According to the ICO’s published guidance plans, a public consultation on new agentic AI guidance is due to launch this month, with final guidance expected in spring 2027. This follows its consultation earlier this year on updated automated decision-making and profiling guidance, revised to reflect the Data (Use and Access) Act 2025. Final ADM guidance is expected this winter. Alongside this, the ICO is required to develop a statutory code of practice on AI and ADM. A recurring theme is the importance of human involvement and that simply signing off on an automated output may not amount to sufficient human involvement in the decision-making process.

What this means for you: If your organisation uses AI tools, understand where and how they are being used, particularly where they process personal data or influence decisions about people. Now is the time to map where those automated decisions sit, who is reviewing them, and whether that review is meaningful in practice.

Shared for general information purposes only and does not constitute legal advice. It is recommended that specific professional advice is sought before acting on any of the information given. Please contact us for specific advice on your circumstances.

Cyber Essentials certification is a UK government backed security standard that demonstrates an organisation has implemented the key technical controls needed to protect against the most common cyber threats.

Get the Regulatory Brief

This field is for validation purposes and should be left unchanged.
Name(Required)
A PRACTICAL GUIDE FOR BUSINESSES AND INDIVIDUALS WHEN THE REGULATOR CALLS

This field is for validation purposes and should be left unchanged.
Name(Required)

This field is for validation purposes and should be left unchanged.
Name(Required)