AI Strategy & ROI · BraivIQ AI Engineering Playbook

What The UK's New Automated-Decision Rules Mean If You Build AI That Decides: DUAA 2025, Articles 22A-22D - A Developer's Pro-UK Read

While much of the AI world argues about hypothetical future regulation, the UK quietly changed the actual law that governs any developer building AI which makes decisions about people - and most engineers have not noticed. Since 5 February 2026, the Data (Use and Access) Act 2025 has replaced the old, restrictive Article 22 of the UK GDPR with new Articles 22A to 22D, which make solely automated decisions about individuals lawful in far more circumstances than before - provided you build in specific, documented safeguards. For developers, this is unusually good news wrapped in real obligations: Britain has chosen a pragmatic, pro-innovation path that lets you ship automated decisioning, but only if you engineer transparency, human review and the right to contest into the system from the start. This educational, openly pro-UK read explains what actually changed, what the safeguards mean in code and architecture, and why the UK's approach is a sensible one for the developers who have to build under it.

September 15, 2026 · 12 min read · By BraivIQ Engineering

5 Feb 2026 - The Data (Use and Access) Act 2025 provisions on automated decisions came into force, replacing UK GDPR Article 22 · 22A-22D - The new articles that make solely automated decisions about individuals lawful in more circumstances - with safeguards · No AI Act - Britain has no single AI statute; it regulates AI through existing law and sector regulators - a deliberate, pragmatic choice · Safeguards in code - Transparency, human review and the right to contest must be built into the system and documented - by design, not bolted on

There is a widespread belief among developers that the UK has not really regulated AI - no dramatic AI Act, no single statute, lots of principles-and-guidance. That belief is half right and, for anyone building AI that makes decisions about people, dangerously incomplete, because while everyone was watching for a headline AI law that has not come, the UK quietly changed the actual law that governs automated decision-making - and it is in force right now. Since 5 February 2026, the Data (Use and Access) Act 2025 has replaced the old Article 22 of the UK GDPR - which broadly prohibited solely automated decisions with legal or similarly significant effects - with new Articles 22A to 22D, which flip the default: solely automated decisions about individuals are now lawful in far more circumstances, provided defined safeguards (transparency, a right to human review, a right to contest) are in place and documented. For developers this is genuinely important and, unusually, mostly good news - but it is good news that comes with real engineering obligations. As an AI Agency London that builds automated decisioning for UK clients under exactly these rules, we think every developer working on AI-that-decides should understand this, and this is an educational, openly pro-UK read on what it means.

The Honest, Pro-UK Framing: Pro-UK here means recognising that Britain has made a deliberate and, we think, sensible regulatory choice - and being honest about the obligations it carries. Rather than copying the EU's comprehensive, prescriptive AI Act, the UK has chosen to regulate AI through existing law (data protection, consumer protection, sector regulators like the FCA and OFCOM) and to liberalise automated decision-making in a way that lets businesses actually deploy it, while requiring safeguards that protect the people affected. That is a pro-innovation stance that treats developers and businesses as capable of building responsibly, rather than presuming they cannot. It is not a free pass - the safeguards are real and enforceable - but it is a framework designed to enable good automated decisioning rather than to smother it. For developers who have to build under it, that is a better environment than the alternative, and worth understanding and using well.

What Actually Changed

The specifics matter, so here is what changed in plain terms. The old Article 22 of the UK GDPR set a restrictive default: a decision based solely on automated processing, which produced legal effects or similarly significant effects on a person, was broadly prohibited unless a narrow exception applied - which made a lot of straightforwardly useful automated decisioning legally awkward. The Data (Use and Access) Act 2025 replaced that with Articles 22A to 22D, which invert the starting position for most cases: solely automated decisions with significant effects are now permitted more broadly, rather than presumptively banned, so long as the decision is not based on special-category (sensitive) data without a further lawful basis, and so long as the required safeguards are in place. Those safeguards are the heart of it: the person must be given meaningful information about the automated decision (transparency), must be able to obtain human intervention and review, and must be able to contest the decision. In other words, the law moved from 'mostly you cannot do solely automated significant decisions' to 'you can, if you build in transparency, human review and the right to contest, and you document it'. For a developer, that is a shift from a legal blocker to a design specification - the constraints did not disappear, they became a set of features you have to build.

