Automated decision-making
ADMAlso called solely automated decision-making, automated individual decision-making
Automated decision-making is a decision about a person made by technology without meaningful human involvement, such as an online loan refusal. Data protection law restricts solely automated decisions with legal or similarly significant effects. The EU GDPR limits when they are allowed, while the UK rewrote its rules in February 2026.
How it works
A firm feeds customer data into a model or rules engine that produces an outcome, such as approving credit, pricing insurance or blocking an account. If no person meaningfully reviews the outcome before it takes effect, the decision is solely automated. Firms then provide information about the logic, a route to human review and a way for customers to contest the result.
Under EU GDPR Article 22, such decisions are allowed only with explicit consent, for a contract or where law authorises them. Since 5 February 2026, the UK's Articles 22A to 22D allow them on wider lawful bases, with safeguards, while keeping tight limits for special category data. A token human sign-off does not take a decision outside these rules.
The rules
Gives people the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to limited exceptions.
Controllers making decisions about people in the EUPermits significant automated decisions on wider lawful bases with safeguards, including information, human intervention and the right to contest.
Controllers processing personal data in the UKGives affected people a right to a clear explanation of the AI system's role in decisions that significantly affect them.
Deployers of Annex III high-risk AI systemsCommon questions
What counts as a solely automated decision?
A decision is solely automated when no person has meaningful involvement in reaching it. A reviewer who simply confirms the system's output without the authority or information to change it does not count. The UK Data (Use and Access) Act 2025 states this test expressly.
What changed in the UK in February 2026?
On 5 February 2026, section 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A to 22D. Significant automated decisions are now permitted on wider lawful bases, provided safeguards are in place. Stricter limits remain for special category data.
Is profiling the same as automated decision-making?
No. Profiling is evaluating people's characteristics from their data, such as predicting creditworthiness. Automated decision-making is acting on a result without meaningful human involvement. Profiling often feeds automated decisions, but each can happen without the other.
