When AI Decides About You: How Algorithms Are Used in UK Decisions, and What Your Rights Are

Quick read: key points

The UK has no dedicated AI law. There is no AI Act and no current plan to introduce one. AI is regulated through existing laws (data protection, equality, sector-specific rules), which were not built for it.
Algorithms already make or shape decisions about your benefits, your job application, your hospital triage, your visa, your credit score and where police look for you. The Department for Work and Pensions confirmed in July 2025 that its own benefit-fraud algorithm was statistically biased against older people, disabled people and people of certain nationalities.
You have a legal right under UK GDPR Article 22 not to be subject to a decision made solely by a machine where it has legal or similarly significant effects on you. The Data (Use and Access) Act 2025, in force from February 2026, weakened this protection and turned it from a prohibition into a right of challenge.
Bias is the rule, not the exception. The 2020 A-level grading algorithm downgraded almost 40% of students before being scrapped. The Home Office’s visa streaming algorithm was withdrawn the same year after being challenged as racist. The Court of Appeal ruled police facial recognition unlawful in 2020. Every documented UK case to date has confirmed bias or unlawfulness.
The accountability gap is the most pressing issue. AI systems are not legal entities, cannot be sued and often cannot be explained even by the people who built them. Liability still sits with the organisation that uses the tool, but enforcement is patchy and the burden of challenge sits with the affected person.
You can act. You can request human review of any significant automated decision, ask for the logic behind it, complain to the Information Commissioner’s Office, raise an equality claim if a protected characteristic is involved, and get free legal advice from organisations such as Foxglove and Liberty.

A brown envelope on the kitchen table

A brown envelope arrives on a Tuesday morning. Inside is a letter from the Department for Work and Pensions telling you that your benefit advance has been flagged for review. The letter does not say why. It does not name a person who looked at your case. It asks you to attend an interview. By the time you find a chair to sit on, you have already started to wonder what you did wrong.

The answer, very often, is nothing. The Department for Work and Pensions runs a machine learning model that scores Universal Credit advance applications for fraud risk. In its own fairness assessment, published in July 2025, the DWP confirmed that the model produced statistically significant disparities by age, disability, marital status and nationality. About one million people were scored by it in a single year. The Department’s own fraud estimate for advances is between zero and seven and a half per cent. The model is looking for needles in a haystack that may not contain many needles at all.

If you have ever felt that a decision about your life was made by something you could not see, you were not imagining it. Decisions about your benefits, your job, your healthcare, your visa, your credit and where the police look for you are increasingly shaped by algorithms. The question is no longer whether AI is making decisions about you. It is what your rights are when it does, and what to do when the decision feels wrong.

Key terms

Term	What it means
Algorithm	A set of rules a computer follows to reach a result. In this guide, an algorithm means any system, including a machine learning model, that processes information about you and produces a decision, a score or a recommendation.
Automated decision	A decision reached by a computer with no meaningful human involvement. UK GDPR uses the phrase ‘solely automated decision-making’ for this and gives it special protection where the decision has legal or similarly significant effects on you.
Algorithmic bias	When a system produces systematically different outcomes for different groups of people, often based on protected characteristics like age, race, disability or sex. Bias does not require anyone to set out to discriminate. It can emerge from the training data, from the design of the system, or from how the output is used.
UK GDPR	The UK version of the General Data Protection Regulation. The main law governing how organisations process personal data in the UK, including data used in automated decisions.
Article 22	The article of UK GDPR that gives you the right not to be subject to a solely automated decision with legal or similarly significant effects on you, with limited exceptions.
Data (Use and Access) Act 2025 (DUAA)	Major reform of UK data protection law. Most of its automated decision-making provisions came into force on 5 February 2026. The Act weakened Article 22 by reframing it from a prohibition with exceptions into a right of challenge with safeguards.
Equality Act 2010	The main UK anti-discrimination law. Protects people from direct and indirect discrimination based on nine protected characteristics including age, race, disability, sex and religion. Applies to AI decisions even though the Act predates AI.
Indirect discrimination	When a rule, practice or system is neutral on its face but disadvantages people with a protected characteristic. Applies to algorithms that score or sort people in ways that disproportionately exclude protected groups.
Public Sector Equality Duty	A duty under the Equality Act on public bodies to consider how their decisions affect equality. The Court of Appeal ruled in 2020 that South Wales Police breached this duty by deploying facial recognition without checking it for racial or sex bias.
Information Commissioner’s Office (ICO)	The UK regulator for data protection. The ICO is also the closest thing the UK has to a national AI regulator, with a statutory code of practice on AI and automated decisions in development under the DUAA.

