Automated Decision Evidence Is Now A UK Governance Requirement

AI Trust & Governance

19 August 2026 | By Ashley Marshall

UK firms have more room to use automated decisions. They also need better evidence when those decisions affect real people.

The important change for UK leaders is not that automated decision-making is suddenly forbidden. It is almost the opposite. The Data (Use and Access) Act 2025 has made the UK regime more permissive for significant automated decisions, provided organisations keep the right safeguards in place. GOV.UK says the Act creates a framework where organisations can make solely automated decisions with legal or similarly significant effects in wider circumstances, but must provide people with information, allow them to make representations, allow challenges, and enable human intervention. The ICO's own summary says automated decision-making can now use the full range of lawful bases for significant automated decisions, including potentially legitimate interests, so long as safeguards continue to apply.

That changes the practical question. Boards should stop asking only, can we use AI for this decision? The more useful question is, can we explain and evidence this decision when an applicant, customer, employee, auditor, insurer or regulator asks what happened? The old mental model treated Article 22 as a legal roadblock. The new model is closer to an operating control. If the business wants to automate more decisions, it needs a live record of where automation is used, what data it uses, what effects it has, when humans intervene, and how the individual can challenge the outcome.

What this means in practice is simple but uncomfortable. AI governance cannot sit in a policy PDF that nobody opens after launch. It needs to become a decision evidence system. A recruitment screen, credit referral, fraud flag, pricing decision, case triage route or service eligibility decision should have a named owner, an explanation record, a bias review cadence, a challenge path, and an audit log that can be read by someone outside the delivery team. Without that, automation may look efficient internally while creating weak evidence externally.

The clearest UK example is recruitment, because the ICO has already put a spotlight on it. On 31 March 2026, the regulator called on businesses to review automated decisions in hiring and published expectations for organisations using ADM in recruitment. Its report was based on evidence gathered from over 30 employers between March 2025 and January 2026. The ICO also wrote to 16 organisations likely to be using ADM to make decisions about candidates, and said they had committed to acting on recommendations. That is a useful signal for every other sector, because recruitment is not special in the underlying risk pattern. It combines personal data, significant life impact, supplier tools, workflow pressure, and a strong temptation to let automation handle volume.

The findings are practical rather than theoretical. The ICO said employers must improve transparency measures so candidates are adequately informed about ADM, including solely automated decisions. It also said meaningful human involvement has to be applied consistently to candidates within a hiring stage, and employers should expand good practice in monitoring for fairness and bias. In the accompanying news release, the ICO highlighted bias monitoring, clear explanations to jobseekers, and recourse routes as core expectations. It also noted that earlier audits of AI recruitment tool providers and developers had produced almost 300 recommendations to improve compliance with the law.

The lesson for business leaders is that evidence gaps often appear before a formal dispute. A tool may have a dashboard, a vendor may provide a fairness statement, and a manager may believe a human is in the loop. None of that proves the individual was properly informed, that the human review was meaningful, that bias checks were current, or that the reviewer had authority to change the result. The evidence has to be designed into the workflow, not reconstructed after a complaint.

Many organisations still treat transparency as a notice-writing exercise. That is too narrow for automated decisions. A privacy notice can tell people that automated decision-making may happen, but it rarely explains the specific decision, the role of the model, the data used, the route to challenge, and the conditions under which a human will review the outcome. The ICO consultation page for its draft ADM guidance says the guidance is aimed at data protection officers, compliance professionals and technical leads with oversight of an organisation's use or procurement of ADM systems. That audience choice matters. The regulator is not talking only to lawyers. It is talking to the people who buy, configure, integrate and operate these systems.

For a UK business, the evidence pack should start with a decision map. List each workflow where automation recommends, ranks, approves, rejects, prices, flags or routes a person. Then classify the effect. Is it a legal effect, a similarly significant effect, or a lower-risk operational assist? Next, identify whether the decision is solely automated or whether there is meaningful human involvement. That phrase should not be a comfort label. A reviewer who rubber-stamps a model score, lacks time to inspect the case, or cannot alter the outcome is unlikely to provide the assurance the business thinks it has.

What this means in practice is that product, compliance and operations need shared artefacts. The user journey must tell people when automation is relevant. The case system must store the model output, source data categories and decision rationale. The review process must show who reviewed it, what they saw, what discretion they had, and whether the decision changed. If those artefacts are missing, the business has transparency theatre rather than transparency evidence.

The strongest argument against heavier evidence controls is that automation is meant to remove friction. Hiring teams want faster screening. Insurers want quicker triage. Lenders want instant decisions. Customer operations leaders want fewer manual queues. There is a real business case here, and the ICO recognises it. Its recruitment update says automated tools can help employers process high volumes of applications consistently and quickly, and that the public can see value in those tools when used appropriately. The problem is not automation itself. The problem is automated impact without a visible route for understanding, review and correction.

