What automated reading does
When a user uploads a certificate, a licence or a timesheet, the Service can read it and pick out details such as names, dates, numbers and hours. The result is a proposal, shown next to the picture of the document.
A person then compares the proposal with the picture and confirms it, corrects it or discards it. Nothing read from a document is written to a record until a person has done that. The audit trail records who confirmed or corrected it.
Documents that are never sent to AI
Identity documents, right-to-work evidence and criminal-record certificates (DBS, PVG and AccessNI) are never sent to an AI model. A file that looks like one of these is refused. The agency's own staff check these documents.
Where reading a document uses the AI features, the rules in our Acceptable use of AI policy apply.
The law on automated decisions
On 5 February 2026 the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. They apply to significant decisions based solely on automated processing. A decision is significant if it has a legal effect on a person or a similarly significant effect, such as refusing them work. It is solely automated if there is no meaningful human involvement in taking it.
Such decisions are allowed only with safeguards: the person must be told about the decision, be able to make representations, be able to get a person at the controller to intervene, and be able to contest it. The rules are stricter where special category data, such as health information, is involved. Then the decision needs the person's explicit consent, or must be necessary for a contract or required or authorised by law and also meet a substantial public interest condition.
The Service takes no automated decisions about people
The Service does not take significant decisions about people by solely automated means. Automated reading produces proposals. The AI features produce drafts and suggestions. Where the Service flags something, such as a document that is missing or out of date, it is telling a person what to look at. In every case a person at the agency decides.
So the Service's own features do not trigger Articles 22A to 22D. That does not remove the agency's duty to make sure the human part is real.
Making the human check meaningful
The ICO is clear that human involvement must not be a token gesture. Users who confirm proposals must:
- compare each detail with the picture of the document, not just glance at it;
- check that the name on the document matches the person's record;
- correct anything that is wrong, and discard a proposal they cannot check;
- never confirm proposals in bulk without looking at each one;
- ask a colleague, or the person the document belongs to, if something is unclear.
The agency's responsibilities
The agency is the controller. It should tell its candidates and workers that uploaded documents may be read automatically and are then checked by a person. It should train its users on the checks above, and make sure that every decision about a person is taken by someone with the authority and the information to decide differently.
Your rights
If you are a candidate or worker, ask the agency you deal with how your documents were read and who checked them. You have the right to a copy of your data and to have mistakes corrected. If you believe a significant decision about you was taken without meaningful human involvement, you can ask the agency to explain it, give your view, have a person look at it again and challenge it.
If you contact us instead, we pass your request to the agency without delay and help it answer you. How we use your data and your rights explains the process.
Automated reading of documents and automated decisions · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.