UK law already answers this question, and the answer is never the software. The organisation that deployed the agent is accountable for what the agent did. Most organisations accept that position and cannot evidence it, because their records do not hold the four facts an investigation asks for. This article states the legal position, names the four gaps, and lists the six questions an ombudsman will put to you.
Connect with us about accountable records · · Replies within 24 hours
The organisation that used the AI. UK data protection law places duties on a controller, and a controller is an organisation or a person. Software holds no duties, so it cannot be at fault in law.
The Information Commissioner's Office sets out the specific rules on automated decision-making and profiling. Where a decision is solely automated and has a legal or similarly significant effect, a person has the right to be told, to obtain human intervention, and to contest the outcome.
The Data Protection Act 2018 carries those provisions into UK law.
The legal question is therefore settled. The practical question is whether you can prove your answer.
Four facts about one decision, on one date, for one person.
Most estates hold the first fact, often in a case note. The second, third and fourth are the gaps.
| Gap | What it looks like | What it costs you |
|---|---|---|
| No named actor | Several agents share one service account. | You cannot attribute the decision. |
| No permission history | You know today's permissions, not March's. | You cannot show the action was authorised. |
| No review record | A person checked it, and nothing recorded that. | The decision reads as solely automated. |
| No alteration control | An administrator can update the log. | Your evidence carries no weight. |
Review must be meaningful. A person who approves every output without the ability to change one is not exercising oversight, and a rubber stamp does not convert an automated decision into a human one.
The EU AI Act states the same principle for high-risk systems in Article 14. Effective oversight needs a person who can see, understand and stop the system.
Three conditions therefore make review real. The reviewer must see the inputs. The reviewer must hold the authority to reach a different conclusion. The system must record which of the two conclusions applied.
Central government departments record algorithmic tools in public. The Algorithmic Transparency Recording Standard sets the format, and it covers what a tool does, what data it uses, and who is accountable.
The Data Ethics Framework covers the wider duties on public bodies using data.
A published record describes a tool at one point in time. It does not evidence a single decision, so a transparency entry and an audit trail answer different questions.
Take one automated decision from three months ago and answer these in order. Each answer is a fact or a gap.
The sixth answer matters as much as the first five. An investigation runs to a deadline, and evidence you can assemble in two weeks does not help a response due in one.
We build your system on engage.re, and the four facts are properties of your records rather than an exercise in reconstruction.
Sense Future built engage.re, and it has run in production since December 2025.
A council uses an automated tool to prioritise homelessness applications. An applicant complains to the Local Government and Social Care Ombudsman. The council must show what the tool decided, on what data, under what authority, and whether an officer reviewed it. Where the tool ran inside a supplier's platform and the review happened in an email, the council holds a story rather than a record.
A care home group uses an automated tool to flag residents at risk of falls. A family challenges a decision, and the registered manager needs the same four facts. One system instead of thirty, and the same four questions.
The care home software and charity software pages set out the sector detail. Our guides to CQC digital records and safeguarding records under KCSIE describe the human duties that sit above any agent.
The organisation that used the AI. UK data protection law places duties on a controller, and a controller is an organisation or a person. Software holds no duties, so it cannot be at fault in law. A supplier contract can allocate cost between parties, and it does not move the statutory duty.
Where a decision is solely automated and has a legal or similarly significant effect, the person has the right to be told about it, to obtain human intervention, and to contest the outcome. The ICO sets this out in its guidance on automated decision-making and profiling, and the Data Protection Act 2018 carries it into UK law.
Four facts about one decision. What the system decided and which records it used. Which actor decided, by name. What that actor was permitted to do at that moment. Whether a person reviewed it, and which person. Most estates hold the first and lack the other three.
Only where the review is meaningful. The reviewer must see the inputs, hold the authority to reach a different conclusion, and the system must record which conclusion applied. A person who approves every output without the ability to change one is not exercising oversight.
Only where nobody can alter it. A log whose rows an administrator can update records what somebody chose to leave in it. A log that chains each event to a hash of the event before it makes any alteration detectable, and that property is what gives the evidence weight.
We build your system on engage.re. Every actor is named, permissions are recorded as they stood on any past date, a human review writes an event, and every access joins a signed hash-chained log that nobody can alter. Your six answers come from one query rather than from four suppliers.
Connect with us about accountable records · · Replies within 24 hours