Good evidence design should make automation faster over time, not slower. A well-built decision record reduces investigation effort when a complaint arrives. A standard explanation template reduces the time spent rewriting responses. Bias monitoring stops teams arguing from anecdotes. A supplier evidence checklist stops procurement from re-litigating the same questions every time a new tool is bought. A clear challenge path means front-line staff know where to send a case instead of improvising under pressure.

The business mistake is to compare an automated workflow with safeguards against a manual workflow imagined as risk-free. Manual decisions also contain bias, inconsistency and poor documentation. The governance aim is not to make humans look perfect or AI look suspect. It is to build a decision process that can be tested. Where automation genuinely improves consistency, the evidence should show that. Where it creates new risk, the controls should catch it early. In practice, the firms that move fastest will be the ones that standardise the evidence layer once, then reuse it across use cases.

Supplier due diligence is often where automated decision risk becomes vague. A vendor says the system is explainable. The buyer asks whether it is compliant. Both sides exchange high-level documents, and the workflow launches with thin operational proof. That will not be enough for significant automated decisions. If a vendor tool ranks candidates, scores customers, flags fraud, recommends eligibility or triggers workflow consequences, the buyer needs evidence that can survive a real challenge. The evidence must cover model behaviour, training or configuration assumptions, audit logs, data categories, bias testing, appeal routing and the boundaries of human review.

The ICO recruitment materials are a warning here. The regulator's earlier work with AI recruitment tool providers generated almost 300 recommendations. That does not mean every tool was unlawful, but it does show that supplier claims need buyer-side verification. A UK firm cannot outsource accountability simply because a system is hosted by a respected platform. Controllers still need to understand how the decision works in their own context, what data is processed, what safeguards are live, and what evidence can be produced if challenged.

Procurement should therefore add a practical ADM schedule to AI vendor contracts. Ask for a data flow map, a description of decision logic suitable for affected individuals, records of bias testing, change notice commitments, incident reporting obligations, model or ruleset version history, retention settings, and support for subject rights and challenge workflows. Ask who can alter thresholds and how those changes are logged. Ask whether the vendor can separate a recommendation from a final decision. These questions are not bureaucracy. They are the controls that turn a promising AI tool into a defensible business process.

This does not need to become a year-long governance programme before any AI work continues. Most organisations can build a useful first evidence pack in 30 days if they keep the scope tight. Start with the highest-impact automated decision workflow already in use or closest to launch. Recruitment, customer eligibility, fraud review, complaint prioritisation, lending, insurance, HR case triage and access decisions are good candidates because the effect on individuals is easy to see. Then collect the facts: purpose, owner, vendor, data categories, affected people, decision effect, automation level, lawful basis, special category data status, explanation route, challenge route, human review process, bias controls, logging, retention and change process.

The second step is to test the workflow with a real case. Can the team show what the individual was told before the decision? Can they show what data influenced the result? Can they explain why the outcome happened without exposing trade secrets or security-sensitive details? Can a trained human review the case with authority to change it? Can the business show that similar people are treated consistently? Can the vendor provide useful records within the time the business needs them? If the answer is no, the gap is operational, not just legal.

The final step is to turn those gaps into a release gate. Significant automated decisions should not go live unless the evidence pack is complete enough for a complaint, audit or board question. That is the governance standard UK firms should adopt now. The DUAA may give businesses more room to automate, but the firms that win trust will be the ones that can explain, challenge and improve those decisions without scrambling.

Frequently Asked Questions

What changed for automated decision-making in the UK?

The Data (Use and Access) Act 2025 created a more permissive framework for significant solely automated decisions, provided organisations apply safeguards such as information, challenge rights and human intervention.

Does this mean UK businesses can freely automate decisions about people?

No. The regime is more flexible, but significant automated decisions still need lawful basis analysis, transparency, recourse, human intervention and extra care where special category data is involved.

What counts as a significant automated decision?

It is a decision based solely on automated processing that has a legal or similarly significant effect on someone, such as access to employment, services, finance or other important opportunities.

Is a privacy notice enough for ADM transparency?

Usually not on its own. Organisations need decision-specific information, clear user journeys, records of the data and logic used, and a practical route for people to challenge outcomes.

What is meaningful human involvement?

It means a competent human reviewer has enough information, time, authority and discretion to assess the case and change the outcome, rather than simply approving a model result.

How should we handle AI vendors that support automated decisions?

Ask for operational evidence: data flows, explanation support, bias testing, version history, audit logs, change notices, retention settings and support for rights and challenge workflows.

Which business functions should review ADM first?

Start with recruitment, lending, insurance, fraud, HR, complaint triage, access decisions, eligibility scoring and any workflow where automation can materially affect a person.

Can evidence packs slow AI adoption?

They add design work upfront, but they reduce delays later by making reviews, complaints, audits, supplier checks and board questions easier to handle.