Technical

Automated decision-making

Fully automated actions without human review.

How the laws define this

Regulators consistently treat automated decision-making as the deployment of algorithmic or artificial intelligence systems to generate outputs that materially impact individuals, rights, or organizational processes, universally requiring safeguards like transparency, oversight, and review pathways. The primary divergence lies in how much human involvement removes a process from this category. Frameworks such as NPC Advisory No. 2024-04, the Privacy Protection Authority guidance, the Bill for the Establishment of the National Agency for AI Governance, and the Data (Use and Access) Act 2025 focus on decisions made without meaningful human intervention or review. In contrast, instruments including the Personal Information Protection Law of the People's Republic of China (PIPL), the Data Governance Guide for Media Practice in Kenya, Smart Dubai guidance, Proposal B 136, and the Autoriteit Persoonsgegevens guidance apply the concept broadly to include systems that merely support, recommend, evaluate, or materially influence decisions.

Synthesised from the 13 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first. Showing 10 of the 13 instruments that define this term; all are listed under Definitions below.

JurisdictionInstrumentStatusWhat is distinctive
ChinaPersonal Information Protection LawIn ForceExplicitly requires transparency, explanation, human oversight, and objection mechanisms where decisions materially affect rights and interests.
United KingdomData (Use and Access) Act 2025In ForceDistinguishes fully automated from assisted processes, permitting wider automated processing for non-sensitive data with notice, representation, and human review.
PortugalCharter of Human Rights in the Digital EraIn Force (Amended)Emphasizes that decisions must be communicated, explainable, auditable, and subject to review to respect fundamental rights.
IsraelPrivacy Protection Authority opinion / guidance on algorithmic processing and notification obligations (automated decision‑making guidance)In ForceDescribes use of algorithmic or AI systems to reach decisions about individuals without meaningful human intervention; where such decisions affect rights or significant interests, controllers should disclose the automated nature and offer human review or appeal mechanisms.
PhilippinesNPC Advisory No. 2024-04: Guidelines on the Application of the Data Privacy Act to AI Systems Processing Personal DataIn ForceHighlights need for disclosure, contestability, and human oversight specifically for decisions producing legal effects or significant impacts.
Dubai, United Arab EmiratesEthical AI Toolkit / AI Principles and Guidelines for the Emirate of Dubai (Smart Dubai)In ForceBroadens to include any AI-produced decision, recommendation, or action influencing outcomes, even partly without immediate human judgment.
NetherlandsSupervision of Algorithms and AIIn ForceIncludes processing that substantially informs decisions with limited human intervention, in light of GDPR Article 22 and profiling.
SwitzerlandGuidelines on Artificial Intelligence for the Federal AdministrationAdoptedEncompasses processes in which software or AI systems produce outputs (decisions, recommendations, classifications) that have an effect on individuals or organisational processes; the Guidelines set out impact assessment, transparency measures and assigned human responsibility.
MoroccoBill for the Establishment of the National Agency for AI GovernanceProposedTriggers transparency obligations, rights to information, and remedies to protect affected persons from determinations without human oversight.
ColombiaBill to define and regulate AIStalledSubjects processes to prior evaluation, enhanced transparency, human oversight, and redress mechanisms for material influence on rights.

What it triggers

  • In China, under the Personal Information Protection Law, it requires transparency, explanation, and mechanisms for human oversight and objection where decisions have significant impacts.source
  • In the United Kingdom, under the Data (Use and Access) Act 2025, it sets obligations including notice, representation, human review pathways and safeguards particularly for non-sensitive data.source
  • In Portugal, under the Charter of Human Rights in the Digital Era, significant automated decisions must be communicated, explainable, auditable and subject to review.source
  • In Israel, under Privacy Protection Authority guidance, controllers should disclose the automated nature and offer human review or appeal mechanisms where decisions affect rights or significant interests.source
  • In the Philippines, under NPC Advisory No. 2024-04, it highlights the need for disclosure, contestability, and human oversight where such decisions are used.source

Definitions (13)

Systems that make and execute decisions autonomously without human review or intervention, producing actions or outcomes directly affecting customers or markets. The report contrasts these with decision‑support systems to calibrate supervisory expectations and controls.

Use of algorithmic or AI systems to reach decisions about individuals without meaningful human intervention; where such decisions affect rights or significant interests, controllers must disclose the automated nature and offer human review or appeal mechanisms.

Decisions made by AI systems without meaningful human intervention that produce legal effects for, or similarly significantly affect, data subjects. The advisory highlights the need for disclosure, contestability, and human oversight where such decisions are used.

Processing that uses algorithms or other automated means to evaluate, score, or make decisions about natural persons which may materially affect their rights and interests; the law requires transparency, explanation, and mechanisms for human oversight and objection where such decisions have significant impacts.

Processes in which an AI system generates outputs that directly determine or materially influence individuals' rights, entitlements or obligations with minimal or no meaningful human intervention; such processes are subject to prior evaluation, enhanced transparency, human oversight requirements and redress mechanisms under the bill.

Use of algorithmic or automated tools to support or make decisions in verification, content recommendation, audience analytics or other editorial processes, requiring documentation of inputs/outputs, safety testing and human oversight as recommended by the guide.

Processes whereby an AI system makes determinations or choices that affect individuals without meaningful human oversight; such decisions trigger transparency obligations, rights to information, and remedies under the Bill to protect affected persons.

Decisions produced by algorithms or AI systems that materially affect individuals; the Charter requires significant automated decisions to be communicated, explainable, auditable and subject to review to ensure respect for fundamental rights, transparency and accountability.

Processes in which software or AI systems produce outputs (decisions, recommendations, classifications) that have an effect on individuals or organisational processes; the Guidelines treat such processes as requiring impact assessment, transparency measures and assigned human responsibility. The concept is operationalised to identify when additional rights-protection, documentation and human oversight are necessary.

Any decision, recommendation or action produced by an AI system or algorithm that influences outcomes for individuals or public services, where the decision process is at least partly executed without immediate human judgement in the operational loop.

Processing performed by algorithms that makes or substantially informs decisions about individuals with limited human intervention; the guidance treats such processing (including profiling) in light of Article 22 GDPR and highlights obligations where decisions have legal or similarly significant effects.

Decisions or assessments in which algorithmic outputs materially inform or determine outcomes for a citizen, such that the algorithm's result plays a substantive role in the administrative decision.

A clarified definition distinguishing fully automated from assisted decision processes, setting out when decisions qualify as ADM under the law and the associated obligations (notice, representation, human review pathways and safeguards) particularly for non‑sensitive data where wider automated processing is permitted.

Not to be confused with

AI-augmented decision-making

This term focuses on fully automated actions without human review, while AI-augmented decision-making involves AI systems assisting or making decisions with some human element.

AI-assisted decision

This term covers fully automated processes, whereas AI-assisted decision refers specifically to cases where AI provides input to a human decision-maker.

Questions and answers

What obligations apply to automated decision-making under China's PIPL?

Processing that uses algorithms to make decisions materially affecting rights requires transparency, explanation, human oversight, and objection mechanisms. This applies where decisions have significant impacts.

Does the UK Data Act 2025 allow automated decisions for non-sensitive data?

Yes, it clarifies distinctions between fully automated and assisted processes, permitting wider automated processing for non-sensitive data with notice, representation, and human review safeguards.

What safeguards does Portugal's Charter require for algorithmic decisions?

Decisions materially affecting individuals must be communicated, explainable, auditable, and subject to review to ensure respect for fundamental rights, transparency, and accountability.