FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Data protection consultants
The ICO's AI material is a mix of final guidance, toolkits, a strategy, draft guidance and open calls for evidence, each with a different status. Consultants who cite the wrong item, or a superseded position, risk giving advice that does not hold.
Part of: AI in Data protection consultants
In short
The ICO has published final guidance on AI and data protection, explaining AI decisions and biometric recognition, plus risk and data analytics toolkits. Its June 2025 AI and biometrics strategy promises updated ADM guidance and a statutory code of practice on AI and ADM. Draft ADM guidance reflecting the DUAA was consulted on from 31 March to 29 May 2026. On 8 October 2026 the ICO opened an agentic AI call for evidence closing 20 November 2026. Guidance on foundation models, AI-generated subject access requests and recruitment is due between Autumn 2026 and Spring 2027.
Clients ask their data protection consultant "what does the ICO say about AI?" as if there were a single answer. There is not. The ICO's material sits on its AI guidance hub, in strategy documents, in consultation pages and in news releases, and it is changing as the ICO works through the Data (Use and Access) Act 2025. Some of it is final guidance. Some is draft. Some is a statement of what the ICO intends to publish. None of the AI guidance listed here is yet a statutory code.
That status matters. Advice that relies on a draft as if it were settled, or ignores a final guidance document because a newer consultation exists, can leave a client exposed. This page sets out the position as at 27 October 2026. It is for orientation: always check the ICO's own pages before advising.
| Item | Status | Date | Key points |
|---|---|---|---|
| AI and data protection | Final guidance | On the AI hub | The core guidance on applying the UK GDPR to AI systems |
| Explaining decisions made with AI | Final guidance | On the AI hub | How to explain AI-assisted decisions to the people affected |
| Biometric recognition | Final guidance | On the AI hub | Biometric systems, including facial recognition |
| AI and data protection risk toolkit; Data analytics toolkit | Practical tools | On the AI hub | Structured risk assessment aids |
| AI and biometrics strategy | Strategy and plan of action | June 2025 | Updated ADM guidance, statutory AI and ADM code, recruitment scrutiny, foundation model assurances, agentic AI |
| Draft ADM and profiling guidance | Draft; consultation closed | 31 March to 29 May 2026 | Reflects DUAA; human review must be meaningful; recognised legitimate interest cannot be used for ADM |
| Foundation model report | ICO report and commitments | 8 October 2026 | Ten developers commit to changes; ICO positions on special category data and whether models contain personal data |
| Agentic AI call for evidence | Open | Closes 20 November 2026 | Security, transparency, accountability, ADM, fairness, lawful use |
| Foundation models guidance | Planned | Autumn 2026 | Technology guidance plan |
| AI-generated subject access requests; recruitment and selection | Planned | Winter 2026 | General guidance plan |
| Monitoring workers | Planned | Winter 2026/27 | General guidance plan |
| Agentic AI guidance | Planned | Consultation October 2026; final Spring 2027 | Technology guidance plan |
The ICO's June 2025 AI and biometrics strategy, Preventing harm, promoting trust, is the best guide to where enforcement attention will go. It commits to updated guidance on ADM and profiling and to a statutory code of practice on AI and automated decision-making addressing transparency, bias and redress. It also commits to scrutiny of ADM in recruitment, to obtaining assurances from foundation model developers and to work on agentic AI. Each of those commitments has since produced a publication or a consultation.
A statutory code would carry more weight than guidance. Consultants should expect clients' AI governance to be measured against it once it exists, and should build advice now that will translate into it.
The draft guidance on automated decision-making including profiling was consulted on from 31 March to 29 May 2026 and is aimed mainly at DPOs, compliance professionals and technical leads. It reflects the new Article 22A definitions in force since 5 February 2026: a decision is solely automated if there is no meaningful human involvement, and a significant decision is one with a legal or similarly significant effect. The draft stresses that human review must be meaningful and that recognised legitimate interest cannot be used as the basis for ADM. The ICO has not yet given a date for the final version. See advising on automated decisions under DUAA.
On 8 October 2026 the ICO reported that ten foundation model developers had made, or committed to make, changes on transparency, individuals' rights and safeguard assessments, and that it is monitoring progress. Its report set out its position on how special category data can be used lawfully and whether foundation models themselves may contain personal data. The ICO also said it had opened a formal investigation into one developer's AI system and paused engagement with that developer.
The same release opened a six-week call for evidence on agentic AI, closing 20 November 2026, covering security, transparency, accountability, ADM, fairness and lawful data use. The ICO said that the fact AI agents act with autonomy is not an excuse for poor compliance. See advising on agentic AI and legitimate interests for AI training.
Fast-moving guidance increases the chance that advice given in good faith later looks wrong. A PI claim usually turns on whether the advice was reasonable when given, so a dated record of the guidance consulted is valuable evidence. A PI policy usually responds to negligent advice claims subject to its terms, but fines imposed on a client are a separate question; see does PI cover AI compliance advice errors? and the data protection consultants' AI hub. For cover, see PI for data protection consultants.
Guidance is not law, but the ICO takes it into account when deciding whether an organisation has complied, and courts may treat it as evidence of good practice. The planned statutory code on AI and automated decision-making will carry more formal weight once issued.
Not as at 27 October 2026. The draft guidance reflecting the DUAA was consulted on from 31 March to 29 May 2026 and the consultation is closed. The ICO has not published a date for the final version.
The ICO's technology guidance plan shows a consultation in October 2026 and final guidance in Spring 2027. Separately, a call for evidence on agentic AI opened on 8 October 2026 and closes on 20 November 2026.
No one, as a profession. The ICO regulates organisations that process personal data, which includes a consultancy as a controller of its own data, but there is no licensing or conduct regime for the advice consultants give. Advice standards are tested through contract and negligence claims.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
