UK GDPR and AI: when you can let software decide

For eight years, UK law started from the position that a machine should not make an important decision about a person on its own. On 5 February 2026 that position was reversed. Article 22 of the UK GDPR was deleted and replaced, and the new rule permits fully automated decisions about credit, hiring, insurance and access to services, provided four specific safeguards are in place.

The regulator has not published guidance on the new rule. The ICO’s guidance on AI and data protection still carries the date 15 March 2023 and a notice saying it is under review because of the Act that changed the law. So the most authoritative published explanation of UK AI rules describes a regime that stopped applying six months ago.

If you use AI to make or support decisions about people, you are operating in that gap. This page is what the law now says, checked against the statute itself.

The hard rules

Five things that will catch people out. Everything after this expands on them.

1. This is not legal advice. It is a summary of published law with every claim linked, so you can check it. If a decision could seriously affect someone, take advice.
2. “Solely automated” now means “no meaningful human involvement”. A person who rubber-stamps output is not involvement. Someone who reads the case, can reach a different answer, and sometimes does, is.
3. Special category data is the hard line. Health, ethnicity, religion, sex life, sexual orientation, political opinions, trade union membership, genetic and biometric data. A significant decision resting even partly on that data still cannot be fully automated, outside narrow exceptions.
4. Four safeguards are mandatory, not best practice. Inform the person, let them make representations, give them a human to appeal to, let them contest the outcome. All four.
5. Pasting customer data into a chatbot is a different question entirely, and Article 22 has nothing to say about it. The answer is in your vendor contract.

What exactly changed on 5 February 2026?

Section 80 of the Data (Use and Access) Act 2025 removed Article 22 of the UK GDPR and substituted four new articles, 22A to 22D. It came into force on 5 February 2026 under the Commencement No. 6 Regulations.

The old Article 22 gave people a right not to be subject to a solely automated decision with legal or similarly significant effects, subject to three exceptions. In practice it read as a prohibition with carve-outs.

The new Articles read the other way round. Automation is allowed; safeguards are the condition. The restriction that survives applies to special category data.

In one line: the question moved from “am I allowed to automate this?” to “have I built the safeguards that let me?”

What counts as a “solely automated” decision now?

Article 22A(1)(a) defines it: a decision is based solely on automated processing “if there is no meaningful human involvement in the taking of the decision”. Article 22A(2) adds that when assessing this you must consider “the extent to which the decision is reached by means of profiling”.

This is a higher bar than the arrangement it replaced. Under the old regime a nominal human reviewer was widely treated as taking a system outside Article 22. The new wording asks whether the involvement is meaningful, which is a question about influence rather than presence.

Three tests worth applying to any reviewer in your process:

• Can they reach a different answer? If the workflow only offers accept, it is not review.
• Do they see the underlying case, or only the output? Someone shown a score and a recommendation is reviewing the model, not the person.
• Do they ever actually differ? If the override rate across thousands of decisions is zero, that is evidence, and it is the kind of evidence a regulator can ask for.

Answer: if a person cannot change the outcome, cannot see what it was based on, or never does change it, treat the decision as solely automated.

What counts as a “significant” decision?

Article 22A(1)(b): one that “produces a legal effect” for the person, or “has a similarly significant effect”.

Legal effect is the narrower half: something that changes rights or obligations. Similarly significant is the half that catches most businesses. Declining credit, rejecting a job application, setting an insurance premium, withdrawing access to a service someone relies on, or changing the price a particular person is offered.

Recommending a product is not significant. Ranking search results is not significant. Deciding that a specific person cannot have something is.

Answer: if the person would reasonably want to argue with the outcome, it is probably significant.

Do the rules apply to what I am doing?

Three questions, in order. Most businesses stop at the first or second.

If you use AI to draft, summarise or search

None of this applies. No decision about a person is being taken, so Articles 22A to 22C are not engaged. Your obligations are the ordinary ones: lawful basis, transparency, security, and the vendor question below.

Answer: carry on, and check your contract.

