trading history. It writes a recommendation and its reasons to two fields on the record.
3. The agent has no permission to change the account status. A credit controller sees the recommendation, the reasons and the source documents together.
4. The controller approves, refuses or sets a different limit. The system records who decided, when, and whether they followed the recommendation.
5. The applicant receives a plain explanation of the outcome and a named reply route.
6. Any reply goes to a second reviewer, and the challenge and outcome are logged on the same record.

Two checks keep the review honest. The wholesaler tracks how often the controller departs from the agent's recommendation. A rate that sits near zero is a warning sign of rubber-stamping. The team also samples decisions each month and compares the stored reasons with the evidence.

The table below sets common decisions against the rules in Articles 22A to 22D. "Significant" is a judgement you must make and record for your own process. Use the table as a starting point for that record, not as legal advice.

Decision	Likely significant?	What the law allows	Design we recommend
Routing a support ticket	Usually not	Full automation	Fully automated, logged
Triage of inbound email	Usually not	Full automation	Fully automated, logged
Credit account for a sole trader, ordinary data	Yes	Solely automated with Article 22C safeguards	Person decides, Claude recommends
Shortlisting job candidates, ordinary data	Yes	Solely automated with safeguards, legitimate interests possible	Person decides, Claude summarises
Any significant decision using special category data	Yes	Prohibited unless explicit consent or the Article 9(2)(g) route	Person decides, or remove the data
Significant decision relying on recognised legitimate interests	Yes	Not as a solely automated decision (Article 22B(4))	Person decides

Where the table says "person decides", the four safeguards remain good practice. A clear explanation and a route to challenge cost little once the log exists. They also prepare you for any regulations made under Article 22D.

UK companies using AI to decide about people have three duties to check now. A data protection impact assessment (DPIA) is a documented review of the risks a processing activity poses to individuals. Article 35(3)(a) requires one for a systematic and extensive evaluation of personal aspects, based on automated processing, that leads to decisions with legal or similarly significant effects. The ICO also requires a DPIA when innovative technology such as AI is combined with another high-risk factor.

The ICO also expects a DPIA for decisions on access to a product, service or opportunity that rely to any extent on automated decision-making. If a DPIA shows a high risk you cannot sufficiently reduce, you must consult the regulator before processing starts.

Detail matters in the DPIA. A DPIA that only lists risks in general terms will not show how you meet the law. Describe the decision, the data and the review step in detail. In its 2026 report on automated decision-making in recruitment, based on its work with employers, the ICO found that many were likely relying on solely automated decisions.

Since 19 June 2026 you must also facilitate data protection complaints and acknowledge each one within 30 days. Link the "contest" route of your agent to that complaints process.

The regulator itself has changed. The Information Commission replaced the Information Commissioner on 30 September 2026. Under SI 2026/425, in force since 12 May 2026, it must prepare a statutory code on AI and automated decision-making. No draft had been published at the time of the source we used. Our overview of AI law in the UK tracks these changes.

Start with an inventory, not a model choice. Most companies find that a few of their planned AI uses touch significant decisions and the rest are routine. Work through these steps in order:

1. List every decision an assistant or agent will take or propose about a person.
2. Mark each as significant or not, and record your reasoning.
3. Note whether special category data could reach the model, including in free text.
4. Record the lawful basis, and rule out recognised legitimate interests for significant decisions.
5. Choose "person decides" or "solely automated with Article 22C safeguards" for each significant decision.
6. Update or write the DPIA, update your privacy notice to say where you use solely automated decisions and how they work, and connect the challenge route to your complaints process.

Then build one process end to end before widening it. For each system the agent must reach, we build a connector, an MCP server, a plugin or a skill. We show you the options with their cost, and you choose. The Claude Pilot A agent service takes one process live with the review step, the log and the challenge route in place.