16 September 2026
The Meaningful Human Review Is a Phrase, Not a Test
The safeguard at the heart of Britain's new law on automated decisions is a word nobody has defined.
By the end of 2027, a tribunal will rule on a rejected job candidate's claim. It will find that a human did review her case. A real person, clicking a real screen. And it will still find against the employer, because the law says the review must be meaningful, and nobody has said what that means. Not Parliament. Not the Secretary of State. Not the ICO. That ruling will be the first time a court has had to say what the word means, because Parliament declined to write it down.
Since 5 February 20261, Article 22C of the UK GDPR gives you a right to human intervention when a hiring tool, a benefit calculator or a loan scorer makes a big decision about you. The law calls it "meaningful human involvement." Article 22D lets the Secretary of State define the phrase by regulation. No such regulations have been made.1
That's 229 days since the law changed. From 5 February to 22 September 2026, the day the AI Regulation and Safety Bill reaches committee stage in the Lords2. Still nothing.
A recruiter opens a dashboard. The software has scored four hundred people. She sees rankings and flags. She doesn't see why. The vendor doesn't show her. She approves or rejects. The candidate gets a letter saying a human reviewed the application. That sentence is true. Whether it counts as "meaningful" is a question the law leaves wide open.
Here's what the new rules did. The old Article 22 said: decisions that hit people hard are banned unless you can justify an exception. The new Article 22C says: allowed, as long as you apply safeguards.3 Parliament moved the weight from the excuse to the safeguard. Then left the safeguard blank. What used to be a gate is now a checklist with a blank line for the most important item.
Lawyers writing about the Act1 call whether a review counts as meaningful "the most consequential question under the new regime", and note that the Act itself doesn't define it. The ICO's draft guidance4 is the closest thing to a steer. Draft guidance isn't law. Nobody has tested it anywhere.
There is a case against this. Leaving "meaningful" undefined isn't careless by itself. Courts work out what words mean, case by case. A meaning fixed in law in 2025, for machines that will look different by 2030, might freeze a word that needs to bend. That's fair. It's also a reason to get cases heard fast. Which needs a candidate to bring one. Which needs her to know the review was hollow. Which needs facts the law doesn't give her.
The person this costs is the candidate who was turned down. She holds a right to meaningful human involvement in a decision that shaped her life. The law forgot to say what meaningful looks like.
The letter said a human reviewed it. Somewhere, a person pressed a button.