UK Law Now Permits Solely Automated Significant Decisions: Article 22C Safeguards, Not a Ban, Set the Terms

The Ban UK Strategy Is Still Planning Around

Many UK organisations are still designing their automation plans around a prohibition that UK law no longer contains. Since 5 February 2026, the UK GDPR has not given anyone a "right not to be subject to" a decision based solely on automated processing. Section 80 of the Data (Use and Access) Act 2025 (DUAA) replaced Article 22 with four new articles, 22A to 22D¹. Regulation 2(j) of SI 2026/82 commenced it on that date².

The new UK model is permission with safeguards. A controller may take a solely automated decision with a legal or similarly significant effect on almost any lawful basis, provided four safeguards are in place. The prohibition survives in two places only: decisions that rely on recognised legitimate interests, and decisions based on special category data outside narrow conditions.

This changes the strategic question. Many processes kept a human in the loop mainly to stay outside Article 22: CV sifting, credit limit changes, fraud holds, shift allocation. In the UK they can now be designed as automated decisions on purpose. The cost then moves from a reviewer at every decision to a challenge route behind every decision. Whether you may automate is no longer the constraint. Whether you can show the safeguards work is.

The old reading is still in circulation. An employment-law firm's guide to AI recruitment, published on 11 February 2026 and modified in July, states that "Under Article 22 of UK GDPR, individuals have the right not to be subject to a decision based solely on automated processing". It does not mention the DUAA or Articles 22A–22D⁸. Most of the safeguards it recommends overlap with what Article 22C now requires. The harm is therefore less a compliance failure than two strategic errors: automation that is never attempted, and lawful-basis reasoning built on the wrong rule.

What the Instrument Says

Scope: Article 22A

Article 22A sets the two tests that decide whether the regime applies at all¹:

• a decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision";
• a decision is significant if "it produces a legal effect for the data subject" or "it has a similarly significant effect for the data subject".

Article 22A(2) adds that anyone assessing human involvement "must consider, among other things, the extent to which the decision is reached by means of profiling".

Restrictions: Article 22B

Two restrictions remain¹:

1. Recognised legitimate interests. A significant decision "may not be taken based solely on automated processing" if the processing for that decision relies, "entirely or partly", on Article 6(1)(ea). This applies to every solely automated significant decision, not only those involving sensitive data.
2. Special category data. A solely automated significant decision based wholly or partly on Article 9(1) data is barred unless one of two conditions is met:
1. the decision is based entirely on data for which the person has given explicit consent; or
2. the decision is necessary for a contract with the person, or required or authorised by law, and Article 9(2)(g) (substantial public interest) applies.

Every other lawful basis in Article 6 remains available. That includes contract, legal obligation and ordinary legitimate interests.

Safeguards: Article 22C

Where a significant decision is based solely on automated processing, the controller "must ensure that safeguards ... are in place". These "must consist of or include measures which"¹:

1. give the person information about such decisions;
2. let them make representations;
3. let them obtain human intervention by the controller;
4. let them contest the decision.

Powers: Article 22D

The Secretary of State may make regulations that deem meaningful human involvement to be present or absent in described cases, deem types of decision to have, or not have, a similarly significant effect, and add to or tighten the Article 22C safeguards. Regulations may not amend Article 22C itself, and they need the affirmative procedure¹. As of July 2026, commentators reported that "No such regulations have yet been made"⁶.

Who Is Bound, From When

What Compliance Concretely Requires

Three layers of authority are mixed together in this area, and they need keeping apart. The instrument binds. The ICO's guidance is a regulator's reading. It is also still a draft: it was updated on 31 March 2026 for consultation, the consultation closed on 29 May 2026, and the pages still say the ICO is consulting³⁴. Practitioner interpretation is neither.

Step one: decide which regime a decision is in

The instrument gives only the words "meaningful human involvement". The ICO's draft guidance says a human "should" review the decision at an appropriate point, be able to influence the outcome, have "discretion and authority to alter the decision", be trained to understand the system's limits, and consider the relevant data. It says reviewers should do this "every time", that ad hoc spot-checking "isn't sufficient", and that involvement must come before the decision is applied. Controllers "should keep a record of how the human was involved"³.

This is where most current exposure sits. The ICO's recruitment report, published alongside the draft guidance, drew on voluntary engagement with more than 30 employers. Employers called their tools decision-support, but the ICO's evidence suggested "there was often no meaningful human involvement and the tools were producing decisions with legal or similarly significant effects"⁵. One commentator describes reviewers who "rubber-stamped outputs without access to the underlying reasoning"⁶.

