Automated decisions in the UK: the rules since February 2026

What changed

Before February 2026, solely automated decisions with legal or similarly significant effects were generally prohibited unless an exception applied. Now the general prohibition remains only for decisions based on special category data, such as health information. For other personal data, organisations may make solely automated significant decisions on any lawful basis except the new "recognised legitimate interests", as long as the safeguards below are in place.

Where special category data is involved, a solely automated significant decision is still prohibited unless the person gives explicit consent, or the decision is necessary for a contract or required by law and there is a substantial public interest.

Which decisions are covered

The rules apply to significant decisions, meaning those with legal or similarly significant effects on a person, made solely by automated means. Typical examples in law firms' summaries include shortlisting job candidates, credit and lending decisions, and access to essential services.

A decision isn't solely automated if there is meaningful human involvement. In its draft guidance, the ICO says a reviewer who simply approves what the system suggests doesn't count: the person must have the authority, competence and discretion to change the outcome, and consider each case.

The four safeguards

When a significant decision is made solely by automated means, the organisation must:

1. tell the person about the decision;
2. let them make representations about it;
3. let them obtain human intervention, from someone able to change the decision;
4. let them contest the decision.

The ICO's guidance

The ICO consulted on draft guidance on automated decision-making from 31 March to 29 May 2026. As of late October 2026, the final version hadn't been published. The ICO is also preparing a statutory code of practice on AI and automated decision-making. Until the final guidance arrives, the draft is the best indication of what the regulator expects.

Since 19 June 2026, organisations must also be able to handle data protection complaints themselves before people go to the ICO.

What to do now

1. List the AI tools and other software that make or help make decisions about people, such as CV screening, credit checks or automated eligibility checks.
2. For each, decide whether a person genuinely reviews and can change the outcome. If not, treat it as solely automated.
3. Where a significant decision is solely automated, put the four safeguards in place and check whether special category data is involved.
4. Explain the decisions in your privacy information, and make sure staff know how to handle a request for human review.
5. Record what you decided and why, and review it when tools change or the ICO publishes its final guidance.

Our UK sample pack shows how an AI risk register and AI use policy handle a recruitment agency's CV-screening tool, and the UK entries in the AI regulations tracker follow further changes.

Free tools, no sign-up

• Free AI policy generatorA short AI use policy in a few minutes
• Australia: automated decisions checkerDoes the 10 December 2026 rule apply to you?
• US: Colorado and California checkerAutomated decision rules from 1 January 2027
• EU AI Act checkerWhich transparency duties apply to you
• AI regulations trackerAI rules by region, with email alerts
• Free checklistsAI tools audit and 10 December readiness, as PDFs

Sources

• Travers Smith: UK's data protection reforms take effect, a new era for automated decision-making (12 February 2026)
• HLC: AI and automated decision-making in the UK (Part I), the new rules and regulatory guidance (6 May 2026)
• Bratby Law: Automated decision-making under the DUAA (updated 25 October 2026)
• Clifford Chance: Key aspects of the Data (Use and Access) Act take effect

This article is general information, last checked against these sources on 1 November 2026. It isn't legal advice. For advice on your situation, speak to a qualified adviser.