{"title":"INFORMATION COMMISSIONER'S OFFICE / INFORMATION COMMISSION — THE REGULATORS' AI UNIVERSE","built":"2026-11-01 08:14 UTC","last_checked":"2026-10-28","checked_range":["2026-10-28","2026-10-28"],"as_of":"2026-10-28","buckets":[{"key":"unit","label":"Units and teams","color":"#8E2433","count":1},{"key":"system","label":"AI systems in use","color":"#1F2F4F","count":3},{"key":"prog","label":"Programmes and funds","color":"#2F5A45","count":0},{"key":"skills","label":"Skills and training","color":"#6E5716","count":0},{"key":"infra","label":"Compute and data infrastructure","color":"#54476E","count":0},{"key":"gov","label":"Governance and assurance","color":"#3E4555","count":1},{"key":"part","label":"Partnerships","color":"#5C5240","count":0},{"key":"rule","label":"Rules and law","color":"#A3394B","count":1},{"key":"reg","label":"Regulator actions","color":"#3D5A80","count":25}],"divisions":[{"key":"department-wide","label":"Department-wide","count":25,"depts":[{"dept":"Department-wide","count":25}]},{"key":"technology-regulation","label":"Technology Regulation","count":2,"depts":[{"dept":"Technology Regulation","count":2}]},{"key":"business-services-team","label":"Business Services team","count":1,"depts":[{"dept":"Business Services team","count":1}]},{"key":"data-ai-and-automation-programme-board","label":"Data, AI and Automation Programme Board","count":1,"depts":[{"dept":"Data, AI and Automation Programme Board","count":1}]},{"key":"group-record","label":"Group record","count":1,"depts":[{"dept":"Group record","count":1}]},{"key":"regulatory-risk","label":"Regulatory Risk","count":1,"depts":[{"dept":"Regulatory Risk","count":1}]}],"colleges":[],"nodes":[{"id":"GOV-REG-001","name":"Information Commission (successor to the ICO)","type":"Units and teams","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-09-30","function":"Body corporate created by the Data (Use and Access) Act 2025 that took over the ICO's functions on 30 September 2026. Led by a board (seven non-executive members, chair vacant) and an interim chief executive. Its first annual report covers 20 August 2025 to 31 March 2026.","composition":"","parent":"Department for Digital, Culture, Media and Sport","parent_research":"Department for Digital, Culture, Media and Sport","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement","https://www.gov.uk/government/news/seven-non-executive-members-appointed-to-information-commission-board-as-chair-recruitment-launches","https://ico.org.uk/about-the-ico/who-we-are/the-information-commission-board/","https://www.gov.uk/government/publications/information-commission-annual-report-and-accounts-2025-to-2026","https://localgovernmentlawyer.co.uk/information-law/398-information-law-news/101814-ico-formally-becomes-the-information-commission-as-new-board-takes-charge"],"source_quotes":[{"url":"https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement","quotes":["transferring its functions to the new Information Commission from 30 September 2026"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://www.gov.uk/government/news/seven-non-executive-members-appointed-to-information-commission-board-as-chair-recruitment-launches","quotes":["The Information Commission was established by the Data (Use and Access) Act 2025."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/who-we-are/the-information-commission-board/","quotes":["The Government are currently recruiting someone for this position."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://www.gov.uk/government/publications/information-commission-annual-report-and-accounts-2025-to-2026","quotes":["information about its activities for the period 20 August 2025 to 31 March 2026."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://localgovernmentlawyer.co.uk/information-law/398-information-law-news/101814-ico-formally-becomes-the-information-commission-as-new-board-takes-charge","quotes":["As the Information Commission, we are building on more than four decades of experience"],"accessed":"2026-10-28","secondary":true,"raw":""}],"bucket":"unit","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":"Department for Science, Innovation and Technology","parent_changed":"2026-07 [exact date not found]","head":"Paul Arnold, Interim Chief Executive Officer, from 2026-09-30 (chair vacant; government recruiting)","established":"2025-08-20 (start of first reporting period); ICO functions transferred 2026-09-30","location":"Wilmslow (53.32554, -2.236048)","money":null,"supplier_id_guess":null,"system":null,"rule":null,"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-DCMS-045","name":"Data (Use and Access) Act 2025, sections 135 and 136 (report and impact assessment duties)","page":"dcms","href":"../../dcms/#org=GOV-DCMS-045","page_label":"DCMS"}],"link_texts":[{"kind":"related","target":"succeeded_by ← ICO","ids":[]},{"kind":"parent","target":"DCMS","ids":[]},{"kind":"related","target":"GOV-REG-030 (Data (Use and Access) Act 2025)","ids":["GOV-REG-030"]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-002","name":"Guidance on AI and data protection (2023 update; under review after the DUAA)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2023-03-15","function":"ICO guidance on applying UK GDPR principles to AI systems, restructured by data protection principle and expanded on fairness in March 2023. Now under review because of the Data (Use and Access) Act.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/"],"source_quotes":[{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","quotes":["This guidance was updated on 15 March 2023."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":null,"quotes":["Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"original guidance date not given on page; updated 2023-03-15","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"current, under review (DUAA)","stage_date":"2023-03-15","sponsor":"Information Commissioner's Office","applies_to":"organisations developing or using AI that process personal data"},"topics":["data","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-DCMS-045","name":"Data (Use and Access) Act 2025, sections 135 and 136 (report and impact assessment duties)","page":"dcms","href":"../../dcms/#org=GOV-DCMS-045","page_label":"DCMS"}],"link_texts":[{"kind":"regulates","target":"AI developers and deployers","ids":[]},{"kind":"related","target":"GOV-REG-030","ids":["GOV-REG-030"]}],"div_label":"Department-wide","degree":2,"related_ids":["GOV-REG-003","GOV-REG-004"]},{"id":"GOV-REG-003","name":"Explaining decisions made with AI","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — null","function":"Practical guidance on explaining AI-assisted decisions to the people they affect. Listed on the ICO's AI guidance hub.