A nominal human review does not take a decision outside the regime. It makes it a solely automated decision without the safeguards the law requires.

Step two: document a lawful basis that is still available

The basis must not be recognised legitimate interests, and special category decisions must meet Article 22B's conditions¹. The draft guidance gives a worked example of high-volume recruitment. It rejects contract as a basis because the employer does not yet know whom it will employ, treats consent as "challenging due to the clear imbalance of power", and works through ordinary legitimate interests with a legitimate interests assessment that then feeds a DPIA³. That is the ICO's illustration, not a ruling, and it has not been tested.

Step three: run the Article 22C safeguards as an operating capability

The statute requires the four measures. The draft guidance describes how the ICO expects them to work³:

• safeguards applied "consistently rather than on an ad hoc discretionary basis";
• a concise explanation of the rationale for the decision about the specific person;
• a response to a request for intervention or challenge "without undue delay and at the latest within one month", which can be extended by two months for complex cases;
• human reviewers who are qualified and have authority to change the outcome, and a record of each review;
• a system that can produce an audit trail of the key decision points, plus monitoring of how often reviews overturn decisions;
• a DPIA, which the ICO says "must" be done for systematic and extensive profiling-based decisions and "should" be done for any automated decision-making.

The four measures are the obligation. The design detail is the regulator's draft expectation.

What Enforcement Has Done

Nothing visible yet. The research behind this brief found no ICO fine, reprimand or enforcement notice under Articles 22A–22D up to August 2026. That search was limited because the ICO's enforcement listing could not be fully checked. A practitioner review of ICO enforcement after the DUAA, updated in August 2026, reports security fines and appeals but no action on automated decision-making⁷. The recruitment report came from voluntary engagement, not enforcement⁵.

So none of the following has been tested: the meaning of "meaningful human involvement", whether ordinary legitimate interests can support recruitment decisions, and what counts as consistent safeguards at volume. Any confidence about where the ICO will draw these lines is a forecast.

Where the Permission Does Not Reach

• EU data subjects. The UK change is one of the clearest divergences from the EU, which keeps the Article 22 prohibition model⁶. A process that is lawful in the UK may not be lawful where the EU GDPR applies to the same decision.
• Earlier decisions. Decisions taken before 5 February 2026 that the old Article 22(3) or DPA 2018 sections 14 or 50(2) covered stay under the old rules².
• Decisions with meaningful human involvement. These fall outside Articles 22B and 22C, but only if the involvement meets the bar. The rest of the UK GDPR still applies to them.
• Other law. The DUAA changes data protection rules only. Discrimination risk from automated scoring, which guidance on AI recruitment stresses, is untouched⁸.

What Remains Unsettled

The central term has no statutory definition. No Article 22D regulations exist. The ICO's guidance is a draft, and final guidance, which commentators expected in summer 2026, had not appeared by the time this brief's evidence was reviewed⁶. The Article 22D powers can also move the boundary in either direction: regulations could deem human involvement to be meaningful in described cases, which would take those decisions out of the safeguard regime. One commentator reports the ICO describing the change as a move "from a prohibition with exceptions to a right of challenge with safeguards"⁵. That phrase was not found on the ICO's own guidance pages and should be read as that firm's account.

The Judgement

Stop treating "keep a human in the loop" as the legal answer. In the UK it is now one of two legitimate designs, and it is the more expensive one to do properly.

For each significant decision, choose deliberately:

1. Meaningful human involvement. Reviewers are trained, have authority to override, act before the decision is applied, look at every case, and leave a record. Then the decision sits outside Articles 22B and 22C.
2. Full automation, run as a service. Use a documented lawful basis other than recognised legitimate interests, and build the four Article 22C safeguards with explanation, a one-month response capability, qualified reviewers and outcome monitoring.

The position to get out of is the common one: a nominal reviewer, no record, and no challenge route. Under the ICO's reading, that is a solely automated decision without safeguards.

A usable test for any process: for one specific decision made last month, can you produce either the record of meaningful human involvement or the Article 22C safeguard trail? If you can produce neither, the design is not finished. Where the same process decides about people covered by the EU GDPR, keep the EU prohibition model for that population.

This brief sets out what the instrument requires. It is not legal advice on any particular system.