The ICO treats a decision as solely automated when no person meaningfully influences it; an agent acting alone on a customer's credit, account or claim usually qualifies. Where the effect is legal or similarly significant, UK law requires safeguards: information about the decision, a way to make representations, human intervention on request and the ability to contest.
What does UK law require on automated decisions?
UK GDPR and the Data Protection Act 2018 regulate decisions based solely on automated processing that produce legal or similarly significant effects on a person. UK law in this area has been amended to widen the circumstances in which such decisions can be made, while keeping the safeguards and keeping tighter limits where special category data is involved. Check which provisions are in force for your processing.
Under either version, the core safeguards remain, in substance:
- tell the person that a significant decision has been made about them by automated means;
- let them make representations about it;
- let them obtain human intervention;
- let them contest the decision.
The Article 5 principles, a lawful basis under Article 6 and transparency duties apply throughout. A DPIA under Article 35 is expected for processing of this kind.
Who does it apply to?
Any controller processing personal data under UK GDPR. The ICO enforces against controllers, so the firm deploying the agent is accountable, not the platform. For how the EU position compares, see what automated decision-making under GDPR is and whether GDPR allows AI agents to make automated decisions.
What counts as meaningful human involvement for an agent?
The ICO's position is that human involvement must be meaningful to take a decision outside the solely automated category. Token approval does not count. For agents this is the central question, because firms often put a person at the end of an agent's process and assume that settles it.
The tests the ICO applies, in substance:
- The reviewer has the authority to change the decision, not just to pass it on.
- The reviewer has the competence to judge it, including knowing the agent's limits.
- The reviewer considers all relevant information, including information the agent did not use.
- The reviewer does not routinely accept the output; their involvement actually affects outcomes.
A person who approves a list of fifty agent declines in five minutes fails the last test. A person who reviews each case with the agent's facts, sources and reasoning in front of them, and who overturns some, passes it.
The trap specific to agents is drift. An agent begins by drafting decisions for underwriters. To clear a backlog, the team approves in bulk. Then it agrees to release low-value cases automatically. Each step seems small, but together they turn a supported decision into a solely automated one.
What safeguards does the ICO expect?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify significant automated decisions | Register of agent capabilities that decide about people, tagged by effect | Capability register |
| Lawful basis and any condition | Basis recorded per decision type; special category data excluded unless permitted | Records of processing |
| Inform the person | Decision communication says it was automated and how to respond | Decision templates |
| Representations | Channel for the person to add information, reviewed by a person | Representation log |
| Human intervention | Named reviewer with authority to change the outcome | Intervention log with outcomes |
| Contest | Challenge route in every decision communication | Challenge log |
| Meaningful review where claimed | Reviewers see full context; override rates tracked; bulk approval prevented | Review records; override statistics |
| DPIA | Assessment before deployment, reviewed on change | Signed DPIA |
| Accuracy and fairness | Outcome monitoring across groups; regular testing | Monitoring reports |
Override rates are the evidence most firms lack. If a reviewer never changes an agent's decision, the ICO may conclude the review is not meaningful. Track them. The customer's side of the same safeguards is covered in whether a customer can object to a decision made by an AI agent.
What will the ICO ask?
- Which agents make decisions about people with no meaningful human involvement?
- For those you call human-reviewed, what does the reviewer see and how often do they change the outcome?
- What do you tell people about these decisions, and when?
- How does a person reach someone who can change the decision?
- Where is the DPIA, and does it reflect how the agent works now?
- How do you prevent special category data entering these decisions?
What does the ICO's approach not cover?
It does not prohibit automation. It does not require human review of decisions without significant effects, such as routing a message. It does not settle sector rules, such as FCA expectations on fair treatment, which apply alongside. Other jurisdictions take different approaches; compare POPIA automated decision-making and AI agents and NDPA automated decision-making and AI agents. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme a decision with significant effects can be configured as held: the agent drafts it, with the facts it used and their provenance, and a named person releases or changes it. Every verdict, including who released it, is filed in an append-only record, so override rates and review quality can be measured rather than asserted.
Questions people ask
Does a person reviewing only declined cases make approvals solely automated?
Yes, approvals in that design are solely automated. Whether that matters depends on their effects. Approvals on worse terms, such as a lower limit or a higher price, can have significant effects and need the same safeguards.
Can the agent itself handle a request for human intervention?
No. The point of the safeguard is that a person reconsiders. The agent can log the request, gather the person's representations and route the case, but a human must decide.
How quickly must human intervention happen?
The law does not set a fixed time. The ICO expects it to be timely and effective. For decisions such as a blocked account, that means fast.