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/"],"source_quotes":[{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/","quotes":["Explaining decisions made with AI"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"null (date not shown on hub page; predates 2023 [unverified — check])","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"current","stage_date":"null","sponsor":"Information Commissioner's Office","applies_to":"organisations using AI to make or support decisions about individuals"},"topics":["data","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-002","ids":["GOV-REG-002"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-002"]},{"id":"GOV-REG-004","name":"AI and data protection risk toolkit","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — null","function":"Toolkit that helps organisations assess risks to individual rights and freedoms from their own AI systems.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/"],"source_quotes":[{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/","quotes":["AI and data protection risk toolkit"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":null,"location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"current","stage_date":"null","sponsor":"Information Commissioner's Office","applies_to":"organisations building or deploying AI"},"topics":["data","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-002","ids":["GOV-REG-002"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-002"]},{"id":"GOV-REG-005","name":"Biometric data guidance: biometric recognition","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2024-02-23","function":"Guidance on what biometric data and biometric recognition are and how to process them fairly and lawfully, including facial recognition systems. Published the same day as the Serco Leisure enforcement notices.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/","quotes":["the ICO today publishes new guidance for organisations on processing biometric data lawfully."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/","quotes":["Biometric data guidance: Biometric recognition"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2024-02-23","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"current","stage_date":"2024-02-23","sponsor":"Information Commissioner's Office","applies_to":"organisations using biometric recognition, including facial recognition"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-008","ids":["GOV-REG-008"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-008"]},{"id":"GOV-REG-006","name":"Generative AI consultation series (five calls for evidence, 2024)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-09","function":"Five-part consultation on how data protection law applies to generative AI, including the lawful basis for training on web-scraped data and engineering individual rights into models.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/guidance-and-practical-resources/","https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/generative-ai-fourth-call-for-evidence/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/guidance-and-practical-resources/","quotes":["From January to September 2024","ran a five-part generative AI consultation series targeting specific aspects of data protection"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/generative-ai-fourth-call-for-evidence/","quotes":["Generative AI fourth call for evidence: engineering individual rights into generative AI models"],"accessed":null,"secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2024-01","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"consultation","stage":"closed","stage_date":"2024-01 to 2024-09","sponsor":"Information Commissioner's Office","applies_to":"generative AI developers and deployers"},"topics":["data","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"succeeded_by","target":"GOV-REG-007","ids":["GOV-REG-007"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-007"]},{"id":"GOV-REG-007","name":"Response to the consultation series on generative AI (outcomes report)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2024-12-12","function":"Sets out the ICO's updated policy positions on generative AI after more than 200 responses; refines its view on the lawful basis for web-scraped training data and on individual rights in models; found a lack of transparency about training data.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/generative-ai-developers-it-s-time-to-tell-people-how-you-re-using-their-information/","https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/generative-ai-developers-it-s-time-to-tell-people-how-you-re-using-their-information/","quotes":["We found a serious lack of transparency, especially in relation to training data within the industry"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai/","quotes":["In due course, we will be updating our existing guidance to reflect the positions detailed in this response."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2024-12-12","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"published","stage_date":"2024-12-12","sponsor":"Information Commissioner's Office","applies_to":"generative AI developers"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-006","ids":["GOV-REG-006"]},{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]}],"div_label":"Department-wide","degree":3,"related_ids":["GOV-REG-006","GOV-REG-012","GOV-REG-241"]},{"id":"GOV-REG-008","name":"Serco Leisure: enforcement notices on facial recognition and fingerprint scanning of staff","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-02-23","function":"Nine enforcement notices ordering Serco Leisure, Serco Jersey and seven community leisure trusts to stop using facial recognition and fingerprint scanning to monitor attendance of more than 2,000 employees at 38 leisure facilities.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/02/ico-orders-serco-leisure-to-stop-using-facial-recognition-technology/","quotes":["This is neither fair nor proportionate under data protection law."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/","quotes":["ICO orders Serco Leisure to stop using facial recognition technology."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"John Edwards, UK Information Commissioner","established":"2024-02-23","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"enforcement","stage":"notices issued","stage_date":"2024-02-23","sponsor":"Information Commissioner's Office","applies_to":"employers using biometric attendance systems"},"topics":["data","employment and the labour market"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-005","ids":["GOV-REG-005"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-005"]},{"id":"GOV-REG-009","name":"Snap 'My AI' chatbot investigation","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-05-21","function":"Investigation, opened June 2023, into whether Snap assessed data protection risks before launching its generative AI chatbot. Preliminary enforcement notice issued 6 October 2023; closed when Snap produced a compliant risk assessment.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/05/ico-warns-organisations-must-not-ignore-data-protection-risks-as-it-concludes-snap-my-ai-chatbot-investigation/","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/05/ico-warns-organisations-must-not-ignore-data-protection-risks-as-it-concludes-snap-my-ai-chatbot-investigation/","quotes":["Our investigation into 'My AI' should act as a warning shot for industry."