The UK has no AI statute, so for many organisations the most important AI regulator is the data protection regulator. On 30 September 2026 the Information Commissioner’s Office became the Information Commission.
What already applies
The regulator’s guidance on AI and data protection covers the familiar principles applied to AI: a lawful basis for training and use, fairness and bias, transparency, accuracy of outputs, security, and the rights of individuals, including in relation to automated decisions. None of this is new law. It is the UK GDPR applied to AI.
What is changing
Automated decisions. The Data (Use and Access) Act 2025 relaxed the rules on solely automated decisions, with new safeguards. The regulator consulted on updated guidance, closing in May 2026, and says final guidance is due in winter 2026.
A statutory AI code. Regulations in force since May 2026 require the regulator to prepare a code of practice on developing and using AI and on automated decision-making, including on children’s data. The code had not been published at the time of writing; one specialist estimate puts it in 2027.
A statutory code is not law, but courts and the regulator must take it into account. Once it exists, ignoring it is hard to defend.
What to do
Use the existing AI guidance now. Check your automated decision-making against the new rules in the Act rather than the old Article 22. When the draft code appears, compare your AI governance against it while it is still out for consultation.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.