Where AI is already deciding about you

When people talk about AI ethics in 2026, the conversation often drifts towards distant futures: machines smarter than humans, robots in factories, science fiction. The more pressing reality is closer to home. Algorithms are already deciding, or shaping decisions, about ordinary parts of your life. The systems are not always called AI. They go by names like ‘risk model’, ‘scoring engine’, ‘streaming tool’ or ‘decision support’. The effect is the same.

Your benefits

The Department for Work and Pensions uses machine learning to score Universal Credit applications, advance payments and certain other claims for fraud risk. The Universal Credit Advances Model alone scored around one million people in 2024 to 2025. The Department’s own Fairness Assessment, published on 17 July 2025, confirmed statistically significant disparities by age, disability, marital status and nationality. The Department says human caseworkers make the final decision. Campaign groups including Foxglove and Big Brother Watch say the human review is often a rubber stamp, because caseworkers see the algorithm’s score before they look at the case.

Your job application

Many UK employers now use AI tools to sift CVs, score video interviews, rank candidates and predict ‘culture fit’. The Information Commissioner’s Office published a report on automated decision-making in recruitment in March 2026 alongside its draft guidance, setting out expectations that meaningful human involvement must be more than a rubber stamp. Bias is well documented. AI interview tools have been shown to score down candidates wearing headscarves, applicants requesting disability adjustments, non-native English speakers and people with speech conditions. The Equality Act 2010 still applies. An employer can be held liable for a discriminatory outcome even if the tool was sold to them as fair.

Your healthcare

Around 63% of NHS providers have introduced AI into administrative or clinical workflows, mostly in lower-risk tasks like note summarisation and triage support. The Medicines and Healthcare products Regulatory Agency launched a national commission on AI in healthcare in December 2025, with recommendations expected in 2026. Patient safety experts have raised concerns that AI diagnostic and triage tools are often ‘black boxes’ that clinicians cannot meaningfully interrogate. The British Medical Association has separately warned about NHS data sovereignty as private AI platforms become central to how care decisions are made.

Your visa

For five years, the Home Office ran a ‘streaming algorithm’ that sorted visa applications into red, amber and green risk tiers. Nationality was a key input. The algorithm was withdrawn in August 2020, the day before a judicial review hearing brought by Foxglove and the Joint Council for the Welfare of Immigrants, who had argued it was racially discriminatory by design. The Home Office did not concede the legal point but agreed to scrap the tool and redesign the process. It remains the first UK government algorithm to be retired in response to a legal challenge.

Your face on a street

UK police forces have trialled live facial recognition technology in public spaces, scanning passers-by against watchlists in real time. In 2020 the Court of Appeal, in R (Bridges) v Chief Constable of South Wales Police, ruled that the force’s deployment of the technology was unlawful on three grounds: it breached the right to privacy under Article 8 of the European Convention on Human Rights, it breached the Data Protection Act 2018, and the force had failed in its Public Sector Equality Duty by not checking the system for racial or sex bias before deployment. Deployments have continued under revised arrangements since then. No comprehensive UK law specifically governs facial recognition.

Your A-level grades, once

In 2020, with exams cancelled by the pandemic, Ofqual used an algorithm to standardise A-level and GCSE results. The algorithm downgraded almost 40% of A-level results from teacher predictions, and the downgrades fell hardest on students at state schools and from disadvantaged areas. Independent schools saw a 4.7 percentage point rise in A and A* grades. The model was scrapped within days and teacher predictions reinstated. The episode produced one of the clearest public verdicts on algorithmic decision-making in UK history. Ofqual’s chief regulator resigned.