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/","quotes":["ICO warns organisations must not ignore data protection risks as it concludes Snap 'My AI' chatbot investigation."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"Stephen Almond, Executive Director of Regulatory Risk (spokesperson)","established":"2023-06","location":null,"money":null,"supplier_id_guess":"biz-snap","system":null,"rule":{"kind":"enforcement","stage":"concluded (no final notice)","stage_date":"2024-05-21","sponsor":"Information Commissioner's Office","applies_to":"Snap, Inc.; generative AI deployers"},"topics":["data","online safety"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"regulates","target":"Snap, Inc.","ids":[]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-010","name":"Statement on Meta's use of user data to train AI","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-09","function":"ICO statement responding to Meta's announcement that it would use UK user data to train AI. Listed by the ICO as part of its AI and biometrics record.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/","quotes":["ICO statement in response to Meta's announcement on user data to train AI."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2024-09 (from URL path)","location":null,"money":null,"supplier_id_guess":"biz-meta","system":null,"rule":{"kind":"report","stage":"statement","stage_date":"2024-09","sponsor":"Information Commissioner's Office","applies_to":"Meta"},"topics":["data"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"regulates","target":"Meta","ids":[]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-011","name":"AI tools in recruitment: audit outcomes report","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-11-06","function":"Consensual audits of developers and providers of AI tools for recruitment sourcing, screening and selection, as part of the ICO's upstream monitoring of AI.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/action-weve-taken/audits-and-overview-reports/2024/11/ai-tools-used-in-recruitment/","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/"],"source_quotes":[{"url":"https://ico.org.uk/action-weve-taken/audits-and-overview-reports/2024/11/ai-tools-used-in-recruitment/","quotes":["how the development and provision of AI recruitment tools complies with UK data protection law."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/","quotes":["AI tools in recruitment."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2024-11-06","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"published","stage_date":"2024-11-06","sponsor":"Information Commissioner's Office","applies_to":"AI recruitment tool developers and providers"},"topics":["data","employment and the labour market"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-012"]},{"id":"GOV-REG-012","name":"Preventing harm, promoting trust: AI and biometrics strategy","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2025-06-25","function":"ICO strategy for AI and biometrics: a statutory code of practice on AI and automated decision-making; work with foundation model developers; fair ADM in recruitment and public services; proportionate police use of facial recognition.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/","quotes":["set clear expectations for responsible AI through a statutory code of practice"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/","quotes":["June 2025 AI and biometrics strategy"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"John Edwards, UK Information Commissioner","established":"2025-06-25 (page metadata date; visible publication date not shown)","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"strategy","stage":"published","stage_date":"2025-06-25","sponsor":"Information Commissioner's Office","applies_to":"AI developers and deployers; police users of facial recognition; public services using ADM"},"topics":["data","regulation and standards","policing and justice"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-013","ids":["GOV-REG-013"]},{"kind":"related","target":"GOV-REG-016","ids":["GOV-REG-016"]}],"div_label":"Department-wide","degree":6,"related_ids":["GOV-REG-007","GOV-REG-011","GOV-REG-013","GOV-REG-014","GOV-REG-016","GOV-REG-025"]},{"id":"GOV-REG-013","name":"AI and biometrics strategy update (March 2026)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-03","function":"Progress report on the strategy: engagement with 11 foundation model developers; draft ADM and profiling guidance due for consultation; police facial recognition audit programme; agentic AI report.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":["developing the secondary legislation which will require the ICO to produce the code of practice."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2026-03","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"published","stage_date":"2026-03","sponsor":"Information Commissioner's Office","applies_to":"AI developers; police forces; central government users of ADM"},"topics":["data","policing and justice","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-012"]},{"id":"GOV-REG-014","name":"Statutory code of practice on AI and automated decision-making","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"planned","status":"planned — 2026-05-29","function":"Code of practice the ICO will produce once government makes the secondary legislation requiring it; to set expectations for organisations developing or deploying AI and ADM.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":["developing the secondary legislation which will require the ICO to produce the code of practice."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/","quotes":["Our areas of focus will include the development of our AI code of practice"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":null,"location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"standard","stage":"in preparation; enabling secondary legislation being developed by government","stage_date":"2026-03","sponsor":"Information Commissioner's Office","applies_to":"organisations developing or deploying AI and ADM"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-DCMS-045","name":"Data (Use and Access) Act 2025, sections 135 and 136 (report and impact assessment duties)","page":"dcms","href":"../../dcms/#org=GOV-DCMS-045","page_label":"DCMS"}],"link_texts":[{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]},{"kind":"related","target":"GOV-REG-030","ids":["GOV-REG-030"]}],"div_label":"Department-wide","degree":5,"related_ids":["GOV-REG-012","GOV-REG-015","GOV-REG-019","GOV-REG-241","GOV-REG-242"]},{"id":"GOV-REG-015","name":"Automated decision-making and profiling guidance (update under the DUAA)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"planned","status":"planned — 2026-03","function":"Update of the ICO's ADM and profiling guidance to reflect the Data (Use and Access) Act's changes to the rules on solely automated decisions; draft due for public consultation in 2026.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/media2/bbzdvqqy/adm-impact-assessment.pdf","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/"],"source_quotes":[{"url":"https://ico.org.uk/media2/bbzdvqqy/adm-impact-assessment.pdf","quotes":["replacing the original Article 22 framework with Articles 22A–22D."