Makes high-risk automated decisions, in the United Kingdom

Equality Act 2010, c. 15, s. 20, Sch. 2 · Read the law's page

• It reaches you if you operate as a service-provider, meaning a person concerned with the provision of a service to the public or a section of the public (for payment or not), or exercise a public function that is not the provision of such a service: where a provision, criterion or practice of yours puts disabled persons generally at a substantial disadvantage in relation to the provision of the service in comparison with persons who are not disabled, take such steps as it is reasonable to have to take to avoid the disadvantage (Equality Act 2010, section 29(7), section 20(3), Schedule 2 paragraph 2(1), (2) and (4)).
• Where a physical feature puts disabled persons generally at a substantial disadvantage in relation to the provision of the service, take such steps as it is reasonable to have to take to avoid the disadvantage or to adopt a reasonable alternative method of providing the service (section 20(4), Schedule 2 paragraph 2(3)).
• Where a disabled person would, but for the provision of an auxiliary aid, be put at a substantial disadvantage in relation to the provision of the service, take such steps as it is reasonable to have to take to provide the auxiliary aid, which includes an auxiliary service (section 20(5) and (11)).
• Where the first or third requirement relates to the provision of information, include among the steps you take steps for ensuring that the information is provided in an accessible format (section 20(6)).
• Do not require a disabled person, in relation to whom you must comply with the duty, to pay to any extent your costs of complying with it, unless an express provision provides otherwise (section 20(7)).

Equality Act 2010, c. 15, ss. 19, 29 · Read the law's page

• It reaches you if you operate as a service-provider, meaning a person concerned with the provision of a service to the public or a section of the public (for payment or not), and a service includes goods or facilities: do not discriminate against a person requiring the service, including a person seeking to obtain or use it, by not providing the person with the service, which includes not providing it of the quality, in the manner or on the terms on which you usually provide it to the public or the section of it that includes the person (Equality Act 2010, section 29(1), section 31(2), (6) and (7)).
• In providing the service, do not discriminate against a person as to the terms on which you provide the service, by terminating the provision of the service, or by subjecting the person to any other detriment (section 29(2)).
• Do not apply to a person a provision, criterion or practice that is discriminatory in relation to a relevant protected characteristic of the person's, meaning one that you apply or would apply to persons who do not share the characteristic, that puts or would put persons who share it, and the person, at a particular disadvantage, and that you cannot show to be a proportionate means of achieving a legitimate aim (section 19(1) and (2), applied through section 29).
• If you exercise a public function that is not the provision of a service to the public or a section of the public, do not, in the exercise of that function, do anything that constitutes discrimination, harassment or victimisation (section 29(6)).
• Do not harass a person requiring the service or a person to whom you provide the service, and do not victimise a person requiring the service by not providing the service or, in providing it, as to its terms, by terminating it or by subjecting the person to any other detriment (section 29(3) to (5)).
• If you rely on the exception for age discrimination in the provision of a financial service and you conduct an assessment of risk for the purposes of providing the service to a person, carry out the assessment, so far as it involves a consideration of the person's age, by reference to information which is relevant to the assessment of risk and from a source on which it is reasonable to rely (Schedule 3, paragraph 20A(1) and (2)).
• If you rely on the exception for disability discrimination in connection with insurance business, do the thing only by reference to information that is both relevant to the assessment of the risk to be insured and from a source on which it is reasonable to rely, and only where it is reasonable to do it (Schedule 3, paragraph 21(1)).

Consumer Rights Act 2015, c. 15, s. 46 · Read the law's page

• This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).
• If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).
• Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6)).

Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR · Read the law's page

• Where you take a significant decision about a person, one with a legal effect or a similarly significant effect, based solely on automated processing of their personal data, have safeguards in place that give the person information about the decision, let them make representations, let them obtain human intervention from you and let them contest the decision.
• Do not take a significant decision based entirely or partly on special category personal data solely by automated processing unless the decision is based entirely on processing to which the person has given explicit consent, or the decision is necessary for entering into or performing a contract with the person, or is required or authorised by law, and point (g) of Article 9(2) applies.
• Do not take a significant decision solely by automated processing where the processing of personal data for the decision is carried out entirely or partly in reliance on Article 6(1)(ea).

Data (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425 · Read the law's page

• Where you take a significant decision about a person in the United Kingdom based solely on automated processing of their personal data, have safeguards in place that give them information about the decision, let them make representations about it, let them obtain human intervention, and let them contest it, under UK GDPR Article 22C.
• Do not take a significant decision based solely on automated processing where your processing for it relies in any part on the recognised legitimate interests basis in UK GDPR Article 6(1)(ea), and base one on special category data only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and the Article 9(2)(g) substantial public interest condition applies, under UK GDPR Article 22B.

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, opened for signature 5 September 2024; signed by the United Kingdom, not yet ratified · Read the law's page

• Each Party to the Convention must adopt or maintain measures for the identification, assessment, prevention and mitigation of risks posed by artificial intelligence systems, considering their actual and potential impacts on human rights, democracy and the rule of law (Article 16(1)).
• Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.
• Each Party must provide a report to the Conference of the Parties within the first two years after becoming a Party, and then periodically thereafter, with details of the activities it has undertaken to give effect to Article 3, paragraph 1, subparagraphs a and b of the Convention (Article 24(1)).