‘Meaningful human review’: what the law actually requires

A large share of the new UK automated decision-making regime rests on one phrase: meaningful human review. Get this right, and a significant solely automated decision can lawfully proceed. Get it wrong, and the safeguard an organisation believed it had turns out not to exist. This piece looks only at what the requirement means in general — not at how any particular sector should apply it.

The rubber-stamp problem

Articles 22A to 22D of the UK GDPR (inserted by section 80 of the Data (Use and Access) Act 2025, in force since 5 February 2026) permit significant solely automated decisions provided a human review is available and capable of changing the outcome. The word doing the work is "capable." A reviewer who sees an automated recommendation and signs off on it without genuine authority, time, or information to reach a different conclusion has not provided meaningful review — they have provided a signature. Regulators elsewhere in UK data protection practice have long treated this kind of token oversight as equivalent to no oversight at all, and the ICO's draft ADM and profiling guidance, consulted on until 29 May 2026, takes the same approach.

What tends to make review genuine

Three features recur in analyses of what makes a human review real rather than nominal: the reviewer has to see the underlying basis for the automated output, not just its conclusion; the reviewer has to have a documented route to overturn it, used in practice and not merely available in theory; and the review has to happen before the decision takes effect, not as a retrospective audit. A process that technically includes a human somewhere in the chain, but where that person has no practical ability to change what happens, does not meet the standard — regardless of how the process is described internally.

This is general awareness content, not legal advice, and does not cover the specific circumstances of any organisation or sector.