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":["in the coming months"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/","quotes":[],"accessed":"2026-10-28","secondary":false,"raw":"https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/ — next steps include updating ADM and profiling guidance, starting with public consultations in 2026 [fetch summary; verbatim not captured] (accessed 2026-10-28)"}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":null,"location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"consultation","stage":"draft guidance and draft impact assessment (March 2026); consultation open/close dates not confirmed in session","stage_date":"2026-03","sponsor":"Information Commissioner's Office","applies_to":"organisations making automated decisions about individuals (UK GDPR Articles 22A–22D; DPA 2018 Part 3)"},"topics":["data","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-DCMS-045","name":"Data (Use and Access) Act 2025, sections 135 and 136 (report and impact assessment duties)","page":"dcms","href":"../../dcms/#org=GOV-DCMS-045","page_label":"DCMS"}],"link_texts":[{"kind":"related","target":"GOV-REG-030","ids":["GOV-REG-030"]},{"kind":"related","target":"GOV-REG-014","ids":["GOV-REG-014"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-014"]},{"id":"GOV-REG-016","name":"Police facial recognition audit programme","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-03","function":"Audits of police use of facial recognition: South Wales and Gwent (summary August 2025), Essex and Leicestershire (summaries March 2026), West Yorkshire (ongoing), Greater Manchester (scheduled April 2026). Findings to be reported when the programme ends.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":["issue public communications on our conclusions and regulatory expectations later this year."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2025","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"enforcement","stage":"audits in progress","stage_date":"2026-03","sponsor":"Information Commissioner's Office","applies_to":"police forces in England and Wales"},"topics":["policing and justice","data"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]},{"kind":"related","target":"GOV-REG-017","ids":["GOV-REG-017"]}],"div_label":"Department-wide","degree":2,"related_ids":["GOV-REG-012","GOV-REG-017"]},{"id":"GOV-REG-017","name":"Response to Home Office consultation on a legal framework for law enforcement biometrics and facial recognition","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2026-02","function":"The ICO's published response to the Home Office consultation on a new legal framework for police use of biometrics and facial recognition.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":[],"accessed":"2026-10-28","secondary":false,"raw":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/ — lists February 2026 publication of the response [fetch summary; verbatim not captured] (accessed 2026-10-28)"}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2026-02","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"consultation","stage":"response published","stage_date":"2026-02","sponsor":"Information Commissioner's Office (respondent); Home Office (consulting)","applies_to":"law enforcement bodies"},"topics":["policing and justice","data"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-016","ids":["GOV-REG-016"]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-016"]},{"id":"GOV-REG-018","name":"ICO Tech Futures: Agentic AI","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-01","function":"Emerging technology report on agentic AI: sets out that organisations stay accountable for agents they develop or deploy, lists risks (unclear controller roles, more automated decisions, excessive processing) and next steps, including industry workshops and a DRCF innovation hub on agentic AI.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/research-reports-impact-and-evaluation/research-and-reports/technology-and-innovation/tech-horizons-and-ico-tech-futures/ico-tech-futures-agentic-ai/","quotes":["Agentic AI combines the capabilities of generative AI with additional tools and new ways of interacting with the world."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/","quotes":[],"accessed":"2026-10-28","secondary":false,"raw":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/ — lists the January 2026 agentic AI report [fetch summary] (accessed 2026-10-28)"}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2026-01 (per March 2026 strategy update; page metadata 2026-10-08)","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"published","stage_date":"2026-01","sponsor":"Information Commissioner's Office","applies_to":"developers and deployers of agentic AI"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-019","ids":["GOV-REG-019"]},{"kind":"partner_of","target":"DRCF","ids":[]}],"div_label":"Department-wide","degree":2,"related_ids":["GOV-REG-019","GOV-REG-242"]},{"id":"GOV-REG-019","name":"Plan for enabling safe AI-powered innovation (response to Technology and Business Secretaries)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-05-29","function":"ICO reply to a January 2026 letter from the Technology and Business Secretaries asking for a plan by end of May 2026, sent as a letter from Paul Arnold MBE, Chief Executive Officer (the letter itself is undated; file name dated 27 May 2026). Commits to an AI and ADM statutory code of practice; guidance on agentic systems under UK GDPR; a \"green cross code-style\" public guide to AI tools; a transparency resource for buying cloud-based AI, aimed at SMEs and public bodies; streamlining and rebranding the Innovation and Sandbox services; support for the government's AI Growth Lab; details in a 2026/27 AI workplan \"in the coming months\".","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"Added or updated by Supplement 1 (edition 2.1).","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/","https://ico.org.uk/media2/q0vf5t0a/letter-to-sos-on-ai-20260527.pdf"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/ico-response-to-government-on-safe-ai-powered-innovation/","quotes":["publish a plan for enabling safe AI-powered innovation by the end of May 2026"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":null,"quotes":["More details on our 2026/27 workplan will be published in our new AI strategy in the coming months."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/media2/q0vf5t0a/letter-to-sos-on-ai-20260527.pdf","quotes":["streamline and rebrand our Innovation and Sandbox services","More detail on these actions will be published in our AI workplan for 2026/27 in the coming months."