Yes, with conditions that changed on 5 February 2026. On that date the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. Automated decisions are now permitted more widely than before, provided you can show four specific safeguards. This page covers UK law only.
I run an AI automation agency in Leeds and we build answering systems for a living. You should know that before you read a word of this, because it means I have an obvious interest in you deciding an AI line is worth paying for. What follows is deliberately the version that includes the parts that lose us work.
This is not legal advice. Where a decision turns on your specific setup, take your own.
If you would rather talk it through than read it, our AI answering service page explains how we build these, and we will tell you when you don’t need one.
What changed in UK law on 5 February 2026?
Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. The Act received Royal Assent on 19/06/2025, and section 80 came into force on 05/02/2026 under regulation 2(j) of SI 2026/82.
The Information Commissioner’s Office confirmed in its summary of the changes, updated 19/06/2026, that “all data protection provisions in the Data (Use and Access) Act 2025 are now in force”.
The direction of the change is worth being clear about. The Department for Science, Innovation and Technology’s factsheet, published 27/06/2025, describes the previous rules as “framed as a general prohibition” and says the reforms enable “solely automated decision-making in wider circumstances, as long as they implement measures to provide the relevant safeguards”.
The law got more permissive, not less. What it asks in return is that you can demonstrate the safeguards.
Does the law let AI make decisions about callers without a human?
For most personal data, yes, provided the safeguards are in place. Two definitions decide whether they apply to you.
Article 22A(1)(a) states that “a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision”. Article 22A(1)(b) states that a decision is significant if “it produces a legal effect for the data subject, or has a similarly significant effect for the data subject”.
Article 22A(2) adds that when considering whether there is meaningful human involvement, a person “must consider, among other things, the extent to which the decision is reached by means of profiling”.
Both tests have to be met before the safeguards bite: solely automated, and significant.
Whether a particular call-handling decision clears that bar is a question about your setup, not a question with a published answer. An AI that takes a message and emails it to you in the morning is a long way from a legal effect. An AI that decides a caller’s problem does not warrant waking anyone up is closer to the line. No case law has settled where an out-of-hours triage decision sits, and I am not going to pretend otherwise, but it is the question to ask a vendor, and a good one will have an answer. The ICO’s draft guidance leans the cautious way: where it is hard to tell which decisions are significant, it suggests applying the safeguards more broadly.
What must an AI answering service let a caller do?
Article 22C(2) sets out four safeguards. Where a significant decision is taken solely by automated processing, the controller must have measures in place which do all four of the following.
| Article 22C(2) | What the law requires | What it means on a phone line |
|---|---|---|
| (a) | Provide the data subject with information about decisions taken in relation to them | The caller can find out that an automated system decided how their call was handled |
| (b) | Enable the data subject to make representations about such decisions | There is a route for the caller to say “that was wrong, here is why” |
| (c) | Enable the data subject to obtain human intervention on the part of the controller | A person can be reached. This is your escalation path, and it is now a statutory safeguard |
| (d) | Enable the data subject to contest such decisions | The caller can challenge the outcome, not just be informed of it |
Safeguard (c) is the one worth dwelling on. The right to obtain human intervention is, in practice, the escalation design: what the system recognises as needing a person, how quickly it hands off, and what happens when nobody picks up. It is easy to sell that as a feature. Where the AI takes significant decisions on its own, it has been a legal requirement since 05/02/2026.
If you are being sold an AI answering service, ask how each of those four is delivered. A vendor who can only answer (c) has built a phone tree with better manners.
Can AI triage calls for a clinic or care home?
This is where the law stops being permissive, and it is the section that costs us work.
Article 22B(1) states that a significant decision “based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met”. Those conditions, at Article 22B(2) and (3), are narrow. Either the decision is based entirely on data the person has given explicit consent for, or it is necessary for entering into or performing a contract with them, or it is required or authorised by law. In either of those last two cases, Article 9(2)(g), the substantial public interest condition, must also apply.
Health data is special category data under Article 9(1). So an AI line that makes a significant decision about a patient or a resident, based on what it has been told about their health, and does it with no meaningful human involvement, runs into a prohibition rather than a set of safeguards.
I am not going to tell you where the line falls for your clinic. Whether your triage step is a “significant decision” with a “similarly significant effect” is a judgement, and nobody has litigated it for this use case. What I will say plainly is that the answer is not automatically yes, the burden is on the operator, and any supplier who tells you it is a non-issue has not read Article 22B.
For most healthcare and care-sector work, the honest design keeps a person in the loop on anything clinical and uses the AI for what surrounds it: capturing the call in full, reaching the right human faster, and making sure nothing waits until morning that shouldn’t. That is a smaller sale than “AI handles it”. It is also the one that survives a regulator asking questions.
Does safeguarding change the rules out of hours?
Section 70 of the Act and Schedule 4, both in force the same day under regulations 2(c) and 2(z6), created a set of “recognised legitimate interests” in a new Annex 1 to the UK GDPR, inserted by Schedule 4. Paragraph 6 states that the condition “is met where the processing is necessary for the purposes of safeguarding a vulnerable individual”.
Annex 1 defines that carefully. Safeguarding means protecting a vulnerable individual from neglect or physical, mental or emotional harm, or protecting their well-being. A vulnerable individual is someone aged under 18, or aged 18 or over and “at risk”, which the Annex defines as the controller having reasonable cause to suspect the individual has needs for care and support, is experiencing or at risk of neglect or harm, and as a result is unable to protect themselves.
