Direct answer: before a UK tour operator, OTA, hotel group, airline retail desk or travel ops team lets an **AI system in (or beside) the CRM** make a **solely automated significant decision** about a traveller, booker or staff member — refuse a booking, freeze a loyalty account, auto-cancel, soft-decline as fraud, change credit/credit-like terms, exclude someone from an essential offer, or score them in a way that materially changes their choices — you must already know whether UK GDPR **Articles 22A–22D** (the ADM provisions) apply, have a lawful basis that is allowed for ADM, and have **Article 22C safeguards** wired into the product: information about the decision, representations, human intervention, and contest. Token "a human designed the model" is not meaningful human involvement.
That is the operator question Kaize is answering here. We are a UK AI product studio for travel and hospitality. This is not a privacy-notice template pack. It is a **control-stack** article for CRM and booking-adjacent AI: what must already be true before an agent or model is allowed to **decide** rather than **draft**. It sits beside — and does not replace — our GDPR/ATOL booking-change, PECR soft-opt-in follow-up, CMA AI-agent consumer-law, CRM/booking system-of-record and AI agent access-control pieces.
Primary evidence is first-party ICO: draft guidance Automated decision-making, including profiling (updated **31 March 2026** for the Data (Use and Access) Act 2025); chapters on what the UK GDPR says about ADM, ADM safeguards and carrying out ADM lawfully; the ICO consultation (closed 29 May 2026); and the ICO overview of what DUAA means for organisations. We do not invent client results, fine outcomes, GSC lifts or GEO ranks.
What DUAA changed for travel CRM AI (and what it did not)
The Data (Use and Access) Act 2025 amended UK GDPR ADM rules. The ICO’s March 2026 draft guidance reframes the core provisions as **Articles 22A–22D**. In short: ADM means a decision that is **based solely on automated processing** (including profiling) **and** has a **legal or similarly significant effect**. DUAA also **opens the range of Article 6 lawful bases** you may use for significant automated decisions — potentially including **legitimate interests** — **so long as appropriate safeguards remain**. Special category data stays more protected. The ICO is clear that you **cannot** use the **recognised legitimate interest** lawful basis for ADM.
For travel operators the practical shift is not "ADM is now free". It is: more lawful-basis flexibility for ordinary personal data **if** you can still show necessity, fairness and the four Article 22C safeguards — and you still must separate marketing PECR, ATOL disclosure, consumer-law agent behaviour and access control from this ADM stack.
- Map every AI path that can change a person’s legal position or similarly significant circumstances without a trained human changing the outcome first.
- Do not treat "chatbot drafted an email" as ADM; do treat "model auto-refused the booking / froze the account / set the limit" as a candidate ADM decision.
- Document lawful basis and safeguards **before** go-live — not after the first complaint.
When does CRM AI become ADM?
ICO draft guidance says the ADM provisions apply only when **three** factors are present: (1) a system is making a **decision about a person**; (2) the decision is **significant** (legal or similarly significant effects); (3) the decision is **solely automated** (no meaningful human involvement). Not every automation is ADM. Applying a human-set rule such as "we do not accept this card brand" may not be the system making its own evaluative decision. Analysing history, ratings, behavioural signals and then automatically allowing or blocking access — the ICO’s lettings-platform style example — is.
Travel CRM examples that often need ADM analysis:
- Auto-refusal or hard block of a booking, amendment or refund pathway based on a risk or fraud score.
- Automatic freeze or downgrade of a loyalty / credit account after profiling.
- Real-time decision to offer or deny a higher spend limit, payment plan or high-value inventory based solely on a profile (ICO’s credit-limit style example maps closely).
- Automated exclusion from an essential service channel (e.g. only phone support left, chatbot permanently closes the case) where that materially affects access to the booking.
- Staff-facing ADM: automated warnings or scheduling penalties driven only by algorithmic evaluation of performance data.
By contrast, recommending a destination blog post from browse history is typically **not** a similarly significant effect — similar to the ICO’s video-recommendation contrast. Context still matters: if similar decisions can be significant for some people and not others, and you cannot accurately separate them, ICO guidance says apply the safeguards to all.
Gate 1 — Decide if it is significant and solely automated
Before wiring an agent tool that can refuse, freeze, cancel or re-price with material effect, compliance and product must classify the outcome.
- Significant? Ask ICO’s impact lens: financial circumstances, access to essential private services, reputation/trust scores, behaviour and choices (including dynamic pricing or discriminatory offers).
- Solely automated? Meaningful human involvement must be **active**, able to **influence and alter** the outcome, **trained** on the system’s logic/limits/risks, and timed **before** the decision is applied — not ad hoc spot-checks, not "human built the model", not "human pasted the CRM fields into the prompt".
- Keep a record of how any human was involved in each decision you claim is outside ADM.
Gate 2 — Lawful basis that ADM actually allows
ICO lawful-basis guidance for ADM highlights consent, contract, public task and legitimate interests as the bases most often relevant — and explicitly **blocks recognised legitimate interest** for ADM. DUAA’s flexibility does not remove necessity: "we want to run the CRM this way" is not enough. If special category data is entirely or partly in the decision, you need Article 6 **plus** Article 9 **plus** an Article 22B special-category ADM condition (explicit consent; contract with substantial public interest; or required/authorised by law with SPI).
- Document the Article 6 basis and why ADM is a targeted, proportionate means.
- If relying on legitimate interests, complete and keep an LIA covering profiling depth, impact and mitigations — escalate to a DPIA where high risk.
- Never use recognised legitimate interest as the ADM basis, even for fraud prevention (ICO: use ordinary legitimate interests + three-part test instead where appropriate).
- Tell people about ADM significance and envisaged consequences in privacy information — then still provide **decision-specific** explanations under Article 22C.
Gate 3 — Article 22C safeguards are product features, not a PDF
For ADM, Article 22C requires measures that (a) provide **information about the decision**, (b) enable **representations**, (c) enable **human intervention**, and (d) enable the person to **contest**. ICO draft guidance is blunt: apply safeguards **consistently**, not as discretionary favours. Information about the decision is **not** a copy-paste of the privacy notice — it must help the person understand the **actual outcome** and which factors (including profiling or third-party data) drove **their** case.
- At decision time: clear explanation + how to request intervention / contest.
- Human intervention ≠ human involvement: intervention is the post-decision right to a trained human review that can change the outcome; involvement is what keeps you out of ADM in the first place.
- Reviewers need access to the data and factors the system used, plus anything the person adds; keep a review record.
- Act without undue delay (generally within one month; extendable by up to two further months for complex requests with notice).
- Audit trail: key decision points, factors considered, alternatives not preferred.
Gate 4 — Separate ADM from PECR, ATOL, CMA and access-control posts
Kaize POV: travel teams often collapse "compliance" into one prompt. That is how gaps appear. **ADM** is about significant automated decisions and profiling under UK GDPR Arts 22A–22D. **PECR soft opt-in** is about electronic marketing follow-up after an enquiry. **GDPR/ATOL booking changes** cover how AI amends protected packages and personal data in the booking journey. **CMA consumer law** is about fairness of agent behaviour toward customers. **Access control** is about what tools an agent may call. You need the stack; do not substitute one article for another.
What this is not
- Not legal advice and not a claim that Kaize is your DPO or counsel.
- Not a statement that every CRM score or recommendation is ADM.
- Not permission to invent "AI reduced complaints by X%" or invented ICO enforcement outcomes.
- Not a substitute for ATOL Certificate display, DMCC total-price rules, sanctions screening, PCI CHD boundaries or ETA/EES eligibility gates.
Operator checklist (before production)
- Inventory AI paths that can refuse, freeze, cancel, exclude or materially re-price a person.
- Classify each: significant? solely automated? special category involved?
- Select and document an ADM-allowed lawful basis; ban recognised legitimate interest for ADM.
- Ship Article 22C UX: decision info, representations, human intervention, contest — with SLAs.
- Train reviewers; log involvement and intervention; monitor how often humans overturn the model.
- DPIA / LIA where high risk; kill-switch that disables decide-tools without disabling read-only itinerary help.
- Align with PECR marketing, ATOL/PTR, CMA and access-control controls as separate gates.
FAQ
If a human clicks "Approve" on every model recommendation, are we outside ADM?
Only if that human involvement is **meaningful**: they assess the case, can change the outcome, are trained, and act before the decision is applied — every time, not as token rubber-stamping. ICO draft guidance is explicit that ad hoc spot-checks are not enough for decisions you claim are outside ADM.
Can we use legitimate interests for fraud soft-declines in the CRM?
Possibly under ordinary **legitimate interests** after a three-part test — the ICO’s own fraud example points that way. You still cannot use **recognised legitimate interest** for ADM, and you still need Article 22C safeguards if the decision is solely automated and significant (account freezes are a classic "similarly significant" example in ICO materials).
Does DUAA mean we can drop human review because more lawful bases are open?
No. Opening lawful bases does not remove safeguards. If the decision remains solely automated and significant, Arts 22A–22D still require information, representations, human intervention and contest — wired as product behaviour, not a policy footnote.
Kaize next step
If you are putting AI beside a travel CRM, start with the ADM boundary: classify significant decide-paths, pick a lawful basis ADM allows, and ship Article 22C as features. See services, thinking and contact. Related reading: GDPR/ATOL booking changes, PECR soft opt-in, control AI agents, connect booking systems and CRM.