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"2026-05-29","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"published","stage_date":"2026-05-29","sponsor":"Information Commissioner's Office","applies_to":"AI developers and deployers"},"topics":["data","investment and growth","regulation and standards"],"confidence":"single_source","confidence_raw":"single_source (one publisher, two documents)","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-014","ids":["GOV-REG-014"]},{"kind":"related","target":"GOV-REG-018","ids":["GOV-REG-018"]}],"div_label":"Department-wide","degree":2,"related_ids":["GOV-REG-014","GOV-REG-018"]},{"id":"GOV-REG-020","name":"Guidance on Freedom of Information and AI (AI-generated FOI requests)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-05-06","function":"Guidance for public authorities on handling FOI requests written with AI tools, including requests that misquote the law and higher volumes needing clarification; does not change the law.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/new-guidance-to-support-public-authorities-dealing-with-ai-generated-foi-requests/","https://ico.org.uk/for-organisations/foi/freedom-of-information-foi-and-artificial-intelligence/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/05/new-guidance-to-support-public-authorities-dealing-with-ai-generated-foi-requests/","quotes":["Public authorities are seeing an increase in the volume and complexity of requests generated using AI tools."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/for-organisations/foi/freedom-of-information-foi-and-artificial-intelligence/","quotes":[],"accessed":null,"secondary":false,"raw":"https://ico.org.uk/for-organisations/foi/freedom-of-information-foi-and-artificial-intelligence/ — guidance page linked from the news item (not opened separately)"}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"Deborah Clark, Upstream Regulation Manager (spokesperson)","established":"2026-05-06","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"published","stage_date":"2026-05-06","sponsor":"Information Commissioner's Office","applies_to":"public authorities subject to FOIA"},"topics":["public-sector adoption","data"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"public-sector FOI teams","ids":[]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-021","name":"Clearview AI: £7.5m penalty and Upper Tribunal judgment","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2025-12-19","function":"May 2022 fine of £7.5m and enforcement notice over Clearview's scraping of images of UK residents for facial recognition. On 8 October 2025 the Upper Tribunal upheld three of the Commissioner's four grounds and sent the case back to the First-tier Tribunal; on 19 December 2025 Clearview was given permission to appeal to the Court of Appeal.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/","https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/","quotes":["Clearview's processing of personal information is related to monitoring of behaviour of UK residents."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/what-we-have-achieved-so-far-on-ai-and-biometrics/","quotes":["Information Commissioner seeks permission to appeal Clearview AI Inc ruling."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"John Edwards, UK Information Commissioner","established":"2022-05 (penalty)","location":null,"money":"penalty: 7,500,000 GBP, imposed May 2022, under appeal","supplier_id_guess":"biz-clearview-ai","system":null,"rule":{"kind":"enforcement","stage":"under appeal (Court of Appeal permission granted 2025-12-19)","stage_date":"2025-10-08","sponsor":"Information Commissioner's Office","applies_to":"Clearview AI Inc"},"topics":["data","policing and justice"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"regulates","target":"Clearview AI Inc","ids":[]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-022","name":"ICO: Registration Inbox AI (ATRS record)","type":"AI systems in use","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"live","status":"live — 2026-08-20","function":"Machine-learning model that sorts emails sent to the ICO's registration inbox and auto-replies with a form link when it detects a change-of-address request; about 23,000 emails a month.","composition":"","parent":"ICO","parent_research":"ICO","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://www.gov.uk/algorithmic-transparency-records/information-commissioners-office-registration-inbox-ai"],"source_quotes":[{"url":"https://www.gov.uk/algorithmic-transparency-records/information-commissioners-office-registration-inbox-ai","quotes":["This algorithmic tool helps to categorise emails sent to the ICO’s registration inbox"],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":null,"quotes":["There is no manual intervention in the process - the links are provided to the customer in a fully automated manner."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"system","depts":[{"dept":"Business Services team","div":"business-services-team"}],"colleges":[],"directorate":"Business Services team","previous_parent":null,"parent_changed":null,"head":null,"established":"2021-05-19 (in production)","location":"Wilmslow (53.32554, -2.236048)","money":null,"supplier_id_guess":"biz-ics-ai","system":{"tool_name":"ICO: Registration Inbox AI","owner_body":"Information Commissioner's Office","purpose":"categorise registration inbox emails and auto-reply to change-of-address requests","method":"Naive Bayes classifier","human_oversight":"none in the process (no decision made); misclassified emails get standard acknowledgement","supplier":"ICS.AI (with Microsoft)","registers":"ATRS","register_url":"https://www.gov.uk/algorithmic-transparency-records/information-commissioners-office-registration-inbox-ai","stage":"production","first_published":"2024-02-21 (record published; record also shows \"Date published: 6 July 2022\"; last updated 2026-08-20)"},"rule":null,"topics":["public-sector adoption"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"buys_from","target":"ICS.AI","ids":[]},{"kind":"buys_from","target":"Microsoft","ids":[]}],"div_label":"Business Services team","degree":1,"related_ids":["GOV-REG-026"]},{"id":"GOV-REG-023","name":"ICO: ICE 360 Case Creation Automation (ATRS record)","type":"AI systems in use","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"live","status":"live — 2026-04-13","function":"Uses a large language model (Azure OpenAI gpt-4.1) to read unstructured complaints and queries and create cases in the ICO's case management system, ICE 360; case officers make all decisions.","composition":"","parent":"ICO","parent_research":"ICO","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://www.gov.uk/algorithmic-transparency-records/ico-ice-360-case-creation-automation"],"source_quotes":[{"url":"https://www.gov.uk/algorithmic-transparency-records/ico-ice-360-case-creation-automation","quotes":["Automated case creation for the ICO's primary case management system, ICE 360."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":null,"quotes":["Following case creation, all decisions on cases will be made by case officers."