That matters less than it sounds for an AI line. Under Article 22B(4), if you rely on a recognised legitimate interest, including safeguarding, you cannot take a significant decision by solely automated means at all. The safeguarding ground can justify handling the information. It cannot justify an AI making the decision on its own. It is also only a lawful basis: health details still need an Article 9 condition, and public authorities will usually rely on public task instead.
Worth correcting a claim you may see elsewhere. Annex 1 paragraph 3 also creates a recognised legitimate interest for “responding to an emergency”, but paragraph 4 ties “emergency” to the meaning in Part 2 of the Civil Contingencies Act 2004. Section 19 of that Act requires a threat of “serious damage to human welfare in the United Kingdom or in a Part or region”. Property damage can count as damage to human welfare under section 19, but the threat has to be at the scale of the country or a region. A burst pipe at 2am is not that, however urgent it is to the person ringing. If a vendor cites the emergencies ground for ordinary out-of-hours call handling, they have not read as far as paragraph 4.
Do you have to tell callers the AI is recording them?
Yes. Tell them.
Two separate bodies of law touch this and they are easy to muddle. The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 used to cover business call recording. Since 2018 that job has been done by the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, made under the Investigatory Powers Act 2016, which makes unauthorised interception an offence under section 3. They let a business record calls on its own system for purposes such as establishing facts and checking standards, and they carry forward the old condition in regulation 3(2)(c) of the 2000 Regulations that the system controller has “made all reasonable efforts to inform every person who may use the telecommunication system in question that communications transmitted by means thereof may be intercepted”.
That condition was written with the people using your phone system in mind, so for callers the stronger footing is UK GDPR: its transparency and fair-processing duties require you to tell people how their personal data is being used. Whichever of those you rely on, the practical answer is the same, which is why arguing about it is a waste of time: announce the recording, say why, and mean the reason you give.
What this is not is a PECR question. The direct-marketing rules in the Privacy and Electronic Communications Regulations 2003 govern outbound marketing calls, not inbound call answering. Some vendor guides cite PECR for call recording, and it is the wrong instrument for that. It does apply if your system makes outbound marketing calls or sends marketing texts.
The cost of getting this wrong is documented. On 18/04/2023 the ICO reprimanded Surrey Police and Sussex Police after 1,015 staff downloaded an app that automatically saved more than 200,000 call recordings. In the ICO’s words, officers “were unaware that all calls would be recorded, and people were not informed that their conversations with officers were being recorded”. Both audiences were owed information and neither got it. Under its public sector approach, the ICO issued reprimands instead of a £1m fine for each force.
When you should not put an AI on the line
Four situations where we would tell you not to, or not yet.
Clinical or safeguarding decisions with no human in the loop. See Article 22B above. If the design has the AI making the call on something clinical, the design is wrong.
You cannot answer the four safeguards. If there is no route for a caller to reach a person, contest an outcome or find out a machine decided it, you do not have a compliant system, you have a demo.
Your call volume is low. This is a commercial point rather than a legal one, but it matters more often. If out-of-hours calls are occasional, an answerphone and a checked inbox costs nothing and breaks nothing.
Nobody is on the other end of the escalation. The most common failure we see is not the AI mishandling a call. It is the AI correctly deciding to escalate to a person who is asleep, off-rota or no longer employed. Safeguard (c) is not satisfied by a transfer to a number nobody answers.
Frequently asked questions
Is it legal to use an AI receptionist in the UK?
Yes. There is no prohibition on AI answering business calls. The main constraints are on solely automated significant decisions, on special category data, and on transparency about recording. The normal UK GDPR duties still apply too: a lawful basis, a contract with your AI supplier, safeguards if call data leaves the UK, and often a data protection impact assessment.
Did the Data (Use and Access) Act 2025 make AI call handling harder?
Not for most calls. Where health or other special category data drives the decision, the prohibition largely remains. For everything else it replaced a general prohibition with a safeguards regime, which is a more permissive framework. It came into force on 05/02/2026.
Does an AI answering service need a caller’s consent to record?
Not necessarily consent, but they must be informed. Consent is one lawful basis among several; the transparency duty applies regardless of which you rely on.
Can an AI answering service handle NHS or care-sector calls?
It can handle calls. Whether it can make solely automated significant decisions involving health data is restricted by Article 22B of the UK GDPR, and in most designs the answer is to keep a person in the loop.
Where can I read the law myself?
Section 80 and Schedule 4 of the Data (Use and Access) Act 2025 on legislation.gov.uk, and the ICO’s summary of the DUAA changes. Both are linked throughout this page.
What to do next
If you are specifying an out-of-hours line, the four safeguards in Article 22C(2) are a better vendor questionnaire than anything a supplier will hand you. Ask how each one is delivered, and ask who answers when the system escalates at 3am.
We build these for UK businesses from Leeds, and we will tell you when the answer is an answerphone. Our AI answering service page covers how the builds work, what AI automation costs in the UK covers the money, and the industry pages for legal, trades and property management cover what the calls actually look like.
Last reviewed 22/09/2026. The ICO consulted on updated automated decision-making guidance between 31/03/2026 and 29/05/2026; that consultation has closed and final guidance has not yet been published. The ICO currently expects to publish it in winter 2026. This page will be updated when it is. Not legal advice.