A short statutory instrument lands on 12 May. It directs the Information Commissioner to prepare a statutory code on AI and automated decision-making. The interesting question is not what the code will say. It is what the law already requires. Since 5 February, UK law has required four safeguards for any significant decision taken solely by automated processing - information, representations, human intervention, and the right to contest. In this episode of The Board in the Machine, Mario Thomas — Chartered Director and Fellow of the Institute of Directors — examines the capability gap that sits between those four safeguards and the systems most Boards have already approved. The episode walks through what the law actually asks for, why rule-based systems carry that capability on the surface and probabilistic systems do not, and where the gap will surface first when the first significant decision is contested. The argument draws on the Data (Use and Access) Act 2025, the new Articles 22A to 22D of the UK GDPR, the CJEU's SCHUFA judgment, the WP29 guidelines on automated decision-making and profiling endorsed by the EDPB, the IoD's *AI Governance in the Boardroom* (2025), and practitioner analyses from Travers Smith, Bird & Bird, Debevoise, and Alston & Bird. The takeaway is operational: Minimum Lovable Governance is the operating principle through which a duty like this one actually gets delivered, and the Board's job is not to build the capability but to refuse to approve systems that cannot deliver it. This episode is for Boards and directors in financial services, employment, insurance, and any consumer context where significant decisions are being made by automated processing, and who want a capability-first framing rather than a compliance checklist. Read the full article at mariothomas.com
続きを読む
一部表示