AI Regulation Tracker / New law

UK Puts the ICO Under a Statutory Duty to Write an AI and Automated Decision-Making Code of Practice

Regulatory summary: Regulations in force since 12 May 2026 require the Information Commissioner to prepare a statutory code of practice on developing and using AI and automated decision-making, with a mandatory children's-data component. The enabling law is live; the code itself is still to be written and is expected in 2027.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

UK Puts the ICO Under a Statutory Duty to Write an AI and Automated Decision-Making Code of Practice regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The UK moved the ICO's AI and automated decision-making guidance from a discretionary work product to a statutory obligation. Before, the ICO published AI and ADM guidance at its own initiative. Now, sections 124A and 124B of the Data Protection Act 2018, exercised through SI 2026/425, require the Commissioner to prepare a code and require that code to address children's data. A statutory code carries more legal weight than ordinary guidance.
UK controllers and processors using AI or automated decisions on individuals, including recruitment and HR teams running automated screening, lenders and credit providers, insurers doing automated underwriting or pricing, healthcare and life-sciences bodies using clinical or triage AI, and public authorities. Data protection officers, general counsel, and AI governance leads own the response. Vendors selling AI decision tools into the UK will face code-aligned procurement expectations.
Status: Enabling regulations in force since 12 May 2026.
Inventory every AI and automated decision system that processes personal data, flag those that make or materially influence decisions about individuals and those touching children's data, and align current practice with the ICO's existing AI and ADM guidance now, so the eventual statutory code is a checkpoint rather than a scramble.

Regulatory Briefing

Bindingness: Enabling regulations in force; statutory code still to be written. SI 2026/425 is a made statutory instrument that is legally in force from 12 May 2026. It does not itself regulate organisations. It imposes a duty on the Information Commissioner to produce a code. Once that code is issued and takes effect under the Data Protection Act 2018 framework, it will be a statutory code of practice: not a criminal offence in itself to breach, but admissible in evidence and something the Commissioner and courts must take into account in enforcement and litigation.
Scope: The eventual code will cover the processing of personal data, under the relevant UK data protection legislation, in relation to developing and using AI and to automated decision-making, with a required children's-data element. In practice that reaches any UK organisation that develops, buys, or operates AI or automated decision systems touching identifiable individuals, across HR and recruitment, financial services, insurance, healthcare, and the public sector.
What Changed: The UK moved the ICO's AI and automated decision-making guidance from a discretionary work product to a statutory obligation. Before, the ICO published AI and ADM guidance at its own initiative. Now, sections 124A and 124B of the Data Protection Act 2018, exercised through SI 2026/425, require the Commissioner to prepare a code and require that code to address children's data. A statutory code carries more legal weight than ordinary guidance.
Who This Affects: UK controllers and processors using AI or automated decisions on individuals, including recruitment and HR teams running automated screening, lenders and credit providers, insurers doing automated underwriting or pricing, healthcare and life-sciences bodies using clinical or triage AI, and public authorities. Data protection officers, general counsel, and AI governance leads own the response. Vendors selling AI decision tools into the UK will face code-aligned procurement expectations.
Current Status: Enabling regulations in force since 12 May 2026. The code has not been written. The ICO's related consultation on automated decision-making and profiling guidance closed on 29 May 2026 and feeds into the work. The full statutory code is expected in 2027.
Effective Date: SI 2026/425 came into force on 12 May 2026. There is no in-force date yet for the code itself, which will take effect through its own parliamentary and issuance process once drafted, expected 2027.
Primary Source: https://www.legislation.gov.uk/uksi/2026/425/made
Secondary Analysis: UK Parliament statutory instruments tracker (statutoryinstruments.parliament.uk) for the laying and progress of SI 2026/425; ICO consultation materials on automated decision-making and profiling guidance (consultation closed 29 May 2026).
Workflow Impact: Organisations should treat AI and ADM documentation, transparency, and human-review processes as heading toward a statutory benchmark. That means data protection impact assessments for AI decision systems, records of how automated decisions are made and reviewed, a working route for meaningful human intervention, and heightened controls where children's data is processed.
Operational Next Step: Inventory every AI and automated decision system that processes personal data, flag those that make or materially influence decisions about individuals and those touching children's data, and align current practice with the ICO's existing AI and ADM guidance now, so the eventual statutory code is a checkpoint rather than a scramble.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	United Kingdom	The UK moved the ICO's AI and automated decision-making guidance from a discretionary work product to a statutory obligation. Before, the ICO published AI and ADM guidance at its own initiative. Now, sections 124A and 124B of the Data Protection Act 2018, exercised through SI 2026/425, require the Commissioner to prepare a code and require that code to address children's data. A statutory code carries more legal weight than ordinary guidance.	UK controllers and processors using AI or automated decisions on individuals, including recruitment and HR teams running automated screening, lenders and credit providers, insurers doing automated underwriting or pricing, healthcare and life-sciences bodies using clinical or triage AI, and public authorities. Data protection officers, general counsel, and AI governance leads own the response. Vendors selling AI decision tools into the UK will face code-aligned procurement expectations.	Enabling regulations in force since 12 May 2026. The code has not been written. The ICO's related consultation on automated decision-making and profiling guidance closed on 29 May 2026 and feeds into the work. The full statutory code is expected in 2027.

Source File

Instrument: The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
Authority: His Majesty's Government (Secretary of State), made under sections 124A and 124B of the Data Protection Act 2018 (inserted by the Data (Use and Access) Act 2025); duty falls on the Information Commissioner
Date: Made and in force 12 May 2026; statutory code to follow, expected 2027
Citation: SI 2026/425, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
Primary Source: https://www.legislation.gov.uk/uksi/2026/425/made
Corroboration: UK Parliament statutory instruments record (statutoryinstruments.parliament.uk) for SI 2026/425; ICO consultation on automated decision-making and profiling guidance, closed 29 May 2026.

Frequently Asked Questions

Is SI 2026/425 in force, and does it regulate my company?

The regulations are in force from 12 May 2026, but they regulate the Information Commissioner, not your company. They impose a duty on the Commissioner to prepare an AI and automated decision-making code of practice. Your organisation's current legal duties still come from the UK GDPR, the Data Protection Act 2018, and the reformed automated decision-making rules.

Does this mean the UK now has an ICO AI code of practice?

Not yet. It means the ICO is now legally required to write one. The code itself has not been drafted or issued. It is expected in 2027 after drafting and consultation.

What makes a statutory code different from the ICO guidance we already follow?

A statutory code prepared under the Data Protection Act 2018 framework must be taken into account by the Commissioner in enforcement and is admissible in legal proceedings. Ordinary guidance does not carry that evidential weight, so the statutory code will be a stronger benchmark.

Why is children's data singled out?

Regulation 2(2) of SI 2026/425 expressly requires the code to include guidance on good practice in processing children's personal data. That signals regulators expect heightened protection where AI or automated decisions involve children, so organisations processing children's data should anticipate stricter expectations.

How does this relate to the automated decision-making changes in the Data (Use and Access) Act 2025?

They are separate. The Data (Use and Access) Act 2025 reformed the substantive law on automated decisions and inserted the powers behind this code. The ICO also consulted on automated decision-making and profiling guidance, closing 29 May 2026. SI 2026/425 requires a distinct statutory code that will sit above the guidance and draw on the reformed rules.