UK GDPR automated decision-making: Articles 22A to 22D

What it is

Articles 22A to 22D of the UK GDPR set the UK’s rules on automated decision-making about individuals. Section 80 of the Data (Use and Access) Act 2025 replaced the old Article 22 with these four articles. The Act received Royal Assent on 19 June 2025, and section 80 came fully into force on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026 (SI 2026/82).

The change is one of direction. The old Article 22, which the EU GDPR still contains, gave people a right not to be subject to solely automated decisions with legal or similarly significant effects, with narrow exceptions. The new UK rules permit those decisions, subject to safeguards, and keep tighter limits only where special category data is involved.

The Information Commission, still known as the ICO, enforces the rules. It replaced the Information Commissioner on 30 September 2026. The ICO consulted on draft guidance on automated decision-making and profiling between 31 March and 29 May 2026, and its published plans list the final version for winter 2026. Separately, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), in force since 12 May 2026, require the ICO to prepare a statutory code of practice on personal data in the development and use of AI and automated decision-making.

Who it applies to

The rules apply to controllers subject to UK GDPR. That covers organisations established in the UK and, under the UK GDPR’s territorial scope, organisations elsewhere that offer goods or services to people in the UK or monitor their behaviour there.

They bite on decisions that meet two tests in Article 22A.

• Based solely on automated processing. There is no meaningful human involvement in taking the decision. The extent of any profiling must be considered when judging this.
• Significant. The decision produces a legal effect for the person or a similarly significant effect.

Typical examples are automated credit decisions, recruitment screening that rejects candidates without real human review, insurance pricing and eligibility, fraud flags that block accounts, and benefit or service eligibility decisions. AI is not required. A simple rules engine can make a significant automated decision, and an AI tool that only informs a human who genuinely decides may not.

What it requires

Safeguards for every significant automated decision (Article 22C). Where a significant decision is based wholly or partly on personal data and made solely by automated processing, the controller must have safeguards that let the person do four things.

1. Receive information about decisions taken about them.
2. Make representations about the decision.
3. Obtain human intervention from the controller.
4. Contest the decision.

These have to work in practice. Someone has to own each channel, have the authority to change the outcome, and have enough information about how the decision was reached to review it properly.

Restrictions on special category data (Article 22B). A significant decision based wholly or partly on special category data, such as health, ethnicity or biometric data, cannot be made solely by automated processing unless the person has given explicit consent, or the decision is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies. A significant solely automated decision also cannot rest, even partly, on the new recognised legitimate interests basis in Article 6(1)(ea).

Further rules by regulations (Article 22D). The Secretary of State can make regulations describing when there is, or is not, meaningful human involvement, and which kinds of decision do or do not have a similarly significant effect. Regulations can add safeguards but cannot amend Article 22C.

The rest of UK GDPR still applies. Automated decisions still need a lawful basis, fair and transparent processing, accurate data and a data protection impact assessment where the processing is likely to result in a high risk. Privacy information under Articles 13 and 14 must tell people about the existence of significant automated decision-making, give meaningful information about the logic involved and its significance and envisaged consequences, and explain the Article 22C safeguards. In practice, meeting Articles 22A to 22D means knowing which systems make or shape decisions about people, judging whether human involvement is meaningful, assessing the impact on those affected, and running the four safeguards as a working process.

Key dates

• 19 June 2025. Data (Use and Access) Act 2025 receives Royal Assent.
• 5 February 2026. Articles 22A to 22D in force under SI 2026/82.
• 31 March 2026. ICO publishes draft guidance on automated decision-making and profiling for consultation.
• 12 May 2026. SI 2026/425 in force, requiring an ICO code of practice on AI and automated decision-making.
• 29 May 2026. ICO consultation closes. Final guidance is listed for winter 2026.

How it relates to other frameworks

The UK rules now differ from the EU GDPR’s Article 22, which still frames solely automated significant decisions as a prohibition with exceptions. An organisation making automated decisions about people in both the UK and the EU has to design for the stricter EU rule where it applies, while using the UK safeguards as the baseline for UK processing.

The safeguards are the legal form of the contestability and redress principle in the UK’s pro-innovation approach to AI regulation. The ICO’s guidance on AI and data protection and on explaining decisions made with AI sets out how to give people meaningful information about an AI-assisted decision, which supports the first safeguard.

Where an automated decision system is also high-risk under the EU AI Act, such as AI used for creditworthiness or recruitment, the Act’s own obligations for deployers, including human oversight and, for some deployers, a fundamental rights impact assessment, apply alongside data protection law. ISO/IEC 42001’s impact assessment controls and the NIST AI RMF’s Map function are useful structures for the underlying assessment work.

Working with it in Aicura

UK framework content is available in Aicura on the Enterprise tier, enabled by an administrator in Settings under Frameworks.

The work starts with the AI Register. Discovery surfaces AI in use across the organisation, and each register entry records what the system does, who owns it and how it is used, which is what you need to judge whether it makes significant decisions about people. Impact assessments look at who is affected and how, with the rights affected and their mitigations set out for each system. Risk assessments add risk items with suggested controls, tracked in Risks and Controls. Governance policy reviews scan documents such as an AI transparency statement against the frameworks mapped to that review, and the Policy review report shows where each one stands.

Aicura provides guidance for your own judgement. It does not decide whether a decision is significant or whether your safeguards meet the law.