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"system","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"record published 2026-01-14; DPIA approved 2025-03-26","location":null,"money":null,"supplier_id_guess":"biz-kainos","system":{"tool_name":"ICE Case Creation Automation","owner_body":"Information Commissioner's Office","purpose":"create cases from complaints and queries","method":"LLM (Azure OpenAI gpt-4.1) parsing to JSON schema, then automated case creation","human_oversight":"automated cases flagged for manual review; decisions by case officers; failures go to manual queue","supplier":"Kainos Software (Dynamics 365 partner); Nexer Digital (website); Shout Digital (previous website)","registers":"ATRS","register_url":"https://www.gov.uk/algorithmic-transparency-records/ico-ice-360-case-creation-automation","stage":"production","first_published":"2026-01-14"},"rule":null,"topics":["public-sector adoption"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"buys_from","target":"Kainos Software","ids":[]},{"kind":"buys_from","target":"Microsoft (Azure OpenAI)","ids":[]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-026"]},{"id":"GOV-REG-024","name":"ICO: Chatbot (ATRS record)","type":"AI systems in use","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"live","status":"live — 2026-01-14","function":"Chatbot on the ICO website answering enquiries about data protection fees; over 360,000 queries processed.","composition":"","parent":"ICO","parent_research":"ICO","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://www.gov.uk/algorithmic-transparency-records/ico-chatbot"],"source_quotes":[{"url":"https://www.gov.uk/algorithmic-transparency-records/ico-chatbot","quotes":["A chatbot that's hosted on the ICO website to support organisations who have enquiries relating to Data Protection Fees."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":null,"quotes":["ICS.AI built the chatbot for us and currently license and support the chatbot."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"system","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":null,"established":"null (record published 2026-01-14)","location":null,"money":null,"supplier_id_guess":"biz-ics-ai","system":{"tool_name":"ICO Chatbot","owner_body":"Information Commissioner's Office","purpose":"answer data protection fee enquiries","method":"ICS.AI SMART:CHAT, pre-populated storycards plus site search","human_oversight":"\"No human review as no decision making capability\"","supplier":"ICS.AI (framework agreement)","registers":"ATRS","register_url":"https://www.gov.uk/algorithmic-transparency-records/ico-chatbot","stage":"production","first_published":"2026-01-14"},"rule":null,"topics":["public-sector adoption"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"buys_from","target":"ICS.AI","ids":[]}],"div_label":"Department-wide","degree":1,"related_ids":["GOV-REG-026"]},{"id":"GOV-REG-025","name":"Regulating AI: the ICO's strategic approach (April 2024)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2024-04","function":"The ICO's reply to the Secretary of State's request of February 2024 for regulators to set out how they apply the AI white paper principles. Lists planned consultations, audits and a joint statement with the CMA on foundation models.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/media2/migrated/4029424/regulating-ai-the-icos-strategic-approach.pdf","https://www.gov.uk/government/publications/request-for-regulators-to-publish-an-update-on-their-strategic-approach-to-ai-secretary-of-state-letters"],"source_quotes":[{"url":"https://ico.org.uk/media2/migrated/4029424/regulating-ai-the-icos-strategic-approach.pdf","quotes":["We do not consider that the risks relating to AI require new, extensive, cross-cutting legislation, but appropriate resourcing of existing UK regulators and their empowerment to hold organisations to account."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://www.gov.uk/government/publications/request-for-regulators-to-publish-an-update-on-their-strategic-approach-to-ai-secretary-of-state-letters","quotes":["The letters set out a request for an initial set of regulators to publish an update by 30 April 2024."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":"DSIT","parent_changed":null,"head":null,"established":"2024-04","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"strategy","stage":"published","stage_date":"2024-04","sponsor":"Information Commissioner's Office","applies_to":"AI developers and deployers"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-029","ids":["GOV-REG-029"]},{"kind":"related","target":"GOV-REG-012","ids":["GOV-REG-012"]}],"div_label":"Department-wide","degree":2,"related_ids":["GOV-REG-012","GOV-REG-029"]},{"id":"GOV-REG-026","name":"ICO Internal AI Use Policy (the regulator's own use of AI)","type":"Governance and assurance","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-03-06","function":"Rules for ICO staff using AI: approved tools only, human review of outputs, labelling of AI-generated content, limits on personal data, and no solely automated decisions with legal or similar effects. Approved by the Data, AI and Automation Board; owned by the Director of Data.","composition":"","parent":"ICO","parent_research":"ICO","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/media2/u3ad0ucv/internal-ai-use-policy.pdf"],"source_quotes":[{"url":"https://ico.org.uk/media2/u3ad0ucv/internal-ai-use-policy.pdf","quotes":["Data, AI and Automation Board"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"gov","depts":[{"dept":"Data, AI and Automation Programme Board","div":"data-ai-and-automation-programme-board"}],"colleges":[],"directorate":"Data, AI and Automation Programme Board","previous_parent":null,"parent_changed":null,"head":"Paul Arnold MBE, Chief Executive (foreword, August 2025)","established":"2025-08 (version 1.3; last revised 2026-03-06; review due August 2026)","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"in force (internal)","stage_date":"2025-08","sponsor":"Information Commissioner's Office","applies_to":"ICO staff"},"topics":["public-sector adoption"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-022","ids":["GOV-REG-022"]},{"kind":"related","target":"GOV-REG-023","ids":["GOV-REG-023"]},{"kind":"related","target":"GOV-REG-024","ids":["GOV-REG-024"]}],"div_label":"Data, AI and Automation Programme Board","degree":3,"related_ids":["GOV-REG-022","GOV-REG-023","GOV-REG-024"]},{"id":"GOV-REG-027","name":"Joint statement by 61 data protection authorities on AI-generated imagery","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-02-23","function":"International statement, signed by 61 authorities including the ICO, on privacy risks of AI systems that create realistic images and videos of identifiable people without consent, with concern for children.","composition":"","parent":"DCMS","parent_research":"DCMS","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/international-data-protection-authorities-issue-joint-statement-on-privacy-risks-of-ai-generated-imagery/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/international-data-protection-authorities-issue-joint-statement-on-privacy-risks-of-ai-generated-imagery/","quotes":["represents the united position of 61 authorities."