ICO confirms timetable for ADM guidance and statutory AI code

The Information Commissioner’s Office has published an updated workplan saying it will finalise guidance on automated decision‑making (including profiling) after its current consultation and is preparing a binding statutory code of practice on AI and ADM under new statutory powers.

In a consultation launched in March 2026 and a Q4 performance annex published on 16 June 2026, the ICO set out a timetable that moves the regulator from advisory guidance toward a legally enforceable code intended to sit alongside the UK GDPR and the Data Protection Act 2018. The consultation covers draft guidance on automated decision‑making and profiling; the annex explains the ICO’s intention to follow that consultation with finalised guidance and to develop a statