UK GDPR's rules on automated decisions apply to an AI agent whenever it makes a decision about a person, with legal or similarly significant effect, and no person meaningfully involved. UK firms must then give safeguards: tell people, let them make representations, offer human intervention and let them contest. Stricter limits apply where special category data is used.
What do the UK rules require?
Article 22 of UK GDPR, read with the Data Protection Act 2018, governs decisions based solely on automated processing, including profiling, that produce legal effects on a person or similarly significantly affect them. UK law in this area has been amended to widen the circumstances in which such decisions can be made, while keeping the safeguards and keeping tighter limits where special category data is involved. Check which provisions are in force for your processing.
Under either version, the safeguards, in substance, are that the person is:
- told that a significant decision has been made about them by automated means;
- able to make representations about it;
- able to obtain human intervention;
- able to contest the decision.
Decisions resting on special category data, such as health information, face stricter conditions. The Article 5 principles, a lawful basis under Article 6, and a DPIA under Article 35 apply throughout. For the wider regime, see what UK GDPR requires of AI agents.
Who does it apply to?
Controllers processing personal data under UK GDPR. The firm that deploys the agent and decides what it does is the controller, so the obligation sits with it, not with the agent platform or model provider.
Which agent actions trigger the rules?
Two tests decide: is the decision solely automated, and is its effect legal or similarly significant?
Clear cases. An agent that declines a loan application, cancels an insurance policy, refuses a claim, closes an account, or sets a price that materially changes what a person pays, without a person meaningfully involved.
Less obvious cases. Agents create several situations that older guidance did not foresee.
- Partial automation. An agent decides routine cases itself and passes harder ones to staff. The cases it decides alone are solely automated, even though the process as a whole involves people.
- Decisions by omission. An agent that never offers a cheaper product to certain customers, or quietly closes a complaint as resolved, may be deciding with significant effect without ever producing a formal "decision".
- Filtered review. A person approves the agent's shortlist, but the agent has already removed applicants from it. Those removed were decided about solely by the agent.
- Rubber-stamped review. A person signs off agent decisions in bulk without considering them. That review is not meaningful, so the decisions stay solely automated.
Usually outside. Routing a query to a queue, drafting a reply a person reviews and sends, or answering a factual question.
What safeguards should UK firms build for agents?
Each safeguard needs a working mechanism, not a sentence in a privacy notice.
Telling people. The decision communication says it was made by automated means, in plain words, at the time.
Representations. The person can add information the agent did not have, and it reaches someone who will consider it.
Human intervention. A named person with the authority, competence and information to change the outcome reviews it. That person should not be shown only the agent's conclusion; they need the facts and sources the agent relied on.
Contest. A route to challenge the decision is offered every time, and challenges are logged with outcomes.
Take an illustrative case. A UK motor insurer's agent handles mid-term policy changes and can refuse cover for a newly added driver based on their claims history. That refusal is solely automated with significant effect. The insurer's design: the refusal message says it was automated and why, invites the customer to add information, and offers review by an underwriter. Underwriters see the claims data the agent used and its source. The insurer tracks how often underwriters overturn the agent, and when that rate is high for one driver profile, it moves those cases to underwriters by default.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify decisions in scope | Register of agent capabilities that decide with significant effect, including partial and omission cases | Capability register |
| Meaningful human involvement where claimed | Reviewers see facts and sources; bulk approval prevented; overrides tracked | Review records; override rates |
| Inform the person | Automated decision stated in the communication | Decision templates |
| Representations | Channel that reaches a person | Representation log |
| Human intervention | Named reviewer with authority to change outcomes | Intervention records |
| Contest | Challenge route offered with every decision | Challenge log |
| Special category data | Stricter conditions checked; such data excluded from agent decisions unless permitted | Data map; condition record |
| DPIA | Assessment before deployment | Signed DPIA |
For running the assessment, see a UK GDPR DPIA for agents.
What will the ICO ask?
- Which agent capabilities make significant decisions without a person?
- How do you handle cases the agent decides alone in a partly automated process?
- What does a reviewer see, and how often do they change the outcome?
- How are people told, and how do they challenge?
- Does any agent decision rely on special category data?
What do the UK rules not cover?
They do not ban automated decisions. They do not set conduct standards for what a fair decision is; the FCA's Consumer Duty and equality law do that. They differ from the EU position, which has not been amended in the same way; see how AI rules differ between the UK and EU. For the full map, see our guide to AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme lets a firm hold a decision-making capability at depth 2, so the agent drafts and a named person decides, and raise it only when Attest evidence supports it. Held items show reviewers each fact with its provenance, and every verdict and override is filed, which gives the firm both meaningful review and the record to prove it.
Questions people ask
Does adding a person at the end of an agent's process take it outside Article 22?
Only if that person's involvement is meaningful: they have authority to change the outcome, consider the relevant information and actually do change outcomes when warranted. Token sign-off does not count.
Do the rules apply to decisions about business customers?
Article 22 protects individuals. Decisions about sole traders and partnerships can affect individuals directly; decisions about companies generally fall outside, though conduct rules may still apply.
How quickly must human intervention happen?
The rules do not set a period, but intervention should be timely enough to matter. A review that arrives after the harm is done does little for the person.