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Department-wide","div":"department-wide"}],"colleges":[],"directorate":"Information Commissioner's Office","previous_parent":null,"parent_changed":null,"head":"William Malcolm, Executive Director, Regulatory Risk & Innovation (spokesperson)","established":"2026-02-23","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"report","stage":"joint statement","stage_date":"2026-02-23","sponsor":"Information Commissioner's Office with 60 other authorities","applies_to":"developers and providers of image and video generation tools"},"topics":["data","online safety","international cooperation"],"confidence":"single_source","confidence_raw":"single_source","one_source":true,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"partner_of","target":"international data protection authorities","ids":[]}],"div_label":"Department-wide","degree":0,"related_ids":[]},{"id":"GOV-REG-029","name":"Request for regulators to publish their strategic approach to AI (Secretary of State letters)","type":"Rules and law","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"closed","status":"closed — 2024-04-30","function":"Letters of 15 February 2024 from the Secretary of State for Science, Innovation and Technology asking 13 regulators, including the ICO, CMA, Ofcom and EHRC, to publish by 30 April 2024 how they apply the AI white paper principles.","composition":"","parent":"Department for Science, Innovation and Technology (sender; DSIT functions since redistributed, July 2026)","parent_research":"Department for Science, Innovation and Technology (sender; DSIT functions since redistributed, July 2026)","relationships":"","notes":"","checked":"2026-10-28","website":[],"sources":["https://www.gov.uk/government/publications/request-for-regulators-to-publish-an-update-on-their-strategic-approach-to-ai-secretary-of-state-letters","https://ico.org.uk/media2/migrated/4029424/regulating-ai-the-icos-strategic-approach.pdf"],"source_quotes":[{"url":"https://www.gov.uk/government/publications/request-for-regulators-to-publish-an-update-on-their-strategic-approach-to-ai-secretary-of-state-letters","quotes":["The letters set out a request for an initial set of regulators to publish an update by 30 April 2024."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/media2/migrated/4029424/regulating-ai-the-icos-strategic-approach.pdf","quotes":["a request by the Secretary of State for Science, Innovation and Technology"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"rule","depts":[{"dept":"Group record","div":"group-record"}],"colleges":[],"directorate":"Group record (applies to ICO, CMA, Ofcom, EHRC and nine other regulators)","previous_parent":null,"parent_changed":null,"head":"Michelle Donelan, Secretary of State for Science, Innovation and Technology (sender, February 2024)","established":"2024-02-15","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"guidance","stage":"responses due","stage_date":"2024-04-30","sponsor":"Department for Science, Innovation and Technology","applies_to":"Financial Conduct Authority; Bank of England; ICO; Ofcom; MHRA; Office for Nuclear Regulation; HSE; Ofsted; Ofqual; Legal Services Board; Ofgem; CMA; EHRC"},"topics":["regulation and standards"],"confidence":"verified","confidence_raw":"verified","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-025","ids":["GOV-REG-025"]},{"kind":"related","target":"CMA, Ofcom and EHRC strategic updates (below)","ids":[]}],"div_label":"Group record","degree":1,"related_ids":["GOV-REG-025"]},{"id":"GOV-REG-240","name":"ICO investigation into X Internet Unlimited Company and X.AI LLC (Grok)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-02-03","function":"Formal data protection investigations into XIUC and X.AI covering their processing of personal data in relation to the Grok AI system and its potential to produce harmful sexualised images and video. The ICO will test whether data was processed lawfully, fairly and transparently and whether safeguards were built in; no finding had been reached at launch. Opened the same day as Ofcom's update on its own X investigation. In October 2026 the ICO said it had paused its wider engagement with X.AI because of this investigation.","composition":"","parent":"Information Commission (ICO at the time) — sponsor DCMS","parent_research":"Information Commission (ICO at the time) — sponsor DCMS","relationships":"","notes":"Added or updated by Supplement 1 (edition 2.1).","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/","quotes":["Losing control of personal data in this way can cause immediate and significant harm."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/","quotes":["We’ve opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI)"],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Regulatory Risk","div":"regulatory-risk"}],"colleges":[],"directorate":"Regulatory Risk & Innovation","previous_parent":"DSIT","parent_changed":"2026-07","head":"William Malcolm, Executive Director Regulatory Risk & Innovation (quoted)","established":"2026-02-03","location":null,"money":null,"supplier_id_guess":"biz-x ; biz-xai","system":null,"rule":{"kind":"enforcement","stage":"investigation open","stage_date":"2026-02-03","sponsor":"ICO","applies_to":"X Internet Unlimited Company; X.AI LLC"},"topics":["data","online safety","regulation and standards"],"confidence":"verified","confidence_raw":"verified (one publisher, two pages; no second publisher opened)","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-REG-057","name":"Investigation into X Internet Unlimited Company (Grok-generated intimate imagery)","page":"regulators/ofcom","href":"../../regulators/ofcom/#org=GOV-REG-057","page_label":"Ofcom"},{"kind":"related","id":"GOV-REG-058","name":"Ofcom update on the scope of the Online Safety Act for AI chatbots","page":"regulators/ofcom","href":"../../regulators/ofcom/#org=GOV-REG-058","page_label":"Ofcom"}],"link_texts":[{"kind":"regulates","target":"X Internet Unlimited Company","ids":[]},{"kind":"regulates","target":"X.AI LLC","ids":[]},{"kind":"related","target":"GOV-REG-057","ids":["GOV-REG-057"]},{"kind":"related","target":"GOV-REG-058","ids":["GOV-REG-058"]},{"kind":"related","target":"GOV-REG-241","ids":["GOV-REG-241"]}],"div_label":"Regulatory Risk","degree":1,"related_ids":["GOV-REG-241"]},{"id":"GOV-REG-241","name":"\"Building trust and transparency into generative AI development\" — changes secured from ten AI developers (October 2026)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-10-08","function":"ICO report and announcement on its supervision of foundation model developers. Ten developers (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI) made or committed to changes such as clearer transparency information, stronger ways for people to use their rights, and tougher safeguard assessments; the ICO is monitoring them. X.AI is excluded while it is under investigation. Next steps include the statutory code of practice on AI and ADM, guidance on agentic AI, scrutiny of developers' reliance on legitimate interests, and work on special category data in training.","composition":"","parent":"Information Commission (ICO branding)","parent_research":"Information Commission (ICO branding)","relationships":"","notes":"Added or updated by Supplement 1 (edition 2.1).","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/","https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/","quotes":["the fact AI agents act with autonomy is not an excuse for poor compliance."