United Kingdom: Data Protection Act (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations enter into force

On 12 May 2026, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations enter into force. The regulations require the Information Commissioner’s Office (ICO) to develop a code of practice providing guidance on the processing of personal data in the development and use of artificial intelligence and automated decision-making systems. They also require the ICO to issue guidance on the processing of children’s personal data. In addition, the regulations amend the panel requirements under the Data Protection Act 2018 to exclude any matters relating to national security from the panel’s reporting.