The law protects you once a machine has decided on its own. Your employer is the one who decides whether it decided on its own.

Britain does not ban machines from making decisions about people. Since the Data (Use and Access) Act 2025 amended the data protection rules, the older near-total prohibition on solely automated decisions has been replaced by a framework of safeguards. The trade is straightforward: you may automate, provided the person on the receiving end gets certain protections.

Those protections attach at a threshold with two parts. The decision has to carry legal or similarly significant effect, and being turned down for a job qualifies. And it has to be made solely by automated means, meaning without meaningful human involvement.

Clear the threshold and the candidate is owed specific information about the decision, the ability to make representations, and the right to ask a person to review it. Fall short of the threshold and none of that is owed, because in law a person made the decision.

So everything rests on the second part, and the second part is a judgement.

The Information Commissioner has set out what it takes for human involvement to count. The involvement has to be active and genuine rather than a token step or a rubber stamp. The person has to be able to influence the outcome before it takes effect, and they need the authority, the discretion and the competence to change it. A name on a screen who cannot overrule the ranking is not human involvement. A reviewer who sees only the shortlist the system produced is reviewing the system's decision, not making one.

The regulator added a second condition that is easy to miss and does a lot of work. Where human involvement exists at a stage of hiring, it has to be applied consistently to every candidate at that stage. If a recruiter reads some of the rejections and not others, the ones nobody read were decided by the machine, whatever the process diagram says.

Then comes the part that decides the whole question in practice. Nobody outside the company assesses any of this. The employer runs the process, the employer forms the view about whether its own reviewer had genuine discretion, and the candidate is not present for that judgement and is not told the outcome of it.

The Commissioner looked, and found employers describing their systems as decision-support while its own reading of the evidence put many of them the other side of the threshold. What that gap is made of belongs to Ada Okafor, elsewhere in this edition. The mechanical point here is narrower, and it is this: the threshold is assessed by the organisation that would be regulated by it.

There is one further gap, and this paper reported it eight days ago. On 17 August, under the headline that one minister can decide what counts as a person being involved in a decision about you, Elena Marsh set out the position exactly. The phrase sits in the Act, at Article 22A. The Act does not say what it means. Article 22D hands a Secretary of State the power to define it by regulation, and six months after the rules took effect no such regulation had been made. That piece was about a decision made about a customer, a loan refused without a person. This is the same four words and the same instrument, applied to a worker by an employer.

One thing has moved since, and it does not close the gap. On 12 May a statutory instrument came into force requiring the Information Commissioner to prepare a code of practice on artificial intelligence and automated decision-making. It was made under a different power, in the Data Protection Act, and it directs the regulator to write a code rather than telling anyone what meaningful involvement is. The final guidance on automated decisions is due in winter. The statutory code is not realistically expected before 2027.

So the four words that decide whether a British jobseeker has any rights at all will go on meaning whatever the organisation rejecting them decides they mean, for another year at the very least.