Part of the AI Regulation News hub.
The United Kingdom has fixed 30 September 2026 as the date on which the office of the Information Commissioner is abolished and its functions pass to the Information Commission
Nothing in this instrument touches the automated decision-making rules themselves. It changes who holds them, which is a different problem and a harder one to diarise.
Bottom line: Made and on the statute book. The commencement instrument was made on 10 September 2026 and regulation 2 brings the abolition and transfer provisions into force on 30 September 2026, so the change of regulator is a fixed future date rather than a proposal.
Who this affects: Data protection officers and privacy counsel at UK controllers and processors, AI governance leads relying on the Data (Use and Access) Act automated decision-making provisions, and litigators and in-house teams with live ICO complaints, investigations or appeals.
Issue date: Made 10 September 2026 and signed the same day by Stephanie Peacock, Parliamentary Under-Secretary of State at the Department for Digital, Culture, Media and Sport. The commenced provisions take effect on 30 September 2026.
What changed: Sections 117(4)(a), 118 and 119 of the Data (Use and Access) Act 2025 were given a commencement date. Section 118 abolishes the office of Information Commissioner and section 119 transfers its functions to the Information Commission.
Analysis: The interesting provision is regulation 3, which deems acts, omissions and other things, including legal proceedings, done or in progress by or in relation to the Commissioner to be done by or in relation to the Commission.
Primary sources: S.I. 2026/1015 (C. 83), as made
- Instrument (EN)
- The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026
- Authority
- Secretary of State, made under sections 142(1) and 143(1) of the Data (Use and Access) Act 2025; published by the King's Printer of Acts of Parliament
- Jurisdiction
- United Kingdom
- Status
- Made 10 September 2026. Published on legislation.gov.uk as the original as made version
- Bindingness
- Binding as a statutory instrument. It commences provisions of the 2025 Act and creates no new duty on any controller, processor or AI deployer
- Issue date / next deadline
- Made 10 September 2026. The commenced provisions come into force on 30 September 2026. The accounts saving in regulation 4 runs to the financial year ending 31 March 2027
- Legal basis
- Sections 142(1) and 143(1) of the Data (Use and Access) Act 2025 (2025 c. 18)
- Number
- S.I. 2026 No. 1015 (C. 83), subject heading DATA PROTECTION
- Primary source
- https://www.legislation.gov.uk/uksi/2026/1015/made/data.htm
What this instrument actually commences
Regulation 2 is four lines long and does the whole job. It provides that three provisions of the Data (Use and Access) Act 2025 come into force on 30 September 2026: section 117(4)(a), which omits section 205(2)(l) of the Data Protection Act 2018; section 118, the abolition of the office of Information Commissioner; and section 119, the transfer of functions to the Information Commission.
Read the instrument for what it is. It is the ninth commencement instrument under the 2025 Act, and a commencement instrument sets a date for provisions that Parliament has already passed. It does not itself write any obligation. The substantive law is in the 2025 Act, and this piece does not describe provisions of that Act that we did not open.
The instrument carries no separate coming-into-force clause of its own in the text we read. The only date it fixes is 30 September 2026, and that date attaches to the three commenced provisions.
The Explanatory Note, which states on its face that it is not part of the Regulations, adds one fact that the operative text leaves implicit: section 118 omits Schedule 12 to the Data Protection Act 2018 as part of abolishing the office, and section 117(4)(a) removes a cross reference to that Schedule which is then redundant.
Regulation 3 is the provision to read twice
Regulation 3 is a general continuity provision, and it is drafted widely. Any act or omission, or other thing including legal proceedings, done or which immediately before 30 September 2026 is in the process of being done, by or in relation to the Information Commissioner, is to be treated as done or in the process of being done, and capable of being continued, by or in relation to the Information Commission.
Three phrases carry the weight. Including legal proceedings puts live litigation inside the provision expressly. In the process of being done reaches matters that are open rather than closed on 30 September 2026. By or in relation to runs in both directions, so it covers things done by the Commissioner and things done in relation to the Commissioner.
Our reading, and we mark it as ours, is that this is drafted to avoid an argument that a complaint, an investigation, an information notice or an appeal falls away or has to be restarted because the body that began it no longer exists. The instrument does not say that in terms and we do not put those words in its mouth.
Why an AI governance team should care about a machinery provision
The Data (Use and Access) Act 2025 reformed the UK GDPR provisions on automated decision-making. This instrument does not amend a word of those provisions, and nobody should read it as changing what the automated decision-making regime requires.
What it changes, from 30 September 2026, is the identity of the body that administers the regime. Guidance, codes of practice, complaint handling, enforcement and the counterparty in any correspondence sit with the Information Commission from that date. That is a change of institution, not of rule, and the two should not be conflated in a compliance register.
