The UK Regulates Automated Decision Making

Automated decision-making (ADM) has faced scrutiny in jurisdictions leading the charge on AI regulation. The EU’s GPAI regulations virtually ban ADM. California’s CPPA has heavily regulated ADM and disallowed it in certain contexts. In new amendments to its Data Use and Access Act (DUAA) the UK is tackling ADM in its own way. Under these new rules, ADM will be allowed contextually, provided certain safeguards are in place. With these changes coming in 2026, Debevoise & Plimpton breaks down the UK’s approach to ADM:

“Although DUAA effectively retains the EU’s definition of ADM, ADM involving non-special category data will now be prima facie permitted (rather than prima facie prohibited) if certain safeguards are implemented. In contrast, ADM involving special category data continues to be prohibited except in very limited circumstances.”

Even with safeguards in place, ADM will not be allowed in the UK for certain activities. These include any credit scoring decisions or those using health data. The UK’s safeguards will allow recourse to those affected by ADM, including the right to contest such a decision and obtain human intervention. ADM is controversial, and we’ll see how different jurisdictions’ approaches play out. Multinational companies that use ADM in any capacity should be aware of the changing regulatory patchwork and keep up with the compliance obligations of each jurisdiction.