Where a Person Has to Be In It

Last week I went looking for a rule that says a human must make the decision, and could not find one in the FCA Handbook.

There is one. It is not the FCA's, it has been in force since February, and it is narrower and sharper than the thing people say.

What changed, and when

Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR. In its place sit four new articles, 22A to 22D. The replacement came fully into force on 5 February 2026, by regulation 2(j) of S.I. 2026/82.

If you learned the old Article 22 at some point in the last eight years, the thing you learned has gone.

The dividing line is a person

Article 22A does not impose a duty. It supplies two definitions that the articles after it use.

"a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision"

"a decision is a significant decision, in relation to a data subject, if— (i) it produces a legal effect for the data subject, or (ii) it has a similarly significant effect for the data subject"

Read the first one twice. The presence of a person is not a requirement here. It is the test for whether the decision counts as automated at all. A decision with meaningful human involvement in it is simply not a solely automated decision, and the rules that follow do not reach it.

The article adds one instruction about how to judge that:

"When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling."

What is actually restricted

Article 22B is the restriction, and it is far narrower than "you cannot automate decisions".

"A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met."

Article 9(1) is the special category list. It covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, sex life and sexual orientation, and it covers "data concerning health".

Protection advice runs on health.

The two conditions are worth reading closely, because the second one is routinely quoted at half its length. The first is explicit consent. The second is this:

"The second condition is that— (a) the decision is— (i) necessary for entering into, or performing, a contract between the data subject and a controller, or (ii) required or authorised by law, and (b) point (g) of Article 9(2) applies."

Limb (a) and limb (b). Not one of them. And limb (b), Article 9(2)(g), is the substantial public interest condition: processing "necessary for reasons of substantial public interest, on the basis of domestic law or relevant international law". An account of this rule that stops at "necessary for the contract" has dropped the half that does the work.

There is a fourth paragraph to Article 22B, which I am leaving aside rather than passing over. It bars a solely automated significant decision where the processing relies on the recognised legitimate interests basis in Article 6(1)(ea). The conditions for that basis are set out in Annex 1 and they are national security, emergencies, crime, safeguarding vulnerable people and the like. None of them describes a firm advising a client on a policy, so it is not the paragraph that would bite here.

Who owes the safeguards

Where a significant decision is solely automated, Article 22C requires safeguards. It is precise about whose job that is.

"Where a significant decision taken by or on behalf of a controller in relation to a data subject is— (a) based entirely or partly on personal data, and (b) based solely on automated processing, the controller must ensure that safeguards for the data subject's rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(3)."

The controller. Not the software vendor, not the model provider, and not whoever built the thing. And note "taken by or on behalf of a controller", which reaches a decision somebody else makes for you.

The safeguards themselves are four:

"(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject; (b) enable the data subject to make representations about such decisions; (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions."

Whether any particular firm is the controller for any particular decision is a question about who determines the purposes and means of the processing. It is not a question this piece can answer for you, and anyone who answers it for you without asking what you actually do is guessing.

So what does "meaningful" mean

This is the part everything turns on, and the honest answer is that it is still being decided.

Parliament saw the problem coming. Article 22D gives the Secretary of State power to make regulations providing "that, for the purposes of Article 22A(1)(a), there is, or is not, to be taken to be meaningful human involvement in the taking of a decision in cases described in the regulations". It gives a second power to define what has a similarly significant effect, and a third to add to the safeguards.

As at September 2026 I can find no regulations made under any of them.

What exists instead is the regulator's view. Guidance is not law, and what follows is neither final nor binding, but the ICO has been specific. Its guidance on automated decision-making was updated on 31 March 2026 to reflect the Act, and it says involvement must be "active and not just a token gesture". It then sets out what a human should do:

"assess and review the decision at an appropriate point to ensure actual impact on the outcome; have the ability to influence the outcome; have discretion and authority to alter the decision; be suitably trained and qualified to understand the system's logic, outputs, limitations, and risks; and take into account the relevant data and factors on which the decision was based."

It adds that "ad hoc spot-checking isn't sufficient", and that the involvement has to come "before you apply the decision to a person and at a time you can still change any recommendation".

And it closes a door that is tempting to walk through:

"A human merely designing or building an automated system does not count as meaningful human involvement."

That is the clearest statement I have found about what the phrase means. It is also a consultation draft. The consultation opened on 31 March 2026 and closed on 29 May. The ICO's own pipeline says the final version is due in Winter 2026.

Two pages, two answers

There is one more thing, and it is the reason I would not take a quick look at a guidance page as settling this.

The ICO's updated draft is live. So is its older "in brief" guidance on the same subject, which still describes the regime the Act replaced. That older page says "For something to be solely automated there must be no human involvement in the decision-making process", with no mention of meaningfulness. On special category data it gives the old test, explicit consent or substantial public interest, rather than the Article 22B conditions.

The regulator's own site currently answers this question two different ways depending on which page you land on. The ICO has said it will update the older material in due course.

What this changes

Last week's answer stands. No FCA rule requires a person to make an advice decision, and what the Handbook fixes is who answers for the outcome.

This is a different rulebook asking a different question, and it reaches a narrower set of decisions: significant ones, involving special category data, taken without meaningful human involvement. Most of what a firm does in a day is nowhere near it.

But where it does reach, it is not a rule about accountability at all. It is a rule about whether a person was actually in it, and it is the first thing I have read on this subject that cares what the person actually did rather than what their job title was.

The test for that is currently a draft.