Automated Decision-Making

The legal focus is on decisions that are solely automated and have legal or similarly significant effects. An online lender that approves or rejects applications instantly with no human looking at them is doing ADM. A model that drafts a recommendation that a loan officer genuinely reviews, and can override, is usually treated differently, though a rubber-stamp review does not count as meaningful human involvement. ADM is also distinct from profiling, which the ICO describes as analyzing, evaluating or predicting aspects of a person such as their behavior, interests or habits. ADM often involves profiling, and profiling can feed a decision, but the two are not the same thing.

“Right to explanation” is popular shorthand rather than a single clause in the law. Under the UK GDPR, as the Information Commissioner’s Office explains in guidance updated for the Data (Use and Access) Act 2025, the safeguards for significant solely automated decisions include giving people information about the decision, letting them make representations, obtaining human intervention and contesting the decision. The EU GDPR contains comparable rules for automated decisions. In practice, the “explanation” a person is owed is about the main factors and how to challenge the outcome, not the model’s weights.

Why it matters: if your product decides about individuals, you need an audit trail that can reconstruct each decision, an escalation path to a person, and explainability good enough to give a reason a non-expert can act on. Under the EU AI Act, many of these uses are also high-risk AI systems. Editorially, these rights are one of the oldest and most concrete forms of algorithmic accountability.