Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
The Data (Use and Access) Act 2025, which received Royal Assent in June 2025, reformed Article 22 of UK GDPR — the rule governing decisions made solely by automated means, including AI and algorithms, that have a legal or similarly significant effect on a person. Previously, solely automated decision-making was banned by default outside narrow exceptions. The reformed rules instead permit it more widely — including for credit scoring, recruitment screening, and customer eligibility decisions — provided businesses put specific safeguards in place: meaningful information about the logic involved, the ability for the person to contest the decision, and a route to obtain human intervention. Special category data (health, ethnicity, religion, etc) remains far more tightly restricted.
This matters for any business using AI tools that screen job applicants, score creditworthiness, price products dynamically, flag insurance claims, or make other decisions affecting customers or staff without a human reviewing the outcome. Businesses that adopted AI tools assuming “a human technically approves it” or that haven’t revisited their automated decision-making safeguards since the reform are at risk of falling short of the new requirements — and the Information Commissioner’s Office (transitioning to the Information Commission under the same Act) has signalled increased scrutiny of AI-driven decisions as adoption grows across recruitment, lending, and customer service.
