Companies responsible for decisions made by 'autonomous' AI, says ICO

The ICO's position

The UK Information Commissioner's Office has made it clear: calling an AI system autonomous does not shift responsibility away from the organisation using it ^[1].

The watchdog's warning comes as more companies deploy AI systems that make decisions with minimal human involvement. Some organisations have suggested that because these systems operate independently, accountability becomes harder to pin down.

The ICO disagrees. It says the company deploying the AI remains the data controller, and that means being able to show compliance with data protection law, including when things go wrong.

Think of it like this: if you set a burglar alarm and it calls the police by mistake, you don't get to say the alarm is responsible. You chose it, installed it and turned it on. The same goes for AI systems that process personal data.

What GDPR already says

This is not a new rule. Article 22 of GDPR, which has applied since May 2018, gives people the right not to be subject to decisions based solely on automated processing when those decisions have legal effects or similarly significant consequences ^[2].

There are exceptions: when the decision is necessary for a contract, permitted by law or based on explicit consent. Even then, the organisation must offer the right to human intervention, the chance to express a view and the ability to contest the decision ^[2].

What the ICO is doing is closing a loophole some had hoped existed: that labelling a system as autonomous might somehow dilute accountability.

The evidence question

For anyone running AI systems that make decisions about people, the practical question is this: if someone challenges a decision, can you show what your system actually did?

Logs are the usual answer, but a log kept by the same organisation that could benefit from changing it is easier to dispute. Access controls and monitoring are the foundation. An independent record goes further.

Making AI decisions checkable

Here, the thing to seal is each decision record as it is written to the log: the individual's reference, the model version, the input features, the output and any human reviewer. Sealing takes a fingerprint of the record, not the data itself, so sensitive information never leaves your systems.

The fingerprint goes to WitniumChain through the REST API, the SDK or the MCP server, and you get a witness ID back. When a decision is questioned, anyone you share the record with can calculate the fingerprint again and check it against the sealed one.

Auditors, supervisors and, if it comes to it, a court can see that the record is exactly what was written at the time. It doesn't show that the decision was right, fair or lawful, or that the log is complete, but it does show that nobody has quietly rewritten it afterwards.

Your system sends the fingerprint, never the content, and the first 2,000 witnesses a month are free. See the documentation.

How it would work

1. A lender's AI declines a loan application and writes the decision to the log.
2. The system seals a fingerprint of that record and gets a witness ID.
3. Six months later, the applicant asks for an explanation and disputes the recorded reason.
4. The lender shares the decision record and the witness ID, and the applicant's solicitor checks that the record matches the sealed fingerprint.

What this means for you

If you use AI systems to make decisions about people, ask yourself:

• Could you show, in detail, what your AI did on a particular day and which version was running?
• When someone disputes a decision, who keeps the record: you, the customer or both?
• If a supervisor or court asked whether the log has been edited, what would you point to?

The ICO's message is that autonomy is not an excuse. Compliance still sits with the organisation, and that includes being able to demonstrate what happened.

Sources

1. Compliance Week, "Companies responsible for decisions made by 'autonomous' AI, says ICO", 2024, https://www.complianceweek.com/artificial-intelligence/companies-responsible-for-decisions-made-by-autonomous-ai-says-ico/
2. Regulation (EU) 2016/679 (GDPR), Article 22, https://eur-lex.europa.eu/eli/reg/2016/679/oj