The ICO's AI governance framework: uniquely detailed
The UK Information Commissioner's Office has produced AI-specific guidance that is more operationally detailed than comparable guidance from most European data protection authorities. The ICO's Explaining Decisions Made with AI guidance, its AI auditing framework, and its specific guidance on bias in AI systems provide organisations with concrete implementation standards that translate data protection law into AI engineering and governance requirements.
The depth of ICO AI guidance reflects the UK's approach to AI regulation post-Brexit — a principles-based framework with detailed sector and use-case guidance, rather than the EU's more prescriptive cross-sectoral AI Act approach. UK organisations benefit from detailed operational guidance but face uncertainty about how the principles will evolve as the regulatory environment develops.
Article 22 UK GDPR: automated decision-making
Article 22 UK GDPR gives individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The ICO's guidance on this provision is more detailed and practical than most national DPA guidance on the equivalent EU GDPR provision. Key ICO positions: "solely" automated means that human involvement must be meaningful — a human who reviews an algorithmic output without the information or capacity to meaningfully assess it is not providing the human involvement that Article 22 requires. The "significant effects" threshold covers decisions about credit, employment, insurance, and many other contexts where an automated decision affects a person's access to services or opportunities.
For AI systems that make or substantially influence these decisions, Article 22 requires either explicit consent, contractual necessity, or UK law authorisation. In each case, the organisation must implement "suitable measures to safeguard the data subject's rights and freedoms and legitimate interests" — at minimum, the right to obtain human intervention, to express their point of view, and to contest the decision.
The ICO's AI bias guidance
The ICO's guidance on AI and data protection includes specific provisions on bias that go beyond the discrimination provisions of UK equality law. The ICO requires that organisations identify and address bias in AI systems as a data protection obligation — not merely as an ethical aspiration. The specific requirements: organisations must assess their AI systems for potential bias in training data, in feature selection, and in outputs; must test for discriminatory outcomes against relevant groups; and must document this assessment and its results as part of their accountability obligations under UK GDPR. The ICO has signalled that failure to conduct adequate bias assessment is a data protection failure that can give rise to enforcement action.
