The ICO says FOI requests drafted with AI are not invalid for that reason, and that AI prompts and outputs an authority holds fall under FOIA

Key takeaways

• An AI-assisted request must still meet section 8 of FOIA to be valid. Length or errors alone do not make it invalid, the ICO says.
• The ICO points authorities to clarification, the section 12 cost limit with advice and assistance, and section 14 for burdensome or repeated requests.
• On the authority's side, the ICO says AI-generated information is subject to FOIA "along with the prompts used", and that inaccuracy is not an exemption.
• The page offers sample website wording authorities may adapt to ask requesters to check AI-drafted requests.

Does using AI make an FOI request invalid?

The ICO answers "Not necessarily". It treats AI as one more writing tool, including where a request is generated from a prompt. The test stays where FOIA puts it: a request is invalid only if it fails the requirements in section 8. The ICO adds that requests through social media were not envisioned when FOIA came into effect in 2005 but are generally valid if section 8 is met. Where an authority suspects pseudonymous requests or a bot acting without human involvement, the ICO points to its separate guidance on recognising a request under section 8.

Requests drafted with AI may misstate FOIA rights or cite ICO decision notices or case law that does not exist. The ICO says such errors do not by themselves invalidate a request, and that it is fine to tell a requester their request contains an incorrect statement about FOIA. It also reminds authorities that FOIA requires appropriate advice and assistance, with a reference to its section 16 guidance.

Which FOIA tools does the ICO point authorities to?

The ICO names three, all existing provisions. First, clarification: if AI has made the wording more complex or the scope unclear, go back to the requester, and the ICO says an authority that needs to ask must do so in a timely fashion. Second, the cost limit: where a request is so broad that it exceeds the limit, the authority must provide appropriate advice and assistance to help the requester reformulate, and the ICO suggests a collaborative approach. Third, section 14: the ICO says an authority may consider refusing where a request is excessively burdensome but outside the section 12 limit, or where AI is used to send repeated requests for substantially similar information, requests meant only to disrupt, requests on matters already told to be closed, or a high volume of related requests as part of a campaign.

The ICO says that list is not exhaustive and refers to its guidance on vexatious requests under section 14(1) and repeat requests under section 14(2). The guidance does not say that AI use alone justifies a refusal, and an authority would still have to apply the section in the usual way to the facts.

Are an authority's own AI outputs and prompts subject to FOIA?

Yes, if the information is held. The ICO states: "If staff at a public authority use AI for work purposes, the information generated will be subject to FOIA along with the prompts used." If the AI tool keeps conversations and past prompts, the ICO says that is recorded information within the meaning of section 84 of FOIA, and that an authority must search the tool where a request covers such information. It adds that official information generated this way should be transferred to a corporate information management system with appropriate retention periods.

Inaccuracy does not change this. The ICO says inaccurate information is not exempt for that reason, and an authority with doubts about accuracy, where no exemption applies, should explain that to the requester. Where it is unclear whether AI-generated information is held, the ICO points to its guidance on whether information is held.

What should public authorities and their counsel do now?

The guidance is a prompt to check practice, not a compliance checklist with a deadline. The four steps below are the desk's reading of what it implies.

• Ask which AI tools staff use for work and whether each keeps prompts and conversation history, since the ICO says such records can fall within a request.
• Add those tools to the places your FOI search procedure covers, and set where official AI output is filed and for how long.
• Train information-access staff on what FOIA does and does not say, as the ICO recommends, so they can respond to AI-drafted requests that misstate the law.
• Decide whether to adapt the sample website text the ICO offers, which asks requesters to check AI-drafted requests for scope, clarity, accuracy and tone.

For requesters and their lawyers, the practical reading is that a long or error-laden AI draft is still a valid request if it meets section 8, but an authority may ask for clarification or point to the cost limit, and the ICO's sample website text says short, straightforward requests are easier to process and usually lead to quicker, more accurate responses.

Which dates matter in the ICO's AI and FOI guidance?

What we did not verify

What we opened: the full ICO guidance page, including the sample website text, and the ICO sitemap entry for that page, on 2026-10-25.

What we did not open: the ICO guidance on sections 8, 12, 14, 16 and 84 and on whether information is held, FOIA itself, any ICO decision notice applying this guidance, and any statement from the UK government or other regulators. The page itself shows no publication or last-updated date; the 22 October 2026 date comes from the page date metadata and the ICO sitemap, so the guidance may have been first published earlier.

What we refuse to claim: that the guidance is binding or changes FOIA, that AI use alone justifies refusing a request, that Scottish public authorities are covered, or how the Information Commissioner or a tribunal would decide a particular case.

Related briefings

• AI Regulation News hub
• Europe AI regulation tracker
• Attorneys and AI regulation
• ICO guidance on automated decision-making and profiling in recruitment
• ICO statutory code of practice on AI and automated decision-making
• Data (Use and Access) Act data complaints procedure duty
• UK judiciary AI guidance for judicial office holders