Apply safeguards to solely automated decisions with significant effects
Under ICO AI guidance, UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025
What does it require?
Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.
Practical action
Map every significant automated decision, add a human-review route and a notice to affected people.
Who does it apply to?
Any controller making solely automated decisions with legal or similarly significant effects.
Evidence examples
- Automated decision register and review procedure (register)
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| NIST AI RMF 1.0 | GOVERN 5.x, MANAGE 4.x | Recourse mechanisms. | medium |
Similar obligations in other instruments
- Enable and assign effective human oversight — EU AI Act, European Union
- Respect the right to object to automated decision-making without human intervention — UAE PDPL, United Arab Emirates
- Determine the appropriate level of human involvement in AI decisions — Singapore Model AI Governance Framework, Singapore (voluntary)
- Provide routes to contest AI outcomes and seek redress — UK AI regulation framework, United Kingdom (voluntary)
- Test and monitor systems, enable human control, and be transparent with users (guardrails 4 to 6) — Australian Voluntary AI Safety Standard, Australia (voluntary)
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.