UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425)
Issued by
UK Government (Department for Science, Innovation and Technology)
- September 30, 2026 · Correction — Corrected the status and dates (made 16 April, laid 21 April, in force 12 May 2026) and the scope; the regulations mandate only children's data guidance (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
UK regulations in force since 12 May 2026 require the Information Commissioner to prepare a statutory code. It covers personal data in developing and using AI, and in automated decision-making. Once the code is in force, the ICO and courts must take it into account.
Applies To
Overview
The Secretary of State made these regulations on 16 April 2026 and laid them before Parliament on 21 April 2026. They came into force on 12 May 2026. They require the Information Commissioner to prepare a code of practice on personal data in developing and using AI. It also covers automated decision-making as defined in Article 22C(1) UK GDPR. The code must include guidance on processing children's personal data. Otherwise the ICO decides its scope and content. The regulations also stop the code's review panel from considering national security matters. The code itself is still to come. The ICO must consult before finalising it, and statutory codes under the Data Protection Act 2018 are laid before Parliament. Once in force, the ICO and courts must take the code into account. Fines under existing law can reach 17.5 million pounds or 4 percent of global annual turnover.
Key Requirements
- •The ICO must prepare a statutory code on personal data in developing and using AI and in automated decision-making.
- •The code must include guidance on processing children's personal data.
- •The regulations have been in force since 12 May 2026; the code itself is still to come.
- •Existing UK GDPR duties, such as impact assessments and safeguards for automated decisions, already apply.
- •Once in force, the ICO and courts must take the code into account.
- •Fines under existing law reach 17.5 million pounds or 4 percent of global annual turnover.
What Your Organization Must Do
- →Track the ICO's consultation on the code and plan to respond with your sector's views.
- →Map where your organisation uses AI or automated decisions involving personal data.
- →Flag any processing of children's personal data, since the code must cover it.
- →Keep meeting existing UK GDPR duties now, including impact assessments and safeguards for automated decisions.
- →Document the logic, data inputs, outputs and human review routes for solely automated decisions.
- →Review AI vendor contracts for audit rights, documentation support and help with impact assessments.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- Does the ICO AI and automated decision-making code of practice apply to SMEs or only large organisations?
- The code will apply to any organisation subject to UK data protection law that uses AI or automated systems processing personal data, regardless of size. SMEs are not exempt, though proportionality in how obligations are met may be addressed during the ICO's public consultation phase.
- What is the deadline for complying with the ICO statutory AI code of practice?
- No deadline applies to organisations yet. The regulations came into force on 12 May 2026 and require the ICO to prepare the code, which it must consult on before finalising.
- Can ICO enforcement action be taken against organisations before the statutory AI code is finalised?
- Enforcement under the code itself cannot proceed until the code is enacted, but existing UK GDPR and Data Protection Act 2018 obligations apply now. The ICO retains full powers to investigate and fine organisations for current AI-related data protection failures.
- How do the ICO AI code penalties compare to EU AI Act fines?
- ICO fines follow existing UK data protection thresholds, reaching up to 17.5 million GBP or 4 percent of global annual turnover. EU AI Act penalties for prohibited practices can reach 35 million euros or 7 percent of global turnover, making the EU regime more severe at the upper end.
- What must organisations document about solely automated decisions to prepare for the ICO code?
- Organisations should document the logic underpinning automated decisions, the data inputs used, the significance of outputs for affected individuals, and the human review mechanisms available to data subjects who wish to contest a decision. Records of processing activities must reflect all of this detail.
- Should AI vendor contracts be updated in anticipation of the ICO automated decision-making code?
- Yes. Compliance with the code will depend partly on what AI vendors provide, so contracts should be reviewed now to include audit rights, documentation obligations, and provisions requiring vendors to support DPIA processes. Waiting until the code is finalised may leave insufficient time to renegotiate agreements.