Artificial Intelligence: ICO set outs its plan for safe AI innovation

The UK’s data protection regulator, the ICO, has published its response to a joint request from the Technology Secretary and Business Secretary asking it to set out a plan for enabling safe AI-powered innovation. The letter, signed by CEO Paul Arnold, gives the clearest picture yet of where the ICO’s regulatory focus will sit over the next year.

The ICO has framed its approach around two objectives:

1. ensuring the public understand how AI systems process their personal data and have meaningful control over that; and
2. ensuring organisations have clarity on what data protection law requires when they deploy AI systems, including agentic AI.

To deliver on those objectives, the ICO has committed to several concrete actions. The most significant for businesses is the development of a statutory AI and automated decision-making code of practice, which will set binding expectations for organisations developing and deploying AI tools. The ICO is also planning dedicated guidance on agentic AI systems and UK GDPR compliance, a transparency resource to help organisations particularly SMEs and public bodies, carry out data protection due diligence when procuring off-the-shelf AI tools and a streamlined version of its regulatory sandbox and innovation services.

For in-house teams, the direction of travel is clear. The ICO is not looking to slow AI adoption down, but it does expect compliance to be built in from the outset. The statutory code of practise will, once in force, set the standard against which organisations will be judged, and the current automated decision-making guidance consultation is an early signal of what will what that will look like in practice.

If you would like to discuss how current or future regulations impact what you do with AI, please contact Tom Whittaker, Brian Wong, Lucy Pegler, Martin Cook or any other member in our Technology team.  For the latest on AI law and regulation, see our blog and newsletter.