Why these decisions go wrong

The pattern across these cases is consistent. Bias is not a malfunction. It is what happens when a system designed to make decisions is built on data that already reflects unequal outcomes, and is then deployed without enough safeguards to catch the disparity.

There are three main reasons AI decisions go wrong, and they tend to compound.

The data is already unequal

Machine learning systems learn from historical data. If the data reflects past unequal treatment, the system learns to repeat it. A hiring tool trained on years of male-dominated promotion decisions will rate male candidates more highly, not because anyone designed it to, but because that is the pattern it found in the past. The 2020 Ofqual algorithm did not invent the gap between private and state school grades; it locked in the gap that already existed.

The system is opaque, even to its makers

Many machine learning systems, particularly newer ones built on large neural networks, produce results that cannot be fully explained even by the engineers who built them. This is not a quirk of complicated software. It is a structural property of how these systems work. When someone affected by a decision asks why, the honest answer is often that no one can give a complete one. The Information Commissioner’s Office now requires organisations to provide ‘meaningful’ explanations of automated decisions, but what counts as meaningful in practice is still being worked out.

Human review is often theoretical

UK law generally allows automated decisions provided a human can step in. In practice, this safeguard depends on the human being independent, informed and empowered to overturn the machine. The ICO’s draft 2026 guidance, published for consultation in March, is explicit that meaningful human involvement requires the reviewer to have the authority, discretion and information to change the outcome, not just endorse it. Foxglove and Big Brother Watch have pointed to the DWP fraud algorithm as a case where this principle is failing in practice: caseworkers see the algorithm’s risk score before they review the case, which shapes how they read it.

What UK law actually does, and what it does not

The UK does not have an AI Act. The Labour government signalled in 2024 that it would legislate for binding rules on the most powerful AI models, but no bill has come forward. The October 2025 Blueprint for AI Regulation reframed the approach: instead of a comprehensive AI law, the government would use existing regulators, an AI Growth Lab sandbox, and targeted reforms to existing legislation. The King’s Speech of 2026 confirmed there is no plan for standalone AI legislation in the current session. The European Union, in contrast, has a comprehensive AI Act in force.

The UK regulates AI decisions through three main legal frameworks, none of which were built for AI.

UK GDPR Article 22

Article 22 gives you the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects on you. A ‘legal effect’ means something that changes your legal position, such as eligibility for a benefit. A ‘similarly significant effect’ has comparable impact, such as a decision to offer or refuse you a job, a mortgage or a credit line. Where Article 22 applies, you have rights to information about the decision, to request human intervention, to contest the decision, and to express your point of view.

There are exceptions. A solely automated decision is allowed where it is necessary for a contract between you and the organisation, authorised by law (for example for fraud or tax purposes), or based on your explicit consent. Even then, safeguards apply.

The Data (Use and Access) Act 2025

The DUAA, most of which came into force on 5 February 2026, made the most consequential change to UK automated decision-making rules since GDPR was introduced. It narrowed the prohibition in Article 22 so that it now applies only to decisions involving special category data, such as health or race. For everything else, the rules shift from prohibition with exceptions to a right of challenge with safeguards. In plain English: it is now easier for UK organisations to use automated decisions about you than it was before February 2026. The safeguards include the right to be told a decision was automated, to make representations, to obtain human intervention and to contest the decision.

The Equality Act 2010

The Equality Act protects you from direct and indirect discrimination based on age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. It applies to algorithmic decisions even though it predates them. Most algorithmic discrimination cases are likely to arise as indirect discrimination, where a system that looks neutral disadvantages people with a protected characteristic. Public bodies also have the Public Sector Equality Duty, which the Court of Appeal used in Bridges to find against South Wales Police for deploying facial recognition without checking it for bias.

Sector-specific rules

Beyond these three frameworks, individual regulators are filling gaps with sector-specific guidance. The ICO is developing a statutory code of practice on AI and automated decisions under the DUAA. The Financial Conduct Authority has guidance for financial services. The MHRA is reviewing healthcare. The Equality and Human Rights Commission has published reports on AI and discrimination. None of these has the force of a single comprehensive AI law.

