FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Data protection consultants
Consultants advising on automated decision-making must decide whether a client's system makes solely automated significant decisions under Article 22A and, if so, design the Article 22C safeguards. Getting the classification wrong can expose the client to ICO action and the adviser to a claim.
Part of: AI in Data protection consultants
In short
Since 5 February 2026, section 80 of the DUAA has replaced the old Article 22 with Articles 22A to 22D. A decision is solely automated if there is no meaningful human involvement, and it is significant if it has a legal or similarly significant effect. Lawful bases for such decisions are wider than before, but not for special category data, and recognised legitimate interests cannot be relied on. Where the rules apply, Article 22C safeguards are mandatory. The ICO's draft ADM guidance stresses that human review must be meaningful. A wrong classification can be a source of negligence claims against advisers.
The usual question is simple: "Does our system make automated decisions, and what do we have to do?" The systems vary: credit and affordability scoring, tenant referencing, insurance pricing, fraud flags, recruitment sifts, benefit eligibility checks and performance scoring. Some clients may believe a human "signs off" the output and assume the rules do not apply. The consultant's job is to test that belief against how the process actually runs.
The ICO's draft ADM guidance, consulted on from 31 March to 29 May 2026, says human review must be meaningful and that recognised legitimate interest cannot be used for ADM.
Classification turns on facts, not labels. Useful questions: who reviews the output, with what information and authority; how often reviewers depart from the system's recommendation; whether they have time to consider each case; and whether the system's output is effectively decisive because nobody can see its reasoning. A reviewer who approves hundreds of cases an hour is unlikely to amount to meaningful involvement. The ICO's Recruitment rewired findings in March 2026 suggest solely automated hiring decisions are likely widespread, with weaker safeguards than the law requires. Recruitment is a common setting for this advice; see auditing AI recruitment tools.
Illustrative scenario: a consultant advises a lettings business that its AI tenant scoring tool does not make solely automated decisions because a negotiator reviews each result. In practice, negotiators accept every rejection without looking at the file. A rejected applicant complains, the ICO makes enquiries and the business has to rebuild its process, add the Article 22C safeguards and deal with complaints. It then alleges the consultant's advice was negligent.
Advice on whether a system falls within Article 22A is professional advice, and PI usually responds to claims that it was negligent, subject to the wording. The difficulty is that the law is new and the ICO's guidance is still draft, so the defence will rely on whether the advice was reasonable on what was known at the time. Dated notes help. Any fine on the client raises separate questions; see does PI cover AI compliance advice errors? More on algorithmic decisions and PI.
Apex arranges PI for data protection consultants. A broker can review how your policy treats ADM classification advice and DPO opinions; see the data protection consultants' AI hub.
When there is no meaningful human involvement in taking it. A human who routinely accepts the system's output without real consideration, information or authority to change it is unlikely to count. The extent to which profiling is involved must also be considered.
No. Article 22B prevents a solely automated significant decision from relying on recognised legitimate interests, and the ICO's draft ADM guidance makes the same point. Other lawful bases may be available, subject to the special category restrictions.
Measures that let the individual receive information about the significant decision, make representations, obtain human intervention and contest the decision. They need to work in practice, not only appear in a policy.
Not as at 27 October 2026. The consultation on the draft ran from 31 March to 29 May 2026. Advice should say that it relies on draft guidance and be reviewed when the final version and the planned statutory code are published.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
