{"slug":"uk-ico-automated-decision-safeguards","id":"AIPT-OBL-0078","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0078","title":"Apply safeguards to solely automated decisions with significant effects","short_title":"Automated decision safeguards","category":"human_oversight","summary":"Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.\n","practical_action":"Map every significant automated decision, add a human-review route and a notice to affected people.\n","is_binding":true,"applies_from":null,"section":null,"source_reference":"UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025","official_source_url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["deployer","public_authority"],"sectors":["cross_sector","employment","financial_services"],"use_cases":["hiring_and_hr","finance_and_credit","public_services"],"applicability":[{"description":"Any controller making solely automated decisions with legal or similarly significant effects.","actors":["deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Automated decision register and review procedure","description":null,"artifact_type":"register"}],"framework_mappings":[{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"GOVERN 5.x, MANAGE 4.x","note":"Recourse mechanisms.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"satisfies","note":"Notice, human intervention and contest route for significant automated decisions.","confidence_level":"high","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"},{"slug":"human-oversight-and-override","title":"Human oversight design and override procedure","kind":"process","relationship":"supports","note":"Meaningful human intervention design.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/human-oversight-and-override"},{"slug":"ai-interaction-and-use-disclosure","title":"AI interaction and use disclosure notices","kind":"process","relationship":"supports","note":"Telling people a solely automated decision was made.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-interaction-and-use-disclosure"}],"url":"https://aipolicytracker.org/obligations/uk-ico-automated-decision-safeguards","policy":{"slug":"uk-ico-ai-data-protection-guidance","title":"ICO Guidance on AI and data protection","status":"guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance"}}