A note on balance

AI in decision-making is a genuinely contested policy question. The argument is not whether AI works, but what its costs and benefits are, and who carries them. The strongest cases on each side are below.

The case for using AI in decisions

Public services are stretched. NHS waiting lists stand at over seven million cases. The DWP processes millions of benefit claims a year. Police forces face rising demand with falling budgets. Automated systems can process information faster than humans, find patterns humans miss, and free skilled staff to focus on cases that need a person. Used carefully, AI can reduce average decision times, expand the reach of underfunded services and surface bias that human decision-making was already producing invisibly. Research from the Alan Turing Institute and others supports the principle that algorithmic systems, properly audited, can produce more consistent outcomes than discretionary human judgement.

The case against the current model

The case against is not that AI cannot help. It is that the safeguards currently in place are not strong enough to catch what is going wrong. Every documented UK case so far has confirmed bias or unlawfulness. The DWP fraud algorithm, the Ofqual A-level model, the Home Office visa tool and police facial recognition have all been retired, ruled unlawful or shown to be biased by their operators’ own assessments. The Data (Use and Access) Act 2025 has weakened the central legal protection in Article 22 at exactly the moment AI is becoming more pervasive. The burden of identifying and challenging unfair decisions sits almost entirely with the affected person, who often has no idea an algorithm was involved.

The evidence weight on bias and harm is strong and consistent. The evidence on properly safeguarded benefits is more mixed. The reasonable position is that AI in decisions is here to stay, but the current safeguards do not match the stakes for the people affected.

What this means in your workplace

The workplace is where most people will first encounter AI deciding about them in 2026. The House of Commons Business and Trade Committee opened an inquiry into AI, business and the future of the workforce in early 2026. Evidence closed on 3 April. A report is expected later in the year. The inquiry’s premise is that AI has rapidly become embedded in UK workplaces, in recruitment, performance management and day-to-day decision-making, and that current workplace protections may not be sufficient.

Algorithmic management is the umbrella term for systems that schedule shifts, allocate tasks, monitor productivity, rate performance and recommend who gets promoted, kept on or let go. The Trades Union Congress has called for a Workplace AI Act with three pillars: Workplace Impact Assessments before deployment, a guaranteed right to human review of significant decisions, and consultation with affected workers and their representatives. The TUC’s draft bill has not been adopted by the government but has shaped much of the public conversation about worker AI rights.

If your employer uses AI to make or shape significant decisions about you, you have rights now under existing law:

You can ask your employer to confirm whether AI is being used in decisions about you, and what data feeds it. UK GDPR gives you a subject access right that includes ‘meaningful information about the logic involved’ in automated processing.
You can request human review of any significant automated decision. The DUAA preserved this right as part of the new safeguards.
You can raise an Equality Act claim if you believe the AI decision discriminated against you on a protected characteristic. The employer carries liability even if a third-party vendor built the tool.
You can raise concerns through your trade union or staff representative. The TUC, Prospect, Unite, USDAW and others are now equipped to advise on AI-related workplace issues.

Your rights when an algorithm decides about you

The legal position in May 2026 is more complicated than it was a year ago, because of the DUAA changes. The practical answer is that you still have specific rights, but you have to use them.

Right	What it does	Where it comes from
Right to know a decision was automated	If a significant decision was made by AI, the organisation must tell you that it was automated, what the logic was in plain language, and what the consequences are.	UK GDPR, DUAA 2025 safeguards
Right to human intervention	You can ask for a human, with the authority to change the outcome, to review the decision. The ICO’s 2026 draft guidance is explicit that this human cannot just rubber-stamp.	UK GDPR Article 22, DUAA safeguards
Right to contest the decision	You can make representations explaining why you believe the decision is wrong, and the organisation must consider them.	UK GDPR, DUAA safeguards
Right to see your data	A subject access request gives you a copy of the personal data the organisation holds about you, including data feeding into automated decisions.	UK GDPR
Right not to be discriminated against	If a decision treats you worse because of a protected characteristic, even via an algorithm, you can bring an Equality Act claim.	Equality Act 2010
Right to complain to the regulator	If you believe an organisation has breached data protection law in an automated decision, you can complain to the Information Commissioner’s Office.	UK GDPR, Data Protection Act 2018

The accountability gap

The most pressing ethics issue is not any one biased system. It is the gap between the speed at which AI is being deployed and the speed at which accountability is catching up. There are four parts to the gap.

