Can AI make automated decisions that affect people?

Answered

Yes, but with legal limits. Article 22 restricts solely automated decisions with legal or similarly significant effects. The Cabinet Office ADM ethics framework covers both solely automated and AI-assisted decisions and should be applied in full for best practice. Significant automated decisions should get ministerial agreement, with a senior owner for major processes. Do not treat ADM as a fix-all for complex policy problems.

From the guidance

Primary (how) ICO: Article 22 of the UK GDPR and fairness

You can only carry out this type of decision-making where the decision is: necessary for the entry into or performance of a contract; authorised by law that applies to you; or based on the individual’s explicit consent.

Secondary (normative) ICO: Article 22 of the UK GDPR and fairness

You therefore have to identify if your processing falls under Article 22 and, where it does, make sure that you: give individuals information about the processing; introduce simple ways for them to request human intervention or challenge a decision; and carry out regular checks to make sure your systems are working as intended.

Secondary (normative) Data and AI Ethics Framework

Avoid fully automated decisions where the outcome could significantly affect individuals or groups, and making sure a person makes the final decision in these cases.

Secondary (normative) AI Playbook for the UK Government

Article 22 currently prohibits decision(s) based solely on automated processing that have legal or similarly significant consequences for individuals. Services using AI that affect a person’s legal status or their legal rights must only use AI to support decisions that must be made by a human decision maker.

Secondary (normative) Ethics, Transparency and Accountability Framework for Automated Decision-Making

Automated decision-making refers to both solely automated decisions (no human judgement) and automated assisted decision-making (assisting human judgement). There are some different legal requirements for the two forms of automated decision-making. This framework should be applied in its entirety for both forms to ensure best practice.

Related questions