The UK ICO’s New Statutory Duty to Produce an AI Code of Practice: What It Means for Businesses That Use AI

All companies that are subject to the UK GDPR and develop or use artificial intelligence (AI) should begin assessing their AI and automated decision-making use now, in anticipation of the Information Commissioner’s Office (ICO), in its Code of Practice (the Code), and should monitor ICO guidance and the Code as it develops to ensure compliance.

In short: the UK’s data protection regulator, the ICO, is preparing a formal Code of Practice on AI and automated decision-making, and expects businesses to act well before it takes effect. This is not only a developer issue; any organization that uses AI or automated tools to make or support decisions about people, including tools bought from a third party, and that is subject to the UK GDPR, including organizations with no UK presence at all, where they offer AI-enabled goods or services to, or monitor the behavior of, individuals in the UK, should start assessing that use now. The legal detail behind this is technical, and is set out below for those who want it, but the practical message is straightforward: businesses that map, assess, and document their AI and automated decision-making use now will be considerably better placed than those that wait.

On May 12, 2026, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425) (the Regulations) came into force, requiring the Information Commissioner, under section 124A of the Data Protection Act 2018 (DPA) (as inserted by section 92(2) of the Data (Use and Access) Act 2025 (DUAA)), to prepare a Code of Practice on the processing of personal data in relation to developing and using AI and automated decision-making (ADM), including a mandatory children’s data component. The Regulations also modify the independent panel process under section 124B of the DPA (inserted by section 93 DUAA) to exclude national security matters from the panel’s remit. For these purposes, “automated decision-making” is defined by reference to Article 22C(1) of the UK General Data Protection Regulation (UK GDPR) and section 50C(1) of the DPA, both also inserted by the DUAA. As we previously reported, most of the data protection reforms introduced by the DUAA took effect on February 5, 2026. The duty on the Information Commissioner under SI 2026/425 is a separate, later development, and arguably the most significant AI-related instrument the ICO has been given to date.

The ICO had already opened a consultation on March 31, 2026, on updated draft guidance on ADM and profiling, its first detailed reading of the ADM reforms introduced by the DUAA. That consultation closed on May 29, 2026, and the ICO has indicated that final guidance will follow this summer, ahead of the statutory Code itself, which is not expected to take effect until 2027. For businesses that build AI models, this is a familiar story. For businesses that simply use AI tools bought or licensed from someone else, it is less well understood and, in our experience, considerably more likely to be overlooked.

Background

SI 2026/425 does not itself impose new obligations on businesses. It gives effect to the duty on the Information Commissioner, under section 124A DPA, to prepare the Code, and modifies the section 124B independent panel process to exclude national security matters from its remit before the Code is laid before Parliament. Section 50C DPA and Article 22C UK GDPR, both inserted by the DUAA, are referenced only to define “automated decision-making” for the purposes of the Regulations; they are not themselves the source of the duty. Once finalized, the Code is expected to carry the same statutory weight as the existing Children’s Code and Data Sharing Code: courts must take it into account in relevant proceedings, and the ICO must have regard to it in enforcement decisions. That is a materially different order of obligation from non-binding guidance.

In the meantime, the ICO’s draft ADM guidance, though not yet final and not itself the statutory Code, is the clearest available signal of the ICO’s thinking, including on what will count as “meaningful human involvement” in an automated decision (active review before a decision takes effect, not a token sign-off) and on the documentation the ICO will expect organizations to hold.

Who Does This Affect?

This is not limited to UK-based companies: it includes organizations with no UK presence at all, where they offer AI-enabled goods or services to, or monitor the behavior of, individuals in the UK. A common misconception is that AI regulation is primarily a problem for the businesses that build AI models. It is not. The ICO’s ADM rules attach to the controller that uses an automated or AI-assisted output to make a decision about an individual, regardless of who built the underlying tool. Buying or licensing a third-party AI system does not transfer that responsibility to the vendor. In practice, this reaches:

• Recruitment and HR functions using AI-assisted CV screening, candidate ranking, or recruitment platforms
• Financial services and insurance businesses using AI or automated systems for credit decisions, pricing, or fraud and risk scoring
• Customer-facing businesses using AI chatbots or automated triage tools that affect service outcomes, refunds, or complaint handling
• Life sciences and healthcare organizations using AI to prioritize, triage, or flag patient cases
• Any business procuring third-party AI tools in the ordinary course of vendor and supplier assessment

The ICO’s own research, published in its Recruitment Rewired report alongside its draft ADM guidance, found that many employers relying on automated recruitment tools were likely conducting solely automated decision-making, without meaningful human involvement and without adequately telling candidates so, in circumstances where several were not aware, or did not acknowledge, that this was what they were doing. The obligation can therefore apply even where a business regards itself as simply using a tool, rather than deploying AI.

The Risks of Non-Compliance

• Regulatory enforcement. Enforcement for ADM or AI-related breaches sits within the existing UK GDPR penalty regime, fines of up to the higher of £17.5 million or 4% of global annual turnover. Once finalized, the Code is likely to become the benchmark the ICO uses to assess what “good practice” looks like.
• Individual rights and litigation risk. Individuals affected by an automated decision have rights to be informed, to obtain meaningful human review, and to challenge the outcome. Unmanaged AI or ADM use is accordingly a direct source of individual complaints, and potentially litigation.
• Priority-sector scrutiny. The ICO’s AI and biometrics strategy names three priority areas: foundation model development, ADM in recruitment and public services, and police use of facial recognition technology, meaning these areas are more likely to attract proactive regulatory attention rather than only complaint-driven investigation. Agentic AI sits outside these three formal priorities for now, but the ICO has flagged it as an emerging area and dedicated guidance is expected as part of its 2026/27 work program.
• Vendor and procurement risk. AI-specific contractual terms, covering training-data rights, model updates, output ownership, and sub-processing, are increasingly expected in due diligence, but are not yet standard in many existing supplier agreements.
• Reputational exposure. Unmanaged AI use is increasingly treated as a board-level issue, and being seen to react only after a complaint or investigation is materially worse, from a regulatory and reputational perspective, than being able to demonstrate a documented, proactive governance process.

What Should Businesses Do Now?

1. Map AI and ADM use across the organization, including tools procured from third-party vendors, not only internally developed systems.
2. Review, or create, Data Protection Impact Assessments for any AI or ADM system against the ICO’s draft guidance, with particular attention to the “meaningful human involvement” test.
3. Audit vendor and procurement contracts for AI-specific terms, including training-data rights, model updates, and output ownership.
4. Benchmark AI use in recruitment, financial decision-making, and any context involving children’s data against the ICO’s stated priority areas.
5. Monitor for the ICO’s final ADM guidance, expected this summer, and the statutory Code itself, expected in 2027, and revisit governance documentation once each is published.

Conclusion

SI 2026/425 is, on its face, a narrow procedural instrument: a duty on the Information Commissioner to produce a Code, not a new set of obligations on business. In practice, it is a foundational step toward the most significant AI-specific instrument the ICO will have produced, and the draft ADM guidance already gives a reasonably clear preview of its likely direction. Businesses that treat AI governance as a developer problem, rather than a deployer problem, risk being caught out when the Code and the enforcement expectations that come with it take effect. Those who map, assess, and document their AI and ADM use now will be considerably better placed than those who wait.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.