What is it?

The report: ‘Humans in the Lead: data protection law and the current legal landscape in respect of human oversight into automated decision-making (ADM),’ acts as a general guide to navigating the complex legal frameworks surrounding automated systems. Created in partnership with Shoosmiths, the paper details how the UK GDPR and the Data Protection Act 2018 govern the use of personal data in automated decisions, particularly those that are ‘solely automated’ and produce legal or significant effects on individuals.

Crucially, the report outlines the upcoming changes being phased in by the Data (Use and Access) Act 2025 (DUAA), which will relax some existing restrictions and allow for fully automated decision-making for important public interest tasks. It explains how human review functions both as a compliance task and a metric for determining if a decision is ‘solely automated’. The paper also outlines the ongoing protections surrounding special category data, children, and vulnerable groups, warning that human intervention must always be ‘meaningful’ rather than just a token gesture.

Why did we create it?

Many local councils are increasingly considering the use of Artificial Intelligence (AI) and Automated Decision-Making (ADM) to reduce costs and streamline service delivery by handing certain decisions over to computers. At the same time, the legal landscape is shifting; upcoming legislative changes will make it easier to use ADM in a wider range of cases.

Despite the new legal freedoms, councils will still be required to provide clear, intelligible explanations of the logic behind automated decisions, which could prove to be a significant barrier to widespread adoption. This paper was written to assist boroughs through these complexities, ensuring they understand the necessity of competent, timely, and meaningful human review.

How does this fit with previous work LOTI has done on the subject?

This report directly builds on LOTI’s ongoing advocacy for responsible technology deployment, specifically its deliberate shift from the phrase ‘humans in the loop’ to ‘humans in the lead’. LOTI has consistently argued that, looking beyond strict legal requirements, human beings should always maintain significant control over automated processes. It is a core LOTI principle that there must always be a human able to control the process, explain why specific things happened, and respond directly to residents when a decision is made using these methods. This paper formalises that ethos, providing the legal context to support LOTI’s vision of human-centric public services.

Who should use it?

This paper and its accompanying primer are intended to be used as foundational texts for internal discussions before any AI or ADM systems are deployed. They should be read and utilised by: Information Governance (IG) Leads , Service Leads and Owners and Legal Teams.

By bringing these stakeholders together, boroughs can effectively plan the necessary Data Protection Impact Assessments (DPIAs), monitoring systems, and resident appeal processes required to use ADM responsibly in the delivery of council services.

Please note: This report is a general guide for informational purposes only. It does not constitute legal advice, nor should it be regarded as a substitute for legal advice. Shoosmiths accepts no responsibility for, and will not be liable for any losses arising from, any action or inaction taken as a result of the information contained in this document. It is recommended that professional advice is sought. The information stated is on 1 January 2026.

© London Office of Technology and Innovation, 2026. This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.