When did the new UK automated decision-making rules come into force?

On 5 February 2026. Section 80 of the Data (Use and Access) Act 2025, which inserts Articles 22A to 22D into the UK GDPR, was commenced by SI 2026/82.

What counts as meaningful human involvement in an automated decision?

In its draft guidance the ICO says a human should review the decision at an appropriate point, be able to influence the outcome, have discretion and authority to alter it, be trained to understand the system's logic, outputs, limitations and risks, and take into account the relevant data. Involvement must be active rather than a token gesture, apply to every decision rather than spot checks, and be recorded.

Is your human review meaningful? Automated decisions after the Data (Use and Access) Act

Since 5 February 2026, whether a person is really involved in an AI-shaped decision decides which UK GDPR rules apply. Here is what the ICO says, and what to keep on file.

By John AkinmadePublished 8 October 2026Sources checked 8 October 2026

A lot of AI in UK organisations is described as "decision support". The system scores, ranks or recommends, and a person makes the call. Since 5 February 2026, whether that description holds up has a sharper legal edge.

What changed

Section 80 of the Data (Use and Access) Act 2025 replaced the old Article 22 of the UK GDPR with new Articles 22A to 22D. The commencement regulations brought it into force on 5 February 2026.

The new rules turn on two ideas:

A significant decision is one that produces a legal effect for the person, or a similarly significant effect.
A decision is based solely on automated processing if there is no meaningful human involvement in taking it. When judging this, you have to consider how far the decision is reached by profiling.

If a significant decision is taken solely by automated means, Article 22C requires safeguards. In plain terms, the person must be given information about the decision and be able to make representations, obtain human intervention and contest it. Where special category data is involved, Article 22B adds tighter restrictions.

So the question "is there meaningful human involvement?" now decides which set of obligations you are under.

What the ICO says "meaningful" means

The ICO consulted on draft guidance on automated decision-making from 31 March to 29 May 2026. Its plans page says the final version is due in winter 2026, so treat the detail below as the regulator's current published view rather than settled guidance.

The draft says that for there to be meaningful human involvement, a human should:

assess and review the decision at an appropriate point, so they have an actual impact on the outcome
have the ability to influence the outcome
have discretion and authority to alter the decision
be suitably trained and qualified to understand the system's logic, outputs, limitations and risks
take into account the relevant data and factors on which the decision was based

Three further points in the draft are worth reading twice:

The involvement must be "active and not just a token gesture".
The criteria should be applied every time a decision is made about a person. "Using ad hoc spot-checking isn't sufficient because some automated decisions won't receive a check."
"You should keep a record of how the human was involved in the decision."

Where this tends to break in practice

Most of the failures are not about bad intentions. They come from how the workflow was set up:

The reviewer only sees the output. A score or a recommendation with none of the inputs behind it gives nothing to review.
Volume makes review impossible. If one person is expected to approve hundreds of cases an hour, the review is a token gesture whatever the process document says.
Nobody can overrule. The reviewer can flag a concern but has no authority to change the outcome, or overruling needs a sign-off that never comes.
Sampling instead of reviewing. A quality team checks 5% of decisions afterwards. Useful for quality, but on the draft guidance it is not meaningful involvement in the other 95%.
No record. The reviewer may well be doing it properly, but nothing shows it. When a complaint comes in, there is no way to prove a human was involved.

What to have on file

For each AI workflow that touches decisions about people, it is worth being able to show:

Which decisions the workflow makes or shapes, and whether any are significant decisions.
Where a person reviews each decision, and what information they see when they do.
That the reviewer can change the outcome, and how often they actually do.
How reviewers are trained on what the system can and cannot do.
A per-decision record of the human involvement.
If any significant decisions are solely automated, how people are told and how they can make representations, get human intervention and contest the decision.

A useful signal: if your reviewers almost never change the system's recommendation, that is worth looking at. It may mean the system is very good. It may also mean the review is not doing what the process says it does.

How CLEARANCE fits

CLEARANCE looks at a live AI workflow against a fixed library of governance gaps, each mapped to a named obligation. Human oversight and accountability are among the core controls it checks. The same answers always produce the same findings, so the result can be shown to a board, an insurer or a regulator and traced back to the answers behind it.

Sources

This article explains the rules in general terms. It is not legal advice. Where guidance is marked as draft, check the regulator's site for the final version.

Check one live workflow.

Six free questions on the core controls, including human oversight. Continue to the full report only if it is worth it to you.

Start free check See pricing