Prepare for the ICO code against current duties
The ICO is required to prepare a statutory AI and automated decision-making code. Existing data-protection duties continue while it is developed. Assess live systems now and distinguish current obligations from anticipated guidance.
Keep sources linked to the record used for review. The diagram does not represent automatic approval.
A readiness plan that says “await the ICO code” should identify what it is waiting to decide. An organisation already processing personal data through AI remains subject to current law. Future guidance may clarify practice, but its absence does not defer existing obligations.
Separate the underlying duties from the code-making process. A statutory code describes good practice and has a specified legal effect once issued. Its preparation includes consultation and other steps. Existing guidance is relevant evidence, but it does not establish the eventual code’s complete content.
Prepare against current obligations while tracking the code’s development. Record which decisions can be made now and which depend on unresolved guidance. Avoid assuming that the final text is already known.
What has actually happened
- 16 April 2026 The regulations are made The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026.
- 12 May 2026 They come into force The Information Commissioner is required to prepare a code on processing personal data in connection with AI and automated decision-making.
- Consultation, closed May 2026 Draft guidance on automated decision-making and profiling The regulator’s substantive position, put out for comment before the code is drafted.
- Ahead The code itself Preceded by a statutory panel and a period for representations. Track the published timetable and statutory process.
The regulations on legislation.gov.uk require the Commissioner to prepare a code covering personal-data processing in AI and specified automated decision-making. They include guidance on children’s personal data. The instrument establishes that preparation duty, rather than a completed code or a new blanket duty for organisations to follow a text not yet issued.
Why a code is different from guidance
| Guidance | A statutory code of practice |
|---|---|
| Persuasive. The regulator will point at it | The regulator must take it into account when exercising its functions |
| Evidence of good practice if followed | Admissible in legal proceedings where a provision appears relevant |
| Updated when the regulator chooses | Prepared through a defined process, with consultation and parliamentary steps |
| Departure is a judgement call | Departure is a position you may have to explain |
The Data Protection Act’s code-effect provisions distinguish a code from direct liability for departing from it. Relevant provisions can carry weight in proceedings and the Commissioner’s work under the statutory conditions. An organisation should retain evidence of how its approach meets the underlying law, including its reasons for any relevant departure. Obtain legal advice on the particular application.
What to do with the time
The ICO’s existing AI and data-protection guidance provides material for a current review. Its themes include lawful basis, fairness, transparency, individual rights and meaningful review where required. Parts are under review following legislative changes, so check the relevant provision and guidance status before relying on an older formulation.
Every one of those is testable against a system you already run.
Review how human involvement works in practice. A recorded approval click does not alone establish meaningful consideration. Examine the reviewer’s information, authority, time and ability to disagree. Whether human involvement or particular safeguards are legally required depends on the processing and applicable rules.
The agentic question underneath
Automated decision-making rules were written with a particular picture in mind: a system produces a decision, a person is subject to it. Agentic systems complicate that picture, because the consequential act may be a sequence of small steps none of which looks like a decision about a person, taken by a system nobody framed as a decision-maker.
An agent’s actual design and operation inform the legal assessment. Inspect the personal data it uses, the actions it takes and how those actions affect an individual. A policy label cannot establish whether a sequence amounts to a significant automated decision or whether review is meaningful.
What this does not tell you
This is not legal advice and it is not a prediction of the code’s content. Drafting is not finished, the statutory process includes consultation, and anybody claiming to know what the final text says is describing their own expectations. Interpretation for your organisation remains with your counsel and your data protection officer.
A review against current published material cannot establish alignment with an unfinished code. It can identify concrete gaps in records, rights handling and oversight that matter already. Keep those findings separate from assumptions about future wording and update the review when the relevant guidance changes.
The readiness owner should replace a general wait instruction with scoped actions, owners and unresolved questions. Review a consequential live use against current obligations and record the evidence. Track the code’s publication as a separate change that may require further assessment.