UK Data (Use and Access) Act 2025 (automated decision-making)
The UK has no AI Act. This data law replaced the UK GDPR's Article 22 with new Articles 22A-22D: solely automated significant decisions are allowed more widely, but decisions using special category data stay restricted, and controllers must provide safeguards: information, a way to make representations, human intervention and a way to contest.
At a glance
In force
- Jurisdiction
- United Kingdom
- Type
- Law
- Official title
- Data (Use and Access) Act 2025 (c. 18)
What this means for you
If you build AI
- If your product makes significant decisions about people with no meaningful human involvement, the new Articles 22A-22D of the UK GDPR apply.
- Decisions based on special category data (such as health) face tighter limits on being solely automated.
If you deploy AI
- For solely automated significant decisions, you need safeguards: tell people, let them make representations, offer human intervention and let them contest.
- These rules have applied since 5 Feb 2026.
If you use AI
- If a significant decision about you is made solely by automated means, you can get information about it, ask for human intervention and contest it.
Key dates
Status history
In the Drops
No Drop has covered this law yet.