Prove your automated decisions were fair — in a day
For UK businesses whose software screens, scores or prices people — CV ranking, credit decisions, tenant referencing, claims triage, and more. Answer a short questionnaire about how the tool actually works (never about any individual candidate, borrower or tenant) and get a dated, evidence-backed report with the law cited on every finding. Increasingly, this is the exact question a client's supplier or tender questionnaire now asks you to answer.
- Your software shortlists, scores, ranks, prices or declines people automatically
- A client, insurer or auditor could reasonably ask how a person can overturn that outcome
- Nobody in your business could currently produce a dated document showing how
- You don't have in-house legal counsel to draft one
- You've been asked — or expect to be asked — to describe your use of AI in a supplier or tender questionnaire
If two or more of these are true, the UK rules on automated decisions — in force since 5 February 2026 — already apply to you.
What you actually get
A real excerpt, redacted — so you can judge the format and the level of detail before answering a single question.
The regulator isn't guessing. It already looked, and found gaps almost everywhere.
Ask most businesses whether their AI is making legal decisions about people, and they'll tell you it's "unlikely." That's almost exactly what the ICO heard from recruiters before it found several of them doing it anyway. The pattern repeats across every sector regulators have actually audited.
None of this is hypothetical, and none of it is confined to one industry. Recruitment, lending, insurance, housing, health, education, the public sector, and ordinary workforce-management tools all sit inside the same regime — and the businesses least prepared are usually the ones who assumed automated decision-making was someone else's problem.
Built first for recruitment — the ICO's own named example
The ICO's draft ADM guidance names recruitment screening as its lead example. Seven more sectors sit inside the same regime.
Recruitment, Staffing & HR Technology
CV screening and video-scoring tools may already be making legal decisions about candidates.
Also live: Consumer Credit & Lending, Insurance, Housing & PropTech, HealthTech, Education & EdTech, Public Sector, and Employee Monitoring.
Four steps to a defensible position — and staying there
Tell us how the decision actually gets made
A branching questionnaire asks how your tools work in practice — who can change an outcome, what data feeds the model, what happens to it afterwards. We never ask for real customer or candidate records: no files, no scores, no personal data. The assessment is about your process, not any individual case.
Get a risk-scored assessment across two exposures
A UK GDPR automated decision-making risk score, and a separate discrimination-exposure rating under the Equality Act 2010 — never blended into one number, because they run in different forums with different consequences. Every finding is labelled as enacted law, regulator guidance, or good-practice recommendation.
Get a defensible report — and the documents that go with it
A branded, evidence-backed report, version-locked to the legal position on the day it was issued: a plain-English Practical Guide, a detailed Legal Report for your file, and a one-page Board Summary. From the same answers you can generate a pre-populated DPIA, Human Review policy, Retention policy or Vendor Due Diligence pack, so you aren't drafting them from a blank page.
Keep it current, and prove you did
Findings become tracked actions you assign to named people with due dates, and anything still open past its date escalates. We monitor the legislation the assessment cites, keep a plain-English feed of UK regulator activity on automated decisions, train your staff with certificates and refreshers, and show your compliance trend over time — because a report from eighteen months ago proves very little on its own.
Why businesses choose The Automated Decision Making Company
One assessment, your whole group
Groups with regional companies, divisions, and business units get a single account structure, up to five levels deep, with local isolation and group-level oversight built in from day one.
Never overstated
The report tells you your assessed risk and where the evidence gaps are. It never claims you are "legally compliant" and never presents draft guidance as if it were settled law.
Built on the regulator's own findings
Every rule in the engine is checked directly against primary legislation and the regulator's own published audits, not just commentary, and versioned so we can show our working.
Evidence you can produce on demand
Every report is immutable once issued and tied to the exact schema version that produced it, so "this was correct when we ran it" is always a true, checkable statement.
What every plan leaves out, on purpose
The report is a risk assessment and an evidence base, not a guarantee. We're explicit about where our job ends, because a customer fined despite holding a report is the outcome this whole product exists to prevent.
- Legal advice — the report identifies assessed risk and evidence gaps; case-specific questions go to your own solicitor
- Certification of legal compliance — we never claim a business is "compliant," only what its assessed risk is and what's missing
- Processing of actual candidate data — the questionnaire asks about your process, never the people it decides on; no CVs, video files or scores are ever uploaded
- Legal sign-off on the documents — the pre-populated policies and DPIA are working drafts built from your answers, not approved instruments; your DPO or solicitor completes and signs them off
The regime is already in force. Your evidence doesn't have to be built under pressure.
Start your assessment now — a short questionnaire about how your tool actually works, and a dated, cited report within the day. No call required, no candidate data ever asked for.