First, AI systems are not legal persons. They cannot be sued. Liability still attaches to the organisation that uses them, but that organisation can be slow to admit that the algorithm was the deciding factor.

Second, automated decisions are often described by the organisation deploying them as ‘decision support’ for a human, not solely automated decisions. This wording matters because Article 22 only triggers full protections for decisions that are solely automated. The closer a system gets to deciding without human involvement, the higher the legal threshold, so organisations have an incentive to keep a human in the loop in name even where the human is rubber-stamping the result.

Third, the burden of challenge sits with the affected person. You have to suspect an algorithm was used. You have to know the right questions to ask. You have to make a subject access request, or file a complaint, or instruct a lawyer. The organisation that built and deployed the system has no obligation to come and find you.

Fourth, the regulators are not yet structured for this. The ICO is the closest thing the UK has to a national AI regulator and is now developing a statutory code of practice. The Equality and Human Rights Commission, the FCA, the MHRA, Ofcom and others each cover a slice. No single body has end-to-end responsibility for AI in decisions, and the resources allocated to enforcement are modest compared with the scale of deployment.

Closing this gap is the central policy question of the next few years. The TUC’s draft AI Bill, the House of Commons inquiry, the ICO consultation and the MHRA review are all pointed at parts of it. Whether they add up to a coherent framework before the next major incident is the open question.

If a decision feels wrong: practical steps

If you suspect an AI decision has gone wrong for you, there is a sequence of free steps you can take. None of them requires a lawyer, though free legal advice is available if you need it.

Ask, in writing, whether the decision was automated

Email the organisation. Ask whether the decision was made or significantly shaped by an automated system, what data was used, and what the logic was in plain English. UK GDPR requires them to tell you.

Request human review of the decision

State clearly that you are exercising your right under UK GDPR to obtain human intervention. The reviewer must be someone with the authority and information to change the outcome, not just confirm it.

Make a subject access request

Ask for a copy of all personal data the organisation holds about you, including data that fed into the decision. The organisation has one month to respond. This is free.

Put your case in writing

Explain in clear language why you believe the decision is wrong. Include the facts the algorithm may have missed or got wrong. Keep a copy of everything.

Complain to the Information Commissioner’s Office

If the organisation does not respond, refuses to explain, or appears to have breached your rights, complain to the ICO. This is free. The ICO can investigate and require the organisation to change its practice.

Consider an Equality Act claim

If you believe the decision treated you worse because of a protected characteristic (age, race, disability, sex and so on), this is a potential discrimination claim. Citizens Advice, Equality Advisory and Support Service, Liberty and the EHRC can advise.

Get free legal advice

Foxglove and Liberty take strategic cases on algorithmic decision-making. Citizens Advice provides general legal information. Law Centres offer free legal advice to people on low incomes. None of these requires you to pay.

Free support organisations

Organisation	What they offer	Contact
Information Commissioner’s Office (ICO)	UK data protection regulator. Handles complaints about automated decisions, subject access refusals and data protection breaches. Free.	0303 123 1113. ico.org.uk
Citizens Advice	Free, confidential advice on consumer, benefits, employment, housing and legal issues. Local offices and national phone line.	0800 144 8848. citizensadvice.org.uk
Foxglove	UK non-profit law firm that takes strategic cases on algorithmic and government technology decisions. Forced the Home Office to scrap the visa streaming algorithm and the DWP to publish its fraud algorithm details.	foxglove.org.uk
Liberty	UK civil liberties organisation. Brought the Bridges case on police facial recognition. Information and casework on rights including automated decisions.	libertyhumanrights.org.uk
Equality Advisory and Support Service	Free advice on equality, human rights and discrimination, including algorithmic and AI-related discrimination.	0808 800 0082. equalityadvisoryservice.com
Equality and Human Rights Commission	Statutory body that monitors and enforces equality law. Published research on AI and discrimination. Casework support for strategic claims.	equalityhumanrights.com
Big Brother Watch	UK civil liberties campaign group focused on technology and surveillance. Active on facial recognition, predictive policing and benefits algorithms.	bigbrotherwatch.org.uk
TUC and your trade union	For workplace AI issues. The TUC has published model AI workplace rules and supports affiliated unions on algorithmic management cases.	tuc.org.uk
Law Centres Network	Free specialist legal advice in England, Wales and Northern Ireland for people on low incomes. Some Law Centres now handle algorithmic decision cases.	lawcentres.org.uk