If you use AI to rank, score or shortlist people

This is where most UK businesses will meet the new rules without realising. Automated CV screening that rejects candidates makes significant decisions. If nobody reviews the rejections in a way that could change them, those decisions are solely automated and the Article 22C safeguards are mandatory.

A recruiter who only ever sees the shortlist is not meaningful involvement in the rejections. They never saw them.

Answer: if your system removes people before a human sees them, you are in scope for every person it removed.

If your decision touches health, ethnicity or biometrics

Article 22B applies. A significant decision based “entirely or partly” on special category data cannot be taken solely automatically unless either:

• the person has given explicit consent (Article 22B(2)), or
• it is necessary for a contract, or required or authorised by law, and the substantial public interest condition in Article 9(2)(g) applies (Article 22B(3)).

Article 22B(4) adds a further restriction where the processing relies on Article 6(1)(ea).

“Partly” carries real weight. A model using health data as one input among forty is still caught.

Answer: if special category data touches the decision at all, assume prohibited until someone qualified tells you which condition you meet.

What are the four safeguards, exactly?

Article 22C requires safeguards for the person’s rights, freedoms and legitimate interests, consisting of or including measures that:

1. provide information about the decisions taken in relation to them
2. enable them to make representations about those decisions
3. enable them to obtain human intervention on the controller’s part
4. enable them to contest the decisions

In practice the first is usually present and the fourth is usually missing. A support address that nobody monitors is not a route to contest. A named step with a response time is.

Answer: build all four, and make the fourth a real process with an owner.

Can I paste customer data into ChatGPT?

The question everyone actually arrives with, and Article 22 is the wrong place to look. Pasting text into a chatbot takes no automated decision about anyone, so nothing above is engaged.

Four things decide it instead:

Your contract with the vendor. Whether the provider may train on your inputs is set by the plan you are on, and consumer and business tiers differ. Check the terms for your actual plan rather than the marketing page.

Lawful basis and transparency. Sending customer data to a new processor is a processing operation like any other. Your privacy notice should reflect where the data actually goes.

International transfers. Processing outside the UK still needs a transfer mechanism.

Whether a DPIA is required. Large-scale processing, special category data, or systematic evaluation of individuals all point towards yes.

Answer: for most small businesses, yes on a business tier, with a DPIA if the data is sensitive, and after updating your privacy notice. What you should not do is paste customer records into a personal account on a free plan.

What is still unsettled?

The most important section on this page, and the one an article written from the ICO’s 2023 guidance alone would miss entirely.

There is no regulatory guidance on the new articles. The ICO’s AI guidance predates them and says so. Until it is updated there is no authoritative interpretation of Articles 22A to 22D, and anyone telling you precisely where meaningful human involvement begins is offering an opinion.

“Meaningful human involvement” has no published threshold. Article 22D allows the Secretary of State to make regulations specifying when involvement is or is not meaningful. Until those exist, the phrase carries enormous weight with no official gloss.

Transitional provisions exist and matter. The commencement instrument is titled “Commencement No. 6 and Transitional and Saving Provisions”. If you are assessing a system that was already running before February 2026, read those provisions rather than assuming the new rules simply replaced the old overnight.

Answer: where the law has moved and guidance has not, document your reasoning. A defensible decision record is worth more than a confident interpretation.

What should I do now?

If you make or support decisions about people, in this order:

1. List what your software decides without a human. Most organisations cannot answer this quickly, and the exercise itself usually finds something.
2. Run each through the three questions. Significant? Meaningful human involvement? Special category data?
3. Where you land on “permitted with safeguards”, build all four. Start with the route to contest, because it is the one that is usually missing.
4. Where special category data is involved, stop and take advice.
5. Write down your reasoning now, while the guidance gap is live. If the ICO’s updated position differs later, a dated record of why you decided what you decided is the difference between a correction and a finding.
6. Re-check when the ICO publishes. That is the event that will change this page.

If you only use AI to write and summarise, none of this applies to you. Check your vendor contract and get on with your day.