AI Automated Decisions After the Data (Use and Access) Act: What UK SMEs Must Do Before Automating

Most AI automation projects in UK SMEs start with admin: sorting email, drafting replies, pulling data out of documents. Sooner or later, though, the automation starts making decisions about people. It sifts CVs, sets payment terms for a new account, flags a customer for fraud or decides who qualifies for a quote. At that point you are no longer just automating a process. You are doing automated decision-making, and the UK rules on it changed this year.

On 5 February 2026 the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with a new set of provisions, Articles 22A to 22D. The headline sounds like deregulation: solely automated decisions with significant effects are no longer prohibited by default. The detail is more demanding. The change swaps a ban for a set of safeguards you have to build in and prove you run. The ICO has also made clear, in draft guidance and a recruitment report, that it expects to see those safeguards working in practice.

This guide explains what changed, how to tell whether your AI tool is making the kind of decision the rules cover, and what to build in before you switch it on. It is practical guidance rather than legal advice. If a decision carries real legal risk, get your data protection adviser involved early.

What changed on 5 February 2026

Under the old Article 22, people had a right not to be subject to a decision based solely on automated processing that produced legal or similarly significant effects. The only exceptions were contract necessity, legal authorisation or explicit consent. In practice many SMEs read that as “keep a human in the loop or don’t do it”.

The new regime flips the default:

• Permission with safeguards. Significant, solely automated decisions can now rest on any lawful basis, including legitimate interests, provided you implement the safeguards in Article 22C.
• Special category data stays locked down. Automated decisions based wholly or partly on special category data (health, ethnicity, religion, trade union membership and so on) remain restricted. They need explicit consent, or necessity for a contract or under law together with a substantial public interest condition.
• No shortcut through “recognised legitimate interests”. The Act created a new lawful basis, recognised legitimate interests, which needs no balancing test. The ICO’s draft guidance is explicit that it cannot be used for automated decision-making.

The same commencement brought other changes worth knowing about. Maximum fines under PECR, the UK’s electronic marketing and cookie rules, rose to £17.5 million or 4% of global turnover. And from 19 June 2026, organisations must run a data protection complaints process: acknowledge complaints within 30 days and deal with them without undue delay. A challenge to an automated decision is exactly the kind of complaint that will arrive through that channel.

The two tests that decide whether the rules apply

Whether your automation falls inside the regime comes down to two questions.

1. Is the decision solely automated?

A decision is solely automated when there is no meaningful human involvement. The ICO’s draft guidance, consulted on between 31 March and 29 May 2026, sets a high bar for what counts as meaningful:

• The human reviews the decision before it is applied, while it can still be changed.
• They have the authority and ability to change the outcome, not just to approve it.
• They are trained on how the system works, what its outputs mean and where it goes wrong.
• They weigh the relevant information themselves rather than simply accepting the AI’s recommendation.
• It happens for every decision. Ad hoc spot checks are not enough.

Two points trip people up. First, the humans who designed the system do not count: design happens before any real-world decision is made. Second, rubber-stamping does not count either. If a manager clicks “approve” on 200 AI rejections in ten minutes, the ICO is likely to treat those decisions as solely automated.

2. Is it a significant decision?

The rules cover decisions with a legal or similarly significant effect on a person. The obvious examples are recruitment, credit, access to services and employment decisions. The ICO’s draft takes a broad view and adds newer examples such as algorithmic recommendations and dynamic pricing where they meaningfully affect someone’s choices. Systems that merely apply fixed rules a human set, such as accepting or declining a card by type, fall outside the scope.

Where UK SMEs actually hit this

Most AI automation in a small business never gets near these rules. An AI that triages your inbox and routes messages to the right team is not deciding anything significant about the sender. The places to look are narrower:

• Recruitment. CV sifting, screening questions and auto-rejection emails. The ICO published a report on AI in recruitment in March 2026. It found that employers often underestimate when a tool is making the decision rather than supporting one, and that there was often no meaningful human involvement despite what the employer believed.
• Credit and account terms. Automatically approving or declining trade accounts, credit limits or payment terms.
• Eligibility and pricing. Deciding who gets a quote, a discount or a service, especially when the price is personalised.
• Fraud and risk flags. Automatically suspending an account or blocking an order.
• Staff decisions. Automated rota allocation, performance scoring or disciplinary triggers.

The tool does not matter. The rules apply whether the decision is made by a Copilot Studio agent, a Power Automate flow with an AI step or a bespoke tool on the Claude API. What matters is what the automation does to a person and whether a human genuinely takes part. If you are choosing an engine for one of these processes, our automation engine comparison covers the cost side; this guide covers the compliance side.

The four safeguards you must build in

If your automation does make solely automated significant decisions, Article 22C requires four safeguards. They need to be part of the workflow, not a paragraph buried in your privacy notice:

1. Information. Tell people that a decision about them is automated, in plain language, when you collect their data, when they ask, and when the decision is made. The ICO warns against explanations so technical they confuse the reader.
2. Representations. Give people a real way to put their side: a named inbox or form, not a no-reply address.
3. Human intervention. Let them get a genuine human review from someone with the authority and discretion to change the outcome.
4. Contest. Let them challenge the decision, with a process that can actually overturn it.

Behind all four sits record-keeping. The ICO expects clear records of how and when human involvement took place for each decision. For an AI tool, that means logging the input, the model’s output, who reviewed it, what they decided and when. It is much easier to design that in than to bolt it on after the first complaint.

Worked illustration: one recruitment workflow, two designs

Take an illustrative (not client-specific) recruitment agency receiving around 400 applications for a role and using an AI model to score CVs against the job criteria.

Neither design is wrong. Design A costs recruiter time on every application; Design B costs a documented safeguard process and more legal care. The mistake is building Design B while believing you built Design A.

A practical checklist before you automate decisions

1. Inventory the decisions. List every AI or automated process that produces an outcome about a person. Our AI readiness checklist is a good place to start the inventory.
2. Apply the two tests. For each one, is it significant, and is there meaningful human involvement on every decision?
3. Check the inputs for special category data, including data the model could infer, not just fields you collect deliberately.
4. Run a DPIA for anything significant, and record your lawful basis. Remember that recognised legitimate interests is off the table.
5. Build the four safeguards into the workflow and route challenges into your complaints process.
6. Log human involvement for each decision if you are relying on it.
7. Update your privacy notice and your AI usage policy so staff know which tools may make decisions about people and which may only recommend.

What’s coming next

The ICO’s consultation on its automated decision-making guidance closed on 29 May 2026. Its guidance plans list the final version for winter 2026, and separate guidance on agentic AI is being drafted for consultation, with the final version targeted for spring 2027. Expect the final text to keep the emphasis on genuine human involvement and visible safeguards; that is where the draft and the recruitment report both point. UK SMEs that sell into the EU should also watch the EU AI Act. Its high-risk obligations, which cover recruitment tools, have been deferred under the EU’s Digital Omnibus agreement but not cancelled.

The practical message is simple. The law now lets you automate decisions that used to need a human, but only if you can show the safeguards working. Decide which design you are building, document it, and build the safeguards into the tool from the start.

FAQ