ICO AI guidance: requirements, deadlines and compliance actions
ICO Guidance on AI and data protection
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
The ICO AI guidance is a non-binding guidance of the United Kingdom, issued by the Information Commissioner's Office. Its current status is guidance. Any controller or processor using personal data in AI systems in the UK, at any lifecycle stage. 2 obligations are recorded against it, each with its source reference.
- Jurisdiction
- United Kingdom
- Instrument type
- Guidance
- Status
- Guidance
- Legal force
- Non-binding (guidance, strategy or standard)
- Issuing body
- Information Commissioner's Office
- Obligations recorded
- 2
- Source reference
- ICO guidance hub
- Official source
- Guidance on AI and data protection
- Verification
- Verified against the official source 26 Sep 2026
What is the ICO AI guidance?
The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.
Who does it apply to?
Any controller or processor using personal data in AI systems in the UK, at any lifecycle stage. It does not apply to AI that processes no personal data.
Controllers and processors under UK GDPR, including developers and deployers of AI.
When do the requirements apply?
First published July 2020, updated March 2023. Consultations on generative AI and data protection ran in 2024. The Data (Use and Access) Act 2025 changed the rules on automated decision-making, so a reviewer should confirm the current version.
What must organisations do?
Complete a data protection impact assessment for high-risk AI, document lawful bases, provide meaningful information about automated decisions, implement safeguards for solely automated decisions with legal or similarly significant effects, and test for bias and accuracy.
Each duty is one line: open it for the summary, practical action and evidence, or go to its own page.
Legal requirement Carry out a data protection impact assessment for high-risk AI processing Provider / developer, Deployer / user organisation +1
Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.
Practical action: Use the ICO's DPIA template and add AI-specific sections on bias, explainability and human oversight.
Evidence examples: Data protection impact assessment
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 6.1.4 AI system impact assessment; NIST AI RMF 1.0 MAP 5.1
Open the obligation page →UK GDPR Article 35; ICO guidance, accountability and governance section Source-linked (a factual check against the official source, not a legal review)
Legal requirement Apply safeguards to solely automated decisions with significant effects Deployer / user organisation, Public authority / government body
Individuals have rights in relation to solely automated decisions that produce legal or similarly significant effects, including being told about the decision, obtaining human intervention, and contesting it. The Data (Use and Access) Act 2025 amended these rules; the reviewer must confirm the current wording.
Practical action: Map every significant automated decision, add a human-review route and a notice to affected people.
Evidence examples: Automated decision register and review procedure
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 5.x, MANAGE 4.x
Open the obligation page →UK GDPR Article 22 as amended by the Data (Use and Access) Act 2025 Source-linked (a factual check against the official source, not a legal review)
What are the penalties?
Underlying UK GDPR breaches can attract fines up to GBP 17.5 million or 4 % of global annual turnover.
Official sources
-
Guidance on AI and data protection
Information Commissioner's Office · Tier 2 source
-
Data (Use and Access) Act 2025
legislation.gov.uk · 19 Jun 2025 · Tier 1 source
Cite this record
AIPolicyTracker (2026). “ICO AI guidance” [AIPT-POL-0203, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0203 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0203: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Guidance on AI and data protection, Information Commissioner's Office, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/.
BibTeX
@misc{aipolicytracker2026_icoaiguidance,
author = {{AIPolicyTracker}},
title = {{ICO AI guidance}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance}},
url = {https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0203)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0203"><img src="https://aipolicytracker.org/badges/uk-ico-ai-data-protection-guidance.svg" alt="AIPolicyTracker: ICO Guidance on AI and data protection, Guidance · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Initial structured record; post-2025 amendments to automated decision-making rules need confirmation. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the ICO AI guidance in force?
The ICO AI guidance has the status "guidance"; it is not a binding law in force.
Is the ICO AI guidance legally binding?
No. The ICO AI guidance is a guidance; it sets expectations rather than legal requirements, unless another instrument gives it force.
Who does the ICO AI guidance apply to?
Any controller or processor using personal data in AI systems in the UK, at any lifecycle stage. It does not apply to AI that processes no personal data.
When does the ICO AI guidance apply?
First published July 2020, updated March 2023. Consultations on generative AI and data protection ran in 2024. The Data (Use and Access) Act 2025 changed the rules on automated decision-making, so a reviewer should confirm the current version.
What must organisations do under the ICO AI guidance?
Complete a data protection impact assessment for high-risk AI, document lawful bases, provide meaningful information about automated decisions, implement safeguards for solely automated decisions with legal or similarly significant effects, and test for bias and accuracy.
What are the penalties under the ICO AI guidance?
Underlying UK GDPR breaches can attract fines up to GBP 17.5 million or 4 % of global annual turnover.
Where is the official text of the ICO AI guidance?
The official text is published by Information Commissioner's Office at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (Guidance on AI and data protection). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.