What The Safeguards Mean In Code And Architecture

This is where it gets concrete for engineers, because the safeguards are not abstract legal principles - they are system requirements you have to architect, and treating them as compliance-by-design from the start is far cheaper than bolting them on after. Transparency means your system must be able to tell an affected person meaningful information about the logic of the decision - which requires that you capture and can surface why a decision was made, not just what it was; a black box that emits a yes/no with no recorded rationale cannot meet this, so you need to log the inputs, the factors and enough of the reasoning to explain the outcome. The right to human review means there must be a real path for a human to step in and re-examine a decision - which is an architectural feature: a queue or workflow where flagged or challenged decisions go to a person with the authority and information to change them, not a rubber stamp. The right to contest means the affected person must be able to challenge a decision and have that challenge actually processed - another workflow, with state, that connects to the human review path. And underpinning all of it is documentation and auditability: you must be able to show, after the fact, that the safeguards existed and operated, which means recording decisions, their rationale, the reviews and the contests. Notice that these are the same disciplines good engineering already values - logging, explainability, human-in-the-loop workflows, auditability - now with legal force behind them. Building automated decisioning for the UK market well means building these in from the first design, not discovering them in a compliance review.

Transparency - capture and be able to surface the logic and factors behind each decision, not just the outcome; a rationale-free black box cannot comply.
Human review - architect a real path (a queue or workflow) for a human with authority and context to re-examine flagged or challenged decisions.
Right to contest - build a workflow, with state, that lets affected people challenge a decision and have the challenge genuinely processed.
Documentation and audit - record decisions, rationale, reviews and contests so you can demonstrate the safeguards existed and operated.
Mind special-category data - solely automated significant decisions on sensitive data need a further lawful basis; know when you are in that territory.

The honest caveat: The liberalisation is real, but so are the obligations, and there are genuine open questions. The safeguards are enforceable, and getting them wrong - shipping automated significant decisions with no meaningful explanation, no route to human review, or no way to contest - is a data-protection breach, not a technicality. The boundary of what counts as a 'significant' effect, and exactly how much explanation is 'meaningful', will be worked out through regulator guidance (the ICO) and cases over time, so there is real interpretive uncertainty at the edges. And special-category data raises the bar further. The pragmatic, pro-UK reading is not that automated decisioning is now unregulated - it plainly is not - but that Britain has chosen a framework that permits it under sensible, engineerable safeguards. The way to stay on the right side of it is to build the safeguards in properly and document them, and to treat the uncertain edges conservatively rather than assume the most permissive interpretation.

The Bottom Line

While the AI world waits for a headline UK AI Act that has not come, the law that actually governs any developer building AI which makes decisions about people already changed: since 5 February 2026 the Data (Use and Access) Act 2025 has replaced UK GDPR's restrictive Article 22 with Articles 22A-22D, which make solely automated significant decisions lawful in far more circumstances - provided you build in transparency, a right to human review, and a right to contest, and document them. For developers this is a shift from a legal blocker to a design specification, and it reflects a deliberate, pragmatic, pro-innovation choice by the UK to regulate AI through existing law and enable automated decisioning under engineerable safeguards rather than smother it under a prescriptive statute. The safeguards translate directly into architecture - explainability and decision logging for transparency, human-in-the-loop workflows for review and contest, and thorough auditability - which are the disciplines good engineering already prizes, now with legal force. The obligations are real and the edges are still being defined by regulator guidance, so the sensible path is compliance-by-design and a conservative reading of the uncertain boundaries. Britain has given developers a workable, comparatively permissive framework for building AI that decides; using it well - shipping automated decisioning that is genuinely transparent, reviewable and contestable - is both the law and simply good engineering, and it is exactly what we build for UK clients.

References & Further Reading

Pinsent Masons (Out-Law) - AI and the post-Data Bill UK timeline into 2026 (DUAA and automated decision-making): https://www.pinsentmasons.com/out-law/analysis/ai-and-copyright-post-data-bill-uk-timeline-2026
Osborne Clarke - UK Regulatory Outlook: artificial intelligence (January 2026): https://www.osborneclarke.com/insights/regulatory-outlook-january-2026-artificial-intelligence
Scaffold Digital - UK AI regulation in 2026: what's in force, what's coming, and what your business should do: https://www.scaffold.digital/news/uk-ai-regulation-in-2026-whats-in-force-whats-coming-and-what-your-business-should-do
ICO - guidance on automated decision-making and profiling: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/automated-decision-making-and-profiling/
White & Case - AI Watch: global regulatory tracker, United Kingdom: https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-united-kingdom