The bottom line

AI is already deciding about you, or shaping the decisions that are. It is in your benefits process, your job application, your hospital triage, your visa, your credit score and where the police look. The UK has no dedicated AI law and is not currently planning one. The central legal protection in Article 22 has been weakened by the Data (Use and Access) Act 2025. Every documented UK case to date has confirmed bias or unlawfulness in the system being used.

That is the uncomfortable part. The freeing part is that you are not powerless. You have rights you can use today: to know, to contest, to see your data, to get a human review, to complain, to bring a discrimination claim. Free help is available from regulators, advice services, civil liberties organisations and trade unions. None of these requires a lawyer. None of them requires you to fully understand the algorithm. The system is not designed to catch its own mistakes. It is designed to be challenged. The most important thing you can do is to challenge it when something feels wrong.

Sources used in this guide

Department for Work and Pensions, Universal Credit Advances Model Fairness Assessment. Published 17 July 2025. Primary source for confirmed bias by age, disability, marital status and nationality in the DWP fraud-detection algorithm.

House of Commons Library, AI Regulation in the UK. Briefing CBP-10003, updated 2026. Primary source for UK regulatory approach and the absence of standalone AI legislation.

Data (Use and Access) Act 2025, Section 80. UK Public General Acts. Primary source for the amendments to UK GDPR Article 22 and the new safeguards regime, in force from 5 February 2026.

Information Commissioner’s Office. Consultation on draft guidance on automated decision-making and profiling, launched 31 March 2026, closes 29 May 2026. Source for ICO position on meaningful human involvement and recruitment automated decision-making expectations.

UK GDPR Article 22. Right not to be subject to solely automated decision-making with legal or similarly significant effects. Primary source for the underlying right.

Equality Act 2010. Source for the nine protected characteristics, direct and indirect discrimination provisions, and the Public Sector Equality Duty applied to AI decisions.

R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058. Court of Appeal judgment of 11 August 2020. Source for the three grounds on which live facial recognition deployment was found unlawful.

Ofqual and the 2020 A-level grading algorithm. University of Bristol Centre for Multilevel Modelling secondary data analysis, and Department for Education statements August 2020. Source for the 40% downgrade figure and the differential effect by school type.

Home Office visa streaming algorithm. Joint Council for the Welfare of Immigrants and Foxglove legal challenge, August 2020. Source for the withdrawal of the algorithm and the design issues with nationality as an input.

House of Commons Business and Trade Committee. Inquiry on Artificial Intelligence, business and the future of the workforce, opened 2026, evidence closed 3 April 2026. Source for the inquiry’s scope and timeline.

Trades Union Congress, Building a Pro-Worker AI Innovation Strategy. Published August 2025, with draft AI Bill. Source for the union position on workplace AI rights and Workplace Impact Assessments.

House of Lords Library, AI in the NHS. Briefing 2026. Source for NHS adoption rate and the MHRA national commission timetable.

Foxglove. Casework and reporting on the DWP fraud algorithm and Home Office visa algorithm. Source for civil society analysis of UK government algorithmic decision-making.

Published by The Knowledge Loop Company | www.theknowledgeloop.com

Download PDF

Disclaimer:

The content published on this site is for general information purposes only. It does not constitute legal, financial, medical or professional advice of any kind. Nothing on this site should be relied upon as a substitute for advice from a qualified professional. If you need advice specific to your situation, please contact a solicitor, financial adviser, or other relevant professional. All free support organisations referenced in our guides are independent of The Knowledge Loop Company.