Is an AI receptionist legal under UK GDPR Articles 22A-22D?
Yes, and the law moved in its favor in February 2026. The new articles allow most automated decisions, with safeguards. What changed for a phone-heavy business is where those safeguards kick in.
Answered in short
5 things that decide this
- 01An AI receptionist is legal under UK GDPR. On 5 February 2026, the Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D, and the default for solely automated decisions moved from banned to allowed.
- 02Article 22A sets the trigger: a decision is solely automated when no meaningful human involvement shapes it, and restricted when its effect is legal or similarly serious. Answering a call and booking an appointment rarely clears that bar.
- 03Where the bar is cleared, Article 22C requires four safeguards: tell the person, let them put their case, offer human review, and let them contest the decision.
- 04Article 22B is the strict lane. A significant automated decision based on special category data, which includes health details from a clinic call, needs explicit consent or legal authority.
- 05The ICO is still rewriting its guidance, so build to the statute's safeguards, not to advice written for the old Article 22.
What flipped on 5 February 2026
The old Article 22 treated solely automated decisions with significant effects as banned unless an exception applied. Then the Data (Use and Access) Act 2025 rewrote the whole regime. From 5 February 2026, Articles 22A to 22D allow such decisions by default, as long as the Article 22C safeguards are in place. If you're deploying automation in the UK, this is the friendliest version of the law yet.
Its structure is worth thirty seconds of your time. Article 22A defines the terms. A decision is solely automated when no real human involvement shapes it. It is significant when its effect is legal or similarly serious. Special category data gets Article 22B, which restricts decisions built on it. The four safeguards live in Article 22C. And Article 22D lets the Secretary of State redefine meaningful human involvement, so the phrase can tighten without a new act.
Where a receptionist crosses the line
Most of what an AI receptionist does never touches Articles 22A to 22D. Answering, taking a message, booking a plumber's call-out or a salon appointment: none of it produces a legal or similarly significant effect. The articles reach the receptionist the moment it decides outcomes on its own. Think of automated triage refusing a patient an urgent slot, or a filter deciding which enquiries your firm will take.
A clean design routes every significant decision to a person and lets the AI handle the rest. That keeps the system outside the restricted zone. It also gives clinics a defensible answer on Article 22B, since a caller describing symptoms is handing you health data. Recording and transcription sit under separate duties on notice and lawful basis. Our page on the ICO's call-analysis guidance covers them.
We build for this jurisdiction already. Hashlogics built Shift Link, an AI workforce compliance platform, for a UK recruitment firm supplying temporary staff to healthcare and logistics. It cut manual compliance verification by 70 percent, and eligibility checks gate every shift before it's offered. A UK receptionist build follows the same principle. Let the automated layer do the volume, and route decisions that affect people to a human, with a record behind them.
- Call answeredThe AI names the business and itself.
- Routine handledBooking, message, FAQ. No 22A effect.
- Significant decision?Routes to a person, per 22C.
- Special category dataHealth details get the 22B treatment.
- LoggedCall, action, basis, reviewer.
Keep the significant decisions human and the articles mostly stay off your system.
Related questions
01Does an AI receptionist have to tell UK callers it's an AI?+
No single line in Articles 22A to 22D says so. But UK GDPR's transparency duties require fair processing information, and saying it up front is the cheapest way to meet them. Every receptionist we build opens by saying what it is. Callers who feel tricked don't book.
02Can an AI receptionist take health details for a clinic?+
It can, given a lawful basis and an Article 9 condition. For most UK clinics that means consent or the provision-of-care conditions. What it should not do is make a significant automated decision from those details, since Article 22B then demands explicit consent or legal authority. Route triage outcomes to your staff.
03Do these articles cover call recording and sentiment analysis?+
Not directly. Recording, transcription and analysis fall under the general UK GDPR duties. The ICO's 2026 guidance on AI call analysis expects a written LIA plus notices that name the analysis. Articles 22A to 22D only enter when the analysis drives a significant automated decision.
Related
- What does the ICO's 2026 guidance on AI call analysis require? →The recording and analysis layer, mapped.
- Voice AI agent development →Our service page: receptionists built with the routing and the record.
- Can an AI agent answer your business phone? →The capability question behind the legal one.
- Shift Link: AI workforce compliance platform →Our UK build: compliance gates on every shift.
