Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.