Aipedia: Occupational health providers

Automated decisions on workers' health under the DUAA

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Since 5 February 2026, significant decisions about workers made solely by automated processing of health data need explicit consent, or a contract or legal requirement plus Article 9(2)(g), with safeguards. OH providers and employer clients both need to know who is making the decision.

Part of: AI in occupational health providers

In short

Section 80 of the Data (Use and Access) Act 2025 replaced the old UK GDPR Article 22 with Articles 22A to 22D, fully in force from 5 February 2026. For special category data such as health, a significant decision based solely on automated processing needs the worker's explicit consent, or a contract or legal requirement plus the substantial public interest condition in Article 9(2)(g). Article 22C safeguards include information, representations, human intervention and the right to contest. Fitness-for-work and health surveillance decisions are squarely in scope. Contracts between OH providers and employers should allocate responsibility.

What changed on 5 February 2026

Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D into the UK GDPR. The new rules relax the position for many automated decisions, but keep tighter limits where special category data is involved. The ICO's workers' health guidance predates the change: it says workers' health information should not be used in solely automated decisions without explicit consent or substantial public interest, with human intervention, a right to challenge and a DPIA. That guidance is under review because of the DUAA.

What the rules require for health data

Scope: a decision based solely on automated processing that has legal or similarly significant effects on the worker.
Conditions: where special category data is used, explicit consent, or the decision is necessary for a contract or required by law and Article 9(2)(g) (substantial public interest) applies.
Safeguards (Article 22C): information about the decision, the ability to make representations, human intervention and the right to contest.

In employment, the ICO notes that consent is often not valid because of the power imbalance, so relying on explicit consent for automated health decisions is fragile. In practice, the simplest route is to make sure a clinician genuinely reviews each significant decision, so it is not solely automated.

Where OH work is in scope

Fitness-for-work outcomes, pre-placement verdicts, health surveillance categorisations, safety-critical clearances and ill-health retirement recommendations can all have significant effects on a worker's job or pay. If an AI tool makes any of these without meaningful human involvement, Articles 22A to 22D apply. Human review must be real: a clinician who signs batches of outcomes without looking at them may not take the process outside "solely automated". Triage and analytics can also be in scope where they lead directly to decisions about individuals.

Illustrative scenario

Illustrative: an employer uses an OH provider's platform to issue automated fit or unfit outcomes for seasonal staff, with a clinician reviewing only appeals. A worker marked unfit loses a job offer and asks how the decision was made. The employer cannot explain and says the OH provider runs the tool; the provider says the employer chose to switch off clinician review. The worker complains to the ICO and brings a claim. The contract does not say who is the controller for the decision or who must provide the safeguards.

Had a clinician reviewed each unfit outcome, or had the contract set out which party provided information, representations and human intervention, the worker would have had a clear route to challenge and both parties a clearer position.

Contract terms that allocate responsibility

State whether any outcome is generated without clinician review, and for which decisions.
Set out each party's role as controller or processor for each processing activity.
Allocate who provides information to workers and handles representations and challenges.
Prevent the employer from treating a provisional or automated outcome as final.
Require a DPIA and share relevant findings.
Deal with liability and indemnities between the parties, and with supplier tools.

What it means for PI

Data protection claims and regulatory action may be excluded or limited under professional indemnity, and NHS indemnity schemes exclude data protection breaches. One medical defence organisation's published position limits help to cases where a human is the decision maker and excludes autonomous systems. Keeping a clinician in the loop therefore helps with both the law and indemnity. Check how your PI and cyber policies treat data protection claims. See does OH indemnity cover AI mistakes, AI pre-placement questionnaires, AI in health surveillance, advising on automated decisions, special category data and the occupational health AI hub.

How Apex helps

Apex arranges PI for occupational health providers. A broker reviews how your policy treats data protection claims and automated outcomes, and whether separate cyber cover is needed; see OH professional indemnity.

Sources

Frequently asked

When do Articles 22A to 22D apply to OH?

When a decision with legal or similarly significant effects on a worker is based solely on automated processing. Fitness-for-work, pre-placement, surveillance and safety-critical outcomes can all qualify if no clinician meaningfully reviews them.

Can we rely on the worker's explicit consent?

It is possible but fragile. The ICO says consent is often not valid in employment because of the power imbalance. The alternative is a contract or legal requirement plus Article 9(2)(g), or ensuring genuine human review so the decision is not solely automated.

Does a clinician sign-off make the decision not solely automated?

Only if the review is real. A clinician who considers the evidence and can change the outcome provides meaningful involvement. Bulk approval without looking at each case may not take the decision outside the rules.

Who is responsible: the OH provider or the employer?

It depends on who decides the purposes and means of each processing activity. Contracts should set out controller and processor roles, who provides the Article 22C safeguards and how liability is shared.

Check your indemnity covers how you use AI

Tell us about your practice and the work you do. A broker will review how your current cover treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start an indemnity quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.