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/","quotes":["We will continue to work with developers that engage constructively and seek to improve practices."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Technology Regulation","div":"technology-regulation"}],"colleges":[],"directorate":"Technology Regulation","previous_parent":null,"parent_changed":null,"head":"Richard Nevinson, Director of Technology Regulation (quoted)","established":"2026-10-07 (report page date; page metadata says 13 October 2026; news item 8 October 2026)","location":null,"money":null,"supplier_id_guess":"biz-amazon ; biz-anthropic ; biz-apple ; biz-cohere ; biz-deepseek ; biz-google ; biz-meta ; biz-microsoft ; biz-openai ; biz-stability-ai","system":null,"rule":{"kind":"report","stage":"published","stage_date":"2026-10-08","sponsor":"ICO","applies_to":"foundation model developers"},"topics":["data","regulation and standards"],"confidence":"verified","confidence_raw":"verified (one publisher, two pages)","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[],"link_texts":[{"kind":"related","target":"GOV-REG-007","ids":["GOV-REG-007"]},{"kind":"related","target":"GOV-REG-014","ids":["GOV-REG-014"]},{"kind":"related","target":"GOV-REG-240","ids":["GOV-REG-240"]},{"kind":"related","target":"GOV-REG-242","ids":["GOV-REG-242"]}],"div_label":"Technology Regulation","degree":4,"related_ids":["GOV-REG-007","GOV-REG-014","GOV-REG-240","GOV-REG-242"]},{"id":"GOV-REG-242","name":"Agentic AI call for evidence (8 October to 20 November 2026)","type":"Regulator actions","category":"Information Commissioner's Office / Information Commission","affiliation":"Group page (sub-page per regulator)","status_group":"current","status":"current — 2026-10-08","function":"Six-week call for evidence on how data protection law applies to agentic AI, in sections on data security, transparency, accountability, automated decision-making, fairness and purpose limitation, and lawfulness. Responses through Citizen Space; evidence will feed ICO guidance and the statutory code on AI and ADM. The ICO has also made enquiries with OpenAI, Anthropic, Meta and the AI Security Institute about recent agentic AI testing and deployment.","composition":"","parent":"Information Commission (ICO branding)","parent_research":"Information Commission (ICO branding)","relationships":"","notes":"Added or updated by Supplement 1 (edition 2.1).","checked":"2026-10-28","website":[],"sources":["https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/"],"source_quotes":[{"url":"https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/","quotes":["The consultation will remain open until the end of 20 November 2026."],"accessed":"2026-10-28","secondary":false,"raw":""},{"url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/","quotes":["robust data protection safeguards become even more critical."],"accessed":"2026-10-28","secondary":false,"raw":""}],"bucket":"reg","depts":[{"dept":"Technology Regulation","div":"technology-regulation"}],"colleges":[],"directorate":"Technology Regulation","previous_parent":null,"parent_changed":null,"head":"Richard Nevinson, Director of Technology Regulation (quoted in the launch item)","established":"2026-10-08","location":null,"money":null,"supplier_id_guess":null,"system":null,"rule":{"kind":"consultation","stage":"open","stage_date":"2026-10-08 (closes 2026-11-20)","sponsor":"ICO","applies_to":"organisations developing or deploying agentic AI"},"topics":["data","regulation and standards","safety and security"],"confidence":"verified","confidence_raw":"verified (one publisher, two pages)","one_source":false,"as_of":"2026-10-28","rec_table":[],"ext_links":[{"kind":"related","id":"GOV-CO-005","name":"AI Security Institute (AISI)","page":"cabinet-office","href":"../../cabinet-office/#org=GOV-CO-005","page_label":"Cabinet Office"}],"link_texts":[{"kind":"related","target":"GOV-REG-018","ids":["GOV-REG-018"]},{"kind":"related","target":"GOV-REG-014","ids":["GOV-REG-014"]},{"kind":"related","target":"GOV-REG-241","ids":["GOV-REG-241"]},{"kind":"related","target":"AI Security Institute (Cabinet Office page)","ids":["GOV-CO-005"]}],"div_label":"Technology Regulation","degree":3,"related_ids":["GOV-REG-014","GOV-REG-018","GOV-REG-241"]}],"links":[{"source":"GOV-REG-003","target":"GOV-REG-002","kind":"related","evidence":"GOV-REG-003 links: related → GOV-REG-002"},{"source":"GOV-REG-004","target":"GOV-REG-002","kind":"related","evidence":"GOV-REG-004 links: related → GOV-REG-002"},{"source":"GOV-REG-005","target":"GOV-REG-008","kind":"related","evidence":"GOV-REG-005 links: related → GOV-REG-008"},{"source":"GOV-REG-006","target":"GOV-REG-007","kind":"succeeded_by","evidence":"GOV-REG-006 links: succeeded_by → GOV-REG-007"},{"source":"GOV-REG-007","target":"GOV-REG-012","kind":"related","evidence":"GOV-REG-007 links: related → GOV-REG-012"},{"source":"GOV-REG-011","target":"GOV-REG-012","kind":"related","evidence":"GOV-REG-011 links: related → GOV-REG-012"},{"source":"GOV-REG-012","target":"GOV-REG-013","kind":"related","evidence":"GOV-REG-012 links: related → GOV-REG-013"},{"source":"GOV-REG-012","target":"GOV-REG-016","kind":"related","evidence":"GOV-REG-012 links: related → GOV-REG-016"},{"source":"GOV-REG-014","target":"GOV-REG-012","kind":"related","evidence":"GOV-REG-014 links: related → GOV-REG-012"},{"source":"GOV-REG-015","target":"GOV-REG-014","kind":"related","evidence":"GOV-REG-015 links: related → GOV-REG-014"},{"source":"GOV-REG-016","target":"GOV-REG-017","kind":"related","evidence":"GOV-REG-016 links: related → GOV-REG-017"},{"source":"GOV-REG-018","target":"GOV-REG-019","kind":"related","evidence":"GOV-REG-018 links: related → GOV-REG-019"},{"source":"GOV-REG-019","target":"GOV-REG-014","kind":"related","evidence":"GOV-REG-019 links: related → GOV-REG-014"},{"source":"GOV-REG-025","target":"GOV-REG-029","kind":"related","evidence":"GOV-REG-025 links: related → GOV-REG-029"},{"source":"GOV-REG-025","target":"GOV-REG-012","kind":"related","evidence":"GOV-REG-025 links: related → GOV-REG-012"},{"source":"GOV-REG-026","target":"GOV-REG-022","kind":"related","evidence":"GOV-REG-026 links: related → GOV-REG-022"},{"source":"GOV-REG-026","target":"GOV-REG-023","kind":"related","evidence":"GOV-REG-026 links: related → GOV-REG-023"},{"source":"GOV-REG-026","target":"GOV-REG-024","kind":"related","evidence":"GOV-REG-026 links: related → GOV-REG-024"},{"source":"GOV-REG-240","target":"GOV-REG-241","kind":"related","evidence":"GOV-REG-240 links: related → GOV-REG-241"},{"source":"GOV-REG-241","target":"GOV-REG-007","kind":"related","evidence":"GOV-REG-241 links: related → GOV-REG-007"},{"source":"GOV-REG-241","target":"GOV-REG-014","kind":"related","evidence":"GOV-REG-241 links: related → GOV-REG-014"},{"source":"GOV-REG-241","target":"GOV-REG-242","kind":"related","evidence":"GOV-REG-241 links: related → GOV-REG-242"},{"source":"GOV-REG-242","target":"GOV-REG-018","kind":"related","evidence":"GOV-REG-242 links: related → GOV-REG-018"},{"source":"GOV-REG-242","target":"GOV-REG-014","kind":"related","evidence":"GOV-REG-242 links: related → GOV-REG-014"}],"placement_method":{"root":25,"tree":3,"head":3}}