SI 2026/425 in force: ICO now under statutory duty to write an AI/ADM Code of Practice
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), in force since 12 May 2026, put the Information Commissioner under a fresh statutory duty (new s.124A DPA, inserted by the Data (Use and Access) Act 2025) to produce a formal Code on AI and ADM, with a mandatory children's-data component — a 17 August advisory flags this as arguably the most significant AI instrument the ICO has yet been handed. The ICO's own draft ADM guidance (consultation closed 29 May) previews the direction ahead of final guidance expected this summer and the statutory Code itself in 2027; once finalised, the Code carries the same weight as the Children's Code — courts must have regard to it, and so must the ICO in enforcement. Crucially it catches deployers, not just developers: any organisation using a third-party AI/ADM tool on UK-connected individuals is in scope, including businesses with no UK presence at all where they offer AI-enabled goods/services to, or monitor, people in the UK. Practical read for the corridor and Aegis Guard's UK DUAA rule: this is the ICO formally signalling the enforcement benchmark that rule will eventually be measured against, and a live prompt to check any UK-facing client's recruitment/credit/HR AI tooling for 'meaningful human involvement' (active review, not token sign-off) now, well ahead of 2027.
Source: Arnold & Porter (James Castro-Edwards), citing SI 2026/425
Unsure which of these developments applies to your AI systems?
Begin in writing →This briefing is general information, not legal advice, and does not create an advisor–client relationship. Summaries are original; follow source links for the full record. Adesanya AI Advisory — Abdulwahab B. Adesanya, Barrister-at-Law (Nigeria).