Automation is getting easier, but governance will decide who gets it right.
Automated decision-making (ADM) is moving from a technical issue to a board-level governance question for franchise networks. As franchisors look for faster, more consistent ways to manage recruitment, loyalty programmes, pricing, compliance and franchisee performance, automation offers obvious advantages. But the legal and operational risk is no longer confined to whether the technology works. The real question is whether the decision-making framework around it is fit for purpose.
The Data Use and Access Act 2025 (the DUAA) gives franchisors greater room to use automated decision-making involving ordinary personal data. That is a significant development. However, it should not be mistaken for a free pass. Where automated decisions have meaningful consequences, franchisors will need to show that transparency, challenge rights and human oversight have been built into the process from the outset.
ADM is not just AI
One of the most important points for franchisors is that automated decision-making, or ADM, is much broader than artificial intelligence. A system does not need to be sophisticated, predictive or AI-enabled to fall within scope. Simple rules-based automation can be enough if it produces a consequence without meaningful human involvement.
In practical terms, ADM may already exist in areas such as automated loyalty downgrades, KPI warnings, application rejections, refund refusals, or rota and shift allocations. The label attached to the technology matters less than the outcome it produces. If the system is effectively deciding something about an individual, franchisee or franchise prospect, the governance requirements need to be considered.
The DUAA creates opportunity, not immunity
Under the previous position, ADM was tightly restricted. It was generally permitted only where it was necessary for a contract, based on explicit consent, or authorised by UK law for public interest or safeguarding purposes. For most commercial franchise arrangements, those routes were difficult to rely on with confidence.
The DUAA changes that position by making ADM easier to use with ordinary personal data. In many cases, franchisors may no longer need to rely on contractual necessity or explicit consent, and may be able to rely on a wider range of lawful bases. That creates useful flexibility for networks that want to improve consistency and efficiency. But it does not remove the need for safeguards, and it does not relax the rules for special category data.
Most franchisors may already be using ADM
For many franchisors, the immediate task is not to decide whether to introduce ADM. It is to identify where it is already happening. Existing CRM systems, loyalty platforms, KPI dashboards and recruitment tools often contain rules that trigger decisions automatically. Those decisions may feel operational rather than legal, but they can still carry regulatory consequences.
In a franchise network, ADM might be used to screen franchise applicants, manage loyalty status, assess franchisee performance, trigger audit activity, or support dynamic pricing. Each use case should be assessed by reference to the impact of the decision. Dynamic pricing, in particular, should also be considered through the lens of consumer and competition law risk.
Safeguards are the difference between efficiency and exposure
The law is not hostile to automation. The risk arises when automation produces significant consequences and there is no meaningful route for the affected person to understand, question or challenge the outcome.
For significant automated decisions, franchisors must:
- tell the individual that the decision was automated;
- allow them to give their views;
- allow them to request human review; and
- allow them to challenge the decision.
These safeguards do not need to be over-engineered. In practice, they may involve a clear line in a rejection or sanction email, a simple route to request human review, a dedicated inbox or form, an updated privacy notice and/or an FAQ explaining how automated decisions can be challenged. The important point is that the route must be real, visible and capable of being used.
Failure to build safeguards can turn automation into a liability
If safeguards are missing, the consequences can be significant. Automated decisions may become unlawful, outcomes may need to be revisited or reversed, individuals may demand human review, and operational processes may be disrupted. There is also the potential for regulatory scrutiny, including intervention by the Information Commissioner’s Office.
Special category data remains a red line
The DUAA’s greater flexibility applies to ordinary personal data. Special category data remains high risk and is still prohibited in ADM unless a narrow exception applies, such as explicit consent or a statutory public-interest basis. For most franchisors, those exceptions will rarely be available in practice. Automated decision-making should therefore avoid relying on data such as health, religion, ethnicity or biometrics.
A franchise example: when KPI automation goes too far
Consider a convenience store franchise that introduces automated KPI scoring. The system automatically sends warnings, places franchisees into support programmes, withholds rebates, increases audits and flags businesses for non-renewal. A refrigeration failure then triggers sanctions, but there is no process for the franchisee to understand the automated decision, provide context, request human review or challenge the outcome.
In that scenario, the automation is not necessarily the problem. The absence of safeguards is. A system designed to improve consistency and speed can quickly become a source of legal exposure if it does not allow for human judgement where the consequences are significant.
What franchisors should do now
Franchisors should treat ADM as part of their wider governance and compliance framework. The starting point is a practical audit: where is automation already being used, what decisions does it make, who is affected, and which outcomes are significant?
From there, franchisors should add safeguards where needed, update privacy notices, train human reviewers and keep simple records of review requests and outcomes.
The direction of travel is clear. Automation will play an increasing role in franchise governance, from recruitment and performance monitoring to customer engagement and pricing. The franchisors that benefit most will not simply be those that automate fastest. They will be the ones that design automation with accountability, transparency and human oversight built in from the beginning.
