UK & EU AI compliance, interpreted
Since February 2026, UK GDPR Articles 22A to 22C, inserted by the Data (Use and Access) Act 2025, generally permit solely automated significant decisions that EU law still restricts by default. AIGRAIL reads both regimes side by side, in plain language, so UK and European organisations understand what they are permitted to deploy, not just what to fear.
May an organisation make a solely automated decision with legal or similarly significant effects on a person, for example automatically rejecting a job applicant?
EU GDPR · Article 22
The starting position is a restriction. Such decisions are permitted only where a specific exception applies (contractual necessity, authorisation by law, or explicit consent) and the required safeguards are in place. High-risk AI obligations under the EU AI Act can apply on top.
UK GDPR · Articles 22A–22C
The starting position is permission. Solely automated significant decisions using ordinary personal data are generally allowed, provided that the individual receives information about the decision and a genuine route to make representations, obtain human intervention, and contest the outcome. Special-category data remains tightly gated.
This is a plain-language orientation, not a statement of the law's full effect. The detailed, source-referenced analysis is published in Insights.
Insights
Every piece starts from the consolidated legislation on EUR-Lex and legislation.gov.uk, and is maintained as the law and guidance evolve. The focus: the UK's new automated decision-making regime, and where it diverges from EU law.
The central divergence between the EU's exception-based restriction and the UK's permission-with-safeguards model, and what it means for anyone deploying automated decisions in both markets.
Information, representations, human intervention, and contest: what each safeguard requires in practice, and why a rubber-stamp review satisfies none of them.
The threshold test that decides whether the UK regime applies at all, and how profiling must be weighed when assessing whether human involvement is meaningful.
How we verify
AIGRAIL maintains a versioned library of obligation restatements and cross-jurisdiction mappings. Each entry carries its own attestation, so you can see exactly what stands behind it.
Also from AIGRAIL
Compliance software in production for UK businesses, alongside advisory work in AI governance.
HMRC · Making Tax Digital
VAT bridging and submission for UK businesses, listed on HMRC's Making Tax Digital compatible-software directory.
Visit MTDBuddy.co.uk →UK lettings · Property
Property compliance workflows for letting agents and landlords: Right to Rent, deposit protection, and EPC tracking.
Visit RentCheckAI.co.uk →AI governance
Consulting for organisations navigating UK and EU AI obligations: governance design, obligation mapping and readiness for automated decision-making rules.
Enquire by email →Contact
Questions about the UK regime, the EU AI Act, or how the two interact for your organisation, or if you want to be notified when new analysis is published? Get in touch.