The UK automated-decision file SMEs now need

The UK’s AI rulebook still looks lighter than the EU’s, but the easy version of that sentence is now misleading.

The Data Use and Access Act reached a live milestone on 19 June 2026, when the ICO marked the 12-month commencement point. For SMEs using automated scoring, triage, pricing, recruitment filters or AI-assisted case routing, the practical question is no longer whether Britain has copied the AI Act. It has not. The practical question is whether the firm can show where an automated decision stops and a human decision begins.

The line is meaningful involvement

Section 80 of the Data (Use and Access) Act 2025 gives the short test. A decision is solely automated if there is no meaningful human involvement in taking it. That sounds simple until it meets an SME workflow.

A customer-support classifier that only sorts tickets is not the same as a system that closes a complaint. A credit-risk score that informs a manager is not the same as one that blocks an application. A hiring tool that ranks CVs is not the same as one that decides who receives an interview. The difference is not the label “AI”. It is who can change the outcome, when, and on what evidence.

The ICO’s draft automated decision-making consultation closed on 29 May 2026. Its technology guidance tracker lists the update as still in drafting, with final guidance due in winter 2026. That leaves a useful gap for SMEs: build the evidence file now, before the final words arrive.

The file is smaller than the policy

The first artefact does not need to be a governance programme. It needs to be a decision file for each workflow where software has practical power over a person.

File item	Minimum question
Decision	What outcome can the system change for a person?
Data	Which inputs are used, and which source is authoritative?
Automation	Is the system recommending, ranking, blocking or finalising?
Human role	Who can intervene before the outcome is applied?
Challenge route	How can the person ask for review or contest the result?
Logs	What record proves the recommendation, review and final action?

Source: Data (Use and Access) Act 2025, section 80, ICO DUAA pages and ICO automated decision-making consultation. Last verified 2026-07-05.

This is deliberately plain. If a smaller firm cannot answer these six lines, a longer policy will not rescue it. The missing item is usually operational: the review happens in a shared inbox, the override is verbal, the CRM only stores the final status, or nobody has written down which manager is allowed to disagree with the model.

Complaints make it visible

The DUAA also matters because it pushes ordinary data-protection handling closer to the product workflow. The ICO’s organisational guidance points firms to changes around complaints, transparency, research, children and cookies. For automated decisions, the visible pressure point is the complaint or challenge.

If a customer, applicant or employee asks why a decision was made, the company needs more than a model name. It needs the decision path. What data entered the system? What did the automation produce? Did a human see it? Did that person have enough information and authority to change the result? Was the final outcome logged separately from the recommendation?

That evidence is not only for regulators. It is also for the person in the business who has to reopen the case six weeks later. Many SMEs discover too late that the automated part is documented, but the human review is not.

The UK-EU split is now procedural

For cross-Channel firms, the UK remains less prescriptive than the EU AI Act. There is no UK conformity assessment regime for AI systems as a category. There is no CE-style technical file. Enforcement still runs through existing regulators and legal duties.

But that does not make the British side empty. The UK file is procedural: data-protection basis, transparency, meaningful human involvement, contestability and logs. The EU file is broader and more formal for systems caught by the AI Act. A small firm selling or operating in both markets should not treat these as rivals. It should keep one workflow map and attach the UK and EU evidence to the same process.

The lazy failure mode is to write “human in the loop” in a policy and leave the actual loop undefined. The better version names the human, the moment, the authority and the record. That is the difference between a slogan and meaningful involvement.

What to do before winter guidance

The final ICO guidance may change wording, examples and emphasis. It is unlikely to make undocumented decision paths look good.

Start with the three workflows where software has the highest practical effect: hiring, credit or payment, customer access, fraud flags, insurance, complaints, support priority, or staff monitoring. For each one, write the six-line decision file. Then test one real case from input to outcome.

If the review cannot be reconstructed, do not buy a platform first. Fix the workflow. The useful question for an SME is not whether the model is impressive. It is whether a person can still understand, challenge and change the decision when it matters.