Automated decision-making by university

Short answer

In most cases, no. If a decision is significant enough to affect your legal position or something of comparable importance to you, and it is made purely by an AI or automated system with no genuine human involvement, data protection law gives you rights that will usually entitle you to human intervention, an explanation and a route to challenge it. There are, however, important qualifications: the law protects you against decisions made solely by automated means, so a university can lawfully use AI as a tool provided a human exercises real, meaningful judgement over the outcome.

The legal framework

The relevant law in England and Wales is the UK GDPR together with the Data Protection Act 2018, now amended by the Data (Use and Access) Act 2025. A university is a data controller when it processes your personal data, so these rules apply to it.

The key provision is Article 22 of the UK GDPR. It restricts decisions that are, in the words of the legislation, “based solely on automated processing” and which produce “legal effects” or “similarly significant effects” on you. Both parts of that test have to be satisfied before the special protection is triggered.

“Solely automated” means there is no meaningful human involvement in the decision. The Information Commissioner’s Office (ICO) is clear that a human rubber-stamping an output, or nominally being “in the loop” without any real authority or competence to change the decision, does not take the decision outside Article 22. The human involvement has to be genuine: carried out by someone with the authority and capability to alter the outcome, who actually considers the relevant information rather than simply endorsing the machine.

A “legal or similarly significant effect” covers decisions that affect your legal rights or have a comparably serious impact on your circumstances. In a university setting this would typically include outcomes such as a decision to exclude or expel you, a finding of academic misconduct, refusal or withdrawal of admission, failing you on a module or programme, or a decision affecting funding or a professional qualification. Routine administrative processing with only trivial effects would not usually meet this threshold.

What the university must do if Article 22 applies

Where a decision is both solely automated and significant, the university may only make it in limited circumstances, broadly where it is necessary for a contract with you, authorised by law, or based on your explicit consent. Even then, it must put safeguards in place. These include telling you that solely automated decision-making is taking place and giving you meaningful information about the logic involved and the likely consequences, providing a simple way for you to request human intervention, allowing you to express your point of view, and giving you the ability to contest the decision. Because this kind of processing is treated as high risk, the university should also have carried out a Data Protection Impact Assessment.

If the decision involves special category data (for example data about your health or disability) the restrictions are tighter still, and solely automated decisions of that kind are only permitted in narrower circumstances with additional protection.

Recent changes under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 reformed the automated decision-making regime. In outline, it recasts the rules so that solely automated significant decisions are more clearly permitted across a wider range of lawful bases, but it strengthens and makes explicit the safeguards that must accompany them. Those safeguards centre on the individual being given information about such decisions, being able to make representations, being able to obtain human intervention, and being able to contest the decision. In other words, even under the reformed framework, if a significant decision about you is taken by a purely automated process you retain a right to ask for a human to reconsider it and to challenge it. Special category data continues to attract stronger protection. The practical effect for a student is that the right to meaningful human review of a significant automated decision remains a core protection.

The common situation: AI as a tool, not the decision-maker

Most university uses of AI do not, in fact, fall within Article 22 at all, because a human remains the decision-maker. Two examples are worth distinguishing.

Plagiarism and AI-detection software (such as Turnitin and similar tools) generates a similarity score or an “AI writing” indicator. That output is not itself a decision. Under proper academic misconduct procedures, an academic or a misconduct panel is supposed to review the report, consider your explanation, look at the underlying work and reach a reasoned human judgement. If that is what happens, the final decision is not solely automated and Article 22 is not engaged, although you still have ordinary fairness and data protection rights. The position is very different, and potentially unlawful, if a university treats a detector score as conclusive proof of misconduct without genuine human evaluation. AI-detection tools in particular are known to be unreliable and to produce false positives, so a decision driven purely by such a score, with no real human assessment, is vulnerable to challenge both on data protection grounds and on grounds of procedural fairness.

Automated marking or algorithmic ranking (for example in admissions or grading) can engage Article 22 if the outcome is generated by the algorithm and simply adopted. If a human academic exercises real judgement over the mark or decision, it is not solely automated.

Other protections beyond data protection law

Data protection is not your only source of rights. A university’s relationship with you is also governed by contract (your student contract and the university’s own regulations), by the public law duty to act fairly where the university is exercising public functions, and, for most higher education providers, by the requirement to have fair and transparent procedures. The university’s own academic regulations and misconduct procedures will usually require a proper process, a chance to respond, and an internal appeal. A decision that departs from those published procedures, or that is reached without giving you a fair opportunity to be heard, can be challenged on those grounds regardless of whether AI was involved.

If you have a disability, the Equality Act 2010 is also relevant. An automated system that disadvantages disabled students, or a failure to make reasonable adjustments in how a decision is reached, can give rise to a discrimination claim.

Missing facts that affect the answer

To assess your position properly it would help to know what the decision actually is (misconduct finding, exclusion, mark, admission, funding), what system was used, whether any human genuinely reviewed and had authority to change the outcome, what the university told you about how the decision was made, and what its own regulations say about the process. The strength of any challenge depends heavily on whether a human truly exercised judgement or merely endorsed a machine output.

Practical next steps

1. Ask the university, in writing, to confirm whether the decision was made solely by automated means, what system or software was used, and whether and how a human reviewed it. You can frame this as a request for information about the logic and consequences of any automated processing.

2. Make a subject access request under the UK GDPR to obtain the data held about you, the report or score generated, and any records of how the decision was reached. This often reveals whether real human review occurred.

3. Expressly invoke your rights: request human intervention, state that you wish to express your point of view, and formally contest the decision. Put this in writing and keep a record.

4. Use the university’s internal appeal or complaints procedure. Set out both the fairness/procedural grounds and the point that a significant decision should not stand if it was made without meaningful human review. Do this within the university’s published deadlines, which are often short.

5. If the internal process is exhausted and you remain dissatisfied, most students at higher education providers in England and Wales can complain to the Office of the Independent Adjudicator for Higher Education, which can consider whether the university acted fairly and followed its procedures. Keep the completion-of-procedures letter, as you generally need it to bring an OIA complaint.

6. On the data protection aspects specifically, you can complain to the Information Commissioner’s Office if you believe the university has breached its obligations on automated decision-making, and the ICO can investigate how the university uses such systems.

7. Court action, such as judicial review of a public law decision or a data protection claim, is usually a last resort because of cost, delay and time limits. Judicial review in particular has a strict short time limit, so if that route ever became relevant you would need to act quickly, but internal appeal and the OIA are normally the more proportionate first ports of call.

Bottom line

A university generally cannot lawfully impose a significant decision on you that was produced solely by AI or an automated system with no meaningful human involvement, and even where such processing is permitted you retain rights to be informed, to obtain human intervention, to make your case and to contest the outcome. Where AI is only a tool and a human genuinely makes the decision, Article 22 is not engaged, but the decision must still be fair, follow the university’s own procedures, and not rely uncritically on an unreliable automated output.