The practical exposure is clerical and it is real. Template privacy notices, data protection impact assessment templates, contractual clauses naming the supervisory authority, internal escalation procedures and litigation correspondence lists all name a body that will not exist after 29 September 2026. Regulation 3 is designed to preserve the legal effect of what has already been done; it does not proofread your paperwork.
The accounting carve-out, and what it signals
Regulation 4 is the only saving provision. Notwithstanding the commencement of section 118, for the financial year ending 31 March 2027 paragraph 11 of Schedule 12 to the Data Protection Act 2018 continues to apply in relation to the accounts of the Information Commissioner, except that the duties that paragraph imposes on the Commissioner are to be discharged by the Information Commission.
That is narrow and specific. It keeps one accounting obligation alive across the transfer and reassigns who performs it. The Explanatory Note describes the purpose as ensuring there are no accounting gaps while functions are transferred.
It is also a useful tell about the shape of the handover. The drafters identified exactly one continuing obligation that needed express saving beyond the general continuity in regulation 3, and it concerns accounts for a financial year that straddles the transfer date.
What the instrument does not do
It does not create, amend or remove any obligation on a controller, a processor, a provider or a deployer of an AI system. A commencement instrument is not a source of substantive duty.
It does not commence the whole of the 2025 Act. The note as to earlier commencement regulations printed with this instrument lists dozens of provisions brought into force by eight earlier instruments between August 2025 and June 2026. Provisions absent from both that table and regulation 2 remain uncommenced so far as this instrument shows, and we did not audit which those are.
It does not set out the constitution, membership or governance of the Information Commission. Those sit in provisions of the 2025 Act that this instrument does not reproduce and that we did not open.
What we did not verify
What we opened: the full as made text of S.I. 2026/1015 (C. 83) on legislation.gov.uk, read end to end, including the enabling words, regulations 1 to 4, the signature block dated 10th September 2026, the Explanatory Note and the note as to earlier commencement regulations.
What we did not open: sections 117, 118 and 119 of the Data (Use and Access) Act 2025 themselves, Schedule 12 to the Data Protection Act 2018, the automated decision-making provisions of the 2025 Act, the King's Printer PDF, any impact assessment, and any Information Commissioner's Office or Information Commission transition material. We therefore describe the commenced sections only as this instrument and its Explanatory Note describe them.
What we refuse to claim: we do not say the automated decision-making rules changed, because this instrument does not amend them. We do not say what the Information Commission's constitution or leadership will be, because the instrument is silent on it. We do not say that any specific live complaint, investigation or appeal is preserved, because regulation 3 is a general provision and its application to a given matter is a question of fact we have not tested. We do not describe this as the end of the ICO as an organisation, because the instrument speaks to an office and its functions and says nothing about staff, premises or branding.
A sourcing note. The legislation.gov.uk text was retrieved through a rendering client rather than a plain command line fetch, because the site returns an empty body to some simple clients. The text we read carried the instrument number, the made date and the signature block, which is how we satisfied ourselves it was the document and not a shell page.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Put 30 September 2026 in the diary as a counterparty change, not a compliance change. Regulation 3 preserves the legal effect of things already done or in progress, including legal proceedings, but it does not update the documents your organisation has written. Between now and then the useful exercise is a search across privacy notices, impact assessment templates, contracts and escalation procedures for every reference to the Information Commissioner, and a decision on which of them you actually need to change.
Source File
https://www.legislation.gov.uk/uksi/2026/1015/made/data.htm
Open the as made text and confirm four things: the three provisions listed in regulation 2 and the 30th September 2026 date attached to them, the words including legal proceedings in regulation 3, the financial year ending with 31st March 2027 in regulation 4, and the made date of 10th September 2026 above the signature block.
by or in relation to the Information Commissioner, is to be treated as an act, omission or thing done or in the process of being done, and capable of being continued, by or in relation to the Information Commission. ยท S.I. 2026/1015, regulation 3, made 10 September 2026
FAQ
Does this change the UK rules on automated decision-making?
No. The instrument commences three provisions about the abolition of the office of Information Commissioner and the transfer of functions to the Information Commission. It does not amend the automated decision-making provisions of the Data (Use and Access) Act 2025 or anything in the UK GDPR.
What happens to a complaint or investigation that is open on 30 September 2026?
Regulation 3 provides that any act, omission or other thing, including legal proceedings, done or in the process of being done by or in relation to the Information Commissioner is to be treated as done or in the process of being done, and capable of being continued, by or in relation to the Information Commission. How that applies to a particular matter is a question of fact.
Is the instrument in force now?
It was made on 10 September 2026. The provisions it commences come into force on 30 September 2026. Until then the office of Information Commissioner has not been abolished by this instrument.
Does anything need to be filed or done by a deadline?
The instrument imposes no filing or notification duty on any organisation. The only dated obligation in it is the accounts saving in regulation 4, which applies to the financial year ending 31 March 2027 and is discharged by the Information Commission, not by regulated organisations.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.