Accountable Algorithms: Legal Responsibility for AI in Public Services

Artificial intelligence is no longer a peripheral experiment in UK public services. It is being used to prioritise casework, identify potential fraud, route enquiries, support eligibility assessments and manage demand across local government and the wider public sector. The operational case can be strong. The legal question is less comfortable: when an algorithm produces a wrong, unfair or unexplained outcome, who is accountable?

The short answer is that the public body remains accountable. AI may change how a decision is reached, but it does not displace the statutory, public law and human rights obligations of the authority using it. Suppliers may bear contractual responsibility for system defects. They do not absorb the authority's duty to the citizen.

The public law baseline has not changed

A public body must act within its legal powers, rationally, fairly and in accordance with relevant statutory duties. It must also comply with the Human Rights Act 1998 and the Equality Act 2010. Those principles apply whether a decision is made by an officer, a rule-based system or a machine-learning model.

The practical difficulty is evidence. If an AI tool informs a decision, the authority should be able to explain what role the tool played, what information it used, what weight it was given and what human review took place. A nominal human sign-off is unlikely to withstand scrutiny if the officer simply adopts the output without understanding it. Meaningful human involvement means the reviewer has the competence, information and authority to challenge the result.

Authorities should also record the reasoning behind decisions in a way that can be reconstructed later. Public law challenges often turn on whether the decision-maker asked the right questions and considered relevant factors. An unexplained algorithmic score can make that task much harder.

Data protection and automated decision-making

The UK GDPR and the Data Protection Act 2018 provide the first detailed controls. Before deploying an AI tool that processes personal data, a public body should complete a data protection impact assessment. That assessment should cover the lawful basis, necessity and proportionality of the processing, the categories of data used, retention periods, security measures and the risk of bias or error.

Article 22 of the UK GDPR restricts decisions based solely on automated processing that produce legal effects or similarly significantly affect an individual. There are limited exceptions, and where they apply the controller must put in place suitable safeguards, including the ability to obtain human intervention, express a view and contest the decision. Public bodies should not assume that a human review step in a workflow automatically satisfies Article 22. The review must be genuine and effective.

Transparency is also integral. Privacy notices should explain, in accessible terms, that AI is used and what that means for individuals. The ICO's guidance and the Algorithmic Transparency Recording Standard provide useful reference points for public authorities seeking to document their use of algorithmic tools.

Bias, equality and the public sector equality duty

Algorithmic bias is not merely a reputational risk. It can produce unlawful indirect discrimination. If a model is trained on historical data that reflects past disadvantage, or if it uses proxies that correlate with protected characteristics, the outputs may disadvantage particular groups.

Public bodies must have due regard to the public sector equality duty when developing or commissioning AI that affects service delivery. That means considering equality impacts before deployment, testing for disparate outcomes, monitoring after go-live and being prepared to adjust or withdraw a tool where evidence of adverse impact emerges. Supplier assurances about fairness are not a substitute for the authority's own due diligence.

Authorities should also consider whether the data used is accurate, representative and up to date. A model that performs well in a pilot may behave differently in live operations, particularly where demand patterns, claimant profiles or local conditions change.

Transparency, FOI and commercial sensitivity

Freedom of Information Act 2000 requests may seek information about the algorithm, its training data, validation results, impact assessments and contract terms. Commercial sensitivity may justify withholding some material, but it is not a blanket exemption. Public bodies should expect to explain the purpose and logic of algorithmic tools at a level that enables public scrutiny.

Contracts with AI suppliers should therefore be drafted with transparency in mind. The authority should secure rights to obtain technical information, audit outputs, publish appropriate details and cooperate with regulators and information requests. Confidentiality clauses should be narrowly drawn and consistent with the authority's FOI obligations.

Allocating risk in supplier contracts

Many AI tools are procured as services, often with limited visibility into the underlying model. Contracts should address that imbalance. Relevant protections include warranties about performance, accuracy and legal compliance; audit and access rights; data ownership and return provisions; security requirements; sub-processor controls; indemnities; insurance; change control; service credits; and exit assistance.

Authorities should also consider what happens when a supplier updates a model, changes training data or withdraws a service. Material changes should not be permitted without notice and, where appropriate, approval. Liability caps should be reviewed carefully: a cap that is modest in relation to the potential impact of a failing decision-support tool may leave the public body carrying the practical consequences.

Contractual protections are important, but they do not cure an unlawful public decision. The authority remains responsible for how the tool is used and for the safeguards around it.

Governance priorities for 2026

A sound governance framework should include an inventory of AI tools in use, clear ownership at senior level, DPIA and equality assessments, human review standards, monitoring for drift and bias, incident response arrangements and regular reporting to audit or governance committees. Staff using the tools need training to understand their limitations, not just their functionality.

AI can improve public service delivery, but only if accountability is designed in rather than bolted on after failure. Public bodies should be able to answer three questions at any time: what the tool does, who is responsible for it and how an affected individual can challenge an outcome. Those questions are legal, operational and democratic. They are also the foundation of trustworthy public administration.

This article is general information and does not constitute legal advice. Specific proposals should be reviewed against the relevant statutory framework and contractual arrangements.