Automated decisions about people, such as credit approvals, job screening or fraud flags, are where AI meets data protection most directly. The three jurisdictions now take three different approaches.
United Kingdom: permitted, with safeguards
Since 5 February 2026 the UK GDPR no longer requires a special lawful basis for most solely automated decisions with legal or similarly significant effects. Instead, new Articles 22A to 22D require safeguards: telling the person about the decision, letting them make representations, giving them human intervention, and letting them contest the outcome. Decisions based on special category data, such as health, remain restricted. The Information Commission’s final guidance is due this winter.
European Union: still a prohibition
Article 22 of the GDPR still gives individuals a right not to be subject to such decisions, subject to exceptions for contracts, law and explicit consent. The AI Act adds separate duties for high-risk systems, including human oversight, from December 2027. A UK business serving EU customers needs to meet the stricter EU rule for them.
United States: California leads
California’s regulations on automated decision-making technology bind businesses from 1 January 2027 where it is used for significant decisions about consumers. Businesses will need pre-use notices, a way for consumers to access information about the logic, and opt-out handling, subject to exceptions. Colorado’s revised law also regulates automated decision technology from 2027.
A decision process that is lawful in London may need redesigning for Dublin and for Los Angeles.
What to do
List the decisions your systems make without a human. For each, record which jurisdictions’ customers it affects, and build the strictest applicable safeguards into the process rather than bolting them on later.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.