Region — UK profile
The regulator already asks who was accountable. Now the actor is an agent.
Under the Senior Managers and Certification Regime a named individual carries the obligation personally, which means the question this platform answers has been a UK compliance question for years. What is new is that the thing acting is not on the payroll.
Two identifiers this platform cannot check, and says so
Detection here reports observed when a checksum agrees and asserted when only the shape matched. The UK is the profile where that distinction earns its keep, because the two identifiers a UK firm asks about most fall on the wrong side of it.
| Identifier | What can be checked | |
|---|---|---|
| NHS number | Modulus 11, published by NHS Digital. | observed |
| Sort code and account | Modulus checking against the published weight table. | observed |
| National Insurance number | Nothing. A NINO carries no check digit at all. Validity rests on which letters may open it, which pairs are never issued, and which letter may close it. | asserted |
| Unique Taxpayer Reference | A modulus 11 that every UK accounting package implements and HMRC has never published. | asserted |
The UTR check runs, and a passing result is still reported as asserted. A check that cannot be cited reduces false positives; it does not establish a fact. If HMRC publishes the algorithm this becomes observed and the change is one word.
Protected characteristics, declared and never inferred
The Equality Act 2010 enumerates the characteristics, so unlike
Singapore — where MAS FEAT asks a firm to
define its own objective — this profile ships a fairness vocabulary. Every
attribute in it is marked declared: usable where a subject
stated it and a lawful basis exists, never guessed from a surname or a
postcode.
Inferring a protected characteristic to test for bias creates UK GDPR Art. 9 data about a person in order to make a claim about a population. The Equality Act names the characteristics; it does not authorise guessing them, and this profile refuses proxy inference outright.
Two clocks, and only one of them is a number
- ICO — 72 hours
- UK GDPR Art. 33, from awareness. Encoded, and the clock starts when the incident is classified rather than when somebody remembers.
- FCA — no fixed window
- Principle 11 and SUP 15 require notification of matters the FCA would reasonably expect notice of. The trigger is qualitative and no hour count is published, so this profile records the obligation with no clock rather than inventing one. Set it against your own supervisory relationship.
Records are kept for six years by default here rather than the two the EU profile uses, which follows FCA record-keeping expectations rather than a preference.
Where UK law stopped agreeing with the EU
On 5 February 2026 the Data (Use and Access) Act deleted Article 22 of the UK GDPR and replaced it with Articles 22A to 22D. The EU prohibits solely automated significant decisions and allows three exceptions. The UK now permits them, provided the Article 22C safeguards were in place.
The question moved from whether you may to whether you can show it, and the whole regime turns on Article 22A(1)(a): a decision is solely automated if there was no meaningful human involvement in the taking of it. A UK deployment scored against the EU map after that date is being graded on a repealed article. The clause map →
What this profile still does not carry is the DPA 2018, a distinct instrument that is not mapped, and the non-statutory UK AI framework, which sets principles for regulators rather than duties for firms. The ICO's updated guidance on automated decision-making is also still in draft, with final publication due Winter 2026, so nothing here is scored against it.
What resolving a profile actually changes
A market profile is not a locale setting. Changing it changes what the platform is permitted to do, what it looks for, what it scores you against and how long it keeps a record — and moving a workspace between profiles is itself a governed act with a name against it.
And a workload can be under more than one at once. The profile resolves per decision — narrowest wins — and is sealed into the record, so a pack states which laws this deployment believed applied at the moment the decision was made. How that works →
See it under this profile
Bring the agent whose actions a senior manager already signs for. We will put it behind a grant in their name, take it past a bound on purpose, and show you the record they would hand their supervisor.
A walkthrough is a working deployment with your senior manager and their second line in the room, not a slide deck. The profile is resolved per decision and sealed into the record, so what you watch is what a supervisor would later read.