The ICO expects the people who review automated decisions to be able to change them, to understand the system well enough to judge its output, and to consider more than the system did. For AI agents, that means training reviewers on the specific agent, testing them on flawed cases, and keeping records that show the review was real.
What does ICO guidance ask of reviewers?
The ICO regulates data protection in the UK under UK GDPR and the Data Protection Act 2018. Article 22 of UK GDPR restricts decisions based solely on automated processing with legal or similarly significant effects. Parliament has since legislated to reform the UK rules on automated decision-making, widening when such decisions may be made while keeping safeguards: information about the decision, the chance to make representations, human intervention and the ability to contest. Decisions based on special category data stay more tightly restricted. Organisations should confirm which provisions apply to them.
Either way, the reviewer sits at the centre. Where the organisation wants a decision to be outside the automated category, human involvement must be meaningful. Where the decision is automated, the safeguard of human intervention depends on a reviewer who can actually intervene.
ICO guidance on automated decision-making and on explaining AI-assisted decisions describes what meaningful review looks like. In substance:
- Reviewers must have the authority and the competence to change the decision.
- They must weigh all the relevant information, including information the system did not use.
- They should not routinely agree with the system's output; a pattern of automatic agreement suggests the review is a formality.
- They need enough understanding of how the system works, and where it is weak, to interpret its output.
- They should be able to explain the decision to the person affected.
The system side is covered in ICO and automated decision-making by AI agents. This article covers the people.
Who does it apply to?
Any controller in the UK, or offering goods and services to people in the UK, that makes significant decisions about individuals using automated processing. That includes lenders, insurers, employers, landlords, retailers, utilities, public bodies and platforms. Reviewers in scope are whoever releases, confirms or re-decides those decisions: credit analysts, claims handlers, HR advisers, caseworkers, fraud analysts and complaints staff. A good primer on terms is what an automated decision is.
What competence does the guidance imply when the system is an agent?
Agents raise the bar because they do more than score. They read sources, reason, draft and sometimes act. A reviewer of an agent's decision must understand five things.
What the agent did, by capability. At depth 1 it read. At depth 2 it drafted a decision for the reviewer to adopt or reject. At depth 3 it may have acted within bounds. The reviewer must know which, because a depth 3 action already taken calls for a different response from a depth 2 draft.
What the agent read. Each fact reaching the agent carries a provenance class. Sealed records from the system of record are strongest; signed facts have a named party behind them; declared facts are the person's own account; external material arrived from outside and proves little on its own. Reviewers must see whether the decision rests on the right class.
What the agent did not read. The guidance asks reviewers to consider information beyond the system's inputs. Training must teach reviewers to ask what is missing: a recent change of circumstance, a disability, an open dispute.
How the agent fails. Every agent has typical errors. Reviewers should be shown them, with examples from the organisation's own cases.
How to explain. The guidance expects explanations people can understand. Reviewers need practice turning an agent's reasons into a plain explanation that is accurate and that they stand behind. The topic is developed in ICO and explaining AI agent decisions to people.
How do you meet the guidance and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Authority to change decisions | Reviewer role definitions with override rights | Role definitions; override records |
| Competence | Training on the specific agent, its sources and failure modes; assessment before release rights | Assessment results per reviewer |
| Weigh all relevant information | Review screen shows inputs, provenance and what was not checked | Case view design; reviewer notes |
| No routine agreement | Agreement rates and review times monitored; seeded cases in queues | Monitoring reports; seeded case results |
| Explain to the person | Reviewer writes or approves the explanation | Explanation records |
| Contest and intervention | Requests routed to trained reviewers who re-decide | Contest log with outcomes |
| Record | Every verdict filed with reviewer identity and reason | Append-only decision record |
What will the ICO or an auditor ask?
- Which decisions are automated, and where does a person decide?
- Show us reviewers' agreement rates with the agent. What explains them?
- How were reviewers trained on this agent, and how were they assessed?
- Ask a reviewer: what does the agent not see?
- Show us an explanation given to a person. Who wrote it?
- What happens when someone asks for human intervention?
Auditors are increasingly testing reviewers directly, as your auditors will sample the reviewers, not just the agents argues. Structured, checkable assessment of reviewers, such as the practicum in Pryme Intelligence Academy's Operator track, gives them something to sample.
What does the guidance not cover?
ICO guidance explains how the law applies; it is not law itself, though the ICO takes it into account. It does not set sector rules: the FCA and PRA apply their own expectations in financial services, including the FCA Consumer Duty. It does not regulate the agent's design as a product. And it does not cover decisions with no significant effect. For the EU position, see whether GDPR allows AI agents to make automated decisions. The guide to AI literacy and certification covers reviewer training broadly.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is a high agreement rate always a problem?
Not if the agent is accurate and reviewers are checking. It becomes a problem when review times are very short and seeded errors go unnoticed.
Do reviewers need to understand how the model works?
They need to understand what the agent does, what it reads and how it fails. Deep technical knowledge is not required; practical understanding is.
Can one reviewer cover several agents?
Yes, if trained and assessed on each. Competence on one agent does not carry over automatically to another.