Meaningful human involvement

Meaningful human involvement is the test UK data protection law now uses to decide whether a significant decision about a person was taken by a machine. If no human was meaningfully involved, the decision counts as "based solely on automated processing" and strict rules apply. The test came in with the Data (Use and Access) Act 2025, which replaced the old Article 22 of UK GDPR with new Articles 22A to 22D, in force from 5 February 2026. The regulator has set out its view of what "meaningful" means: the person must have the authority, the discretion and the competence to change the outcome, and their involvement must be more than a rubber stamp. That last word, competence, turns a governance question into a capability question.

What the law says#

Section 80 of the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, inserted four new articles into UK GDPR. They were brought fully into force on 5 February 2026.

Article 22A sets the definitions. A decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision". A significant decision is one that produces a legal effect for a person or "a similarly significant effect". And when deciding whether involvement was meaningful, "a person must consider, among other things, the extent to which the decision is reached by means of profiling".

Article 22B restricts solely automated significant decisions that rely on special category data, such as health or ethnicity, to narrow conditions including explicit consent. Article 22C requires safeguards for every solely automated significant decision: the person must be told about it, be able to make representations, be able to obtain human intervention, and be able to contest it. Article 22D lets the government define meaningful involvement further by regulations; I have found none made so far.

The change loosened the law in one direction and tightened it in another. The old Article 22 was framed as a right not to be subject to such decisions. The new regime permits more automated decision-making outside special category data, provided the safeguards are in place. But the definition now turns on a single phrase, and an organisation that relies on a human reviewer to keep a decision outside the rules has to show the reviewer was meaningful.

What the regulator says "meaningful" means#

The phrase did not start with the 2025 Act. The European data protection regulators' guidance on the original GDPR, written in 2017, warned that a controller "cannot avoid the Article 22 provisions by fabricating human involvement", and that oversight had to be meaningful "rather than just a token gesture", carried out by someone with "the authority and competence to change the decision".

The Information Commissioner's Office applied the test to hiring in Recruitment rewired, published on 31 March 2026 after engagement with more than 30 employers. Its page on meaningful human involvement sets out the tests. The human must have "the authority, discretion and competence to alter" the decision and be able to "exercise real influence" before it is applied. Involvement "must be active and not just a token gesture or 'rubber stamp'". It must be "applied to every candidate, not just those who score highly". And human design of the scoring model "alone is not enough".

The ICO found employers using tools to make solely automated decisions with no meaningful human involvement, and said it "frequently saw evidence" that lower-scoring candidates were rarely reviewed by anyone. Where the human looks only at the people the machine has already approved, every rejection would, on the ICO's reading, be solely automated.

The ICO consulted on updated guidance on automated decision-making between 31 March and 29 May 2026. At the time of writing I have not found the final version, so check the ICO's site before relying on the draft.

How it differs from human in the loop and human oversight#

Three phrases are often used as if they meant the same thing. They do not.

Human in the loop describes where a person sits in a process. It says nothing about what they can do there. The weakest version, a person approving output at the end, is the design the evidence rates lowest; see human in the loop is not a safeguard.

Meaningful human oversight is the EU AI Act's standard for high-risk systems. Article 14 requires that the people overseeing a system can "properly understand the relevant capacities and limitations", "remain aware of the possible tendency of automatically relying or over-relying on the output", correctly interpret it, decide not to use it, override it, and interrupt it through a "stop" button. The EU's Digital Omnibus on AI, in force since 27 July 2026, moved the obligations for the high-risk systems that include employment uses to 2 December 2027 rather than August 2026, according to law firms including Orrick and Lewis Silkin. See what is meaningful human oversight.

Meaningful human involvement is narrower and more concrete. It is the UK test of whether a particular decision about a particular person was automated, and it applies now, to any organisation processing personal data in the UK, whatever technology it uses. See also human in command, the European principle that a person must keep authority over the system as a whole.

The evidence that review becomes rubber-stamping#

The law assumes a reviewer can resist a machine's recommendation. The research suggests that is hard. Ben Green reviewed 41 policies requiring human oversight of government algorithms and concluded that "people are unable to perform the desired oversight functions", and that such policies can "legitimize government uses of faulty and controversial algorithms" (Computer Law and Security Review, 2022). In an earlier experiment with 554 participants, Green and Yiling Chen found that only 23.7 per cent of those given a risk assessment outperformed it, and that they could not judge the accuracy of either their own predictions or the tool's.

Courts have started to look through token review. In April 2023 the Amsterdam Court of Appeal, in cases brought by drivers against Uber and Ola, found that the human checks the companies relied on were little more than symbolic, so the decisions were solely automated. In the UK, three make-up artists dismissed after an algorithm scored their video interviews settled with Estée Lauder out of court in 2022, as Cosmetics Business reported. I have found no UK tribunal judgment or ICO enforcement on the new test yet.

Why competence is the hard part#

Authority and discretion are matters of process. An organisation can grant them by writing a policy. Competence cannot be granted. A reviewer has it or does not, and it decays when the reviewer stops doing the underlying work.

The legal test and my own argument meet here. If a hiring manager has spent two years approving a ranked shortlist, can they still judge a candidate the system scored low? If a claims handler has stopped assessing claims from scratch, can they overrule the model? The law now asks that question about every significant decision, and the answer depends on whether the organisation kept people doing the work. Capability decay is no longer only a management problem; it is a compliance exposure. See capability debt and who supervises work they cannot do. In drift versus design terms, meaningful involvement has to be designed in, because it does not survive drift. The wider position of this research applies directly: the risk that can be measured sits in handing decisions to machines and what happens to human judgement afterwards, and what an organisation controls is which decisions a machine may make, who can stop each one, what people must remain able to do, and how anyone would know if it went wrong.

Questions for a board or leadership team#

Which significant decisions about people does any system we use shape, and do we have a list? For each, who is the human, and could they explain why they would overturn the output? Do they review every case, or only the ones the system passes? How often do they disagree with it, and is that rate ever above zero? What do they still do by hand often enough to stay competent? And if the ICO asked tomorrow, what would show their involvement was more than a click?

What this does not show#

This page describes the law and the regulator's published position; it is not legal advice. The ICO's final guidance on automated decision-making had not been published when this was written, and no regulations have been made under Article 22D, so the boundaries of "meaningful" will be settled by guidance and cases still to come. The Amsterdam and Estée Lauder matters were decided or settled under the old rules, and I have relied on reports of them rather than the judgments. The new EU AI Act dates are taken from legal commentary rather than the amending text. And the research on rubber-stamping comes mostly from experiments with lay participants and from government settings, not from UK employers.