Standard / soft law
Solely-automated AI decisions require contest, human review, explanation, and a DPIA (UK ICO)
Per the UK ICO's guidance applying UK GDPR Article 22 to AI, where an AI system makes solely-automated decisions with legal or similarly significant effects, the controller must give individuals information about the processing, provide simple ways to request human intervention or challenge the decision, give an explanation of the decision after it is made, and — because such processing is high-risk — carry out a Data Protection Impact Assessment (DPIA). The ICO is a horizontal regulator; the UK governs AI ADM through data-protection law rather than a dedicated AI Act. Detect a solely-automated AI significant-decision path with no human-review/contest affordance, explanation capability, or DPIA.
uk-ico-ai.ai-adm-safeguards-dpia · ICO UK GDPR guidance — Rights related to automated decision-making including profiling (Article 22) · official source · jurisdictions: GB