UK statutory AI code puts automated decisions on compliance agenda

UKSI 2026/425 came into force on 12 May 2026, requiring the Information Commissioner to prepare the UK’s first statutory code of practice for AI and automated decision-making under Article 22C of the UK GDPR and section 50C of the Data Protection Act 2018. The instrument does not directly impose new duties on businesses, but the eventual code will carry legal weight, with courts required to take it into account and the ICO expected to consider it in enforcement decisions.

The code will cover good practice for processing personal data when developing and using AI systems, automated decision-making including profiling, and specific requirements for children’s personal data. The ICO’s draft automated decision-making guidance, shaped by the Data (Use and Access) Act 2025, closed for consultation at 23:59 on 29 May 2026, with final guidance expected in summer 2026 and the statutory code expected in 2027.

Organisations using AI in recruitment, credit assessments, insurance pricing, fraud detection, employee monitoring or customer segmentation should review whether human involvement is meaningful rather than nominal. The ICO’s draft position treats token review as insufficient and expects documented processes for human review requests, robust Data Protection Impact Assessments and closer scrutiny where children’s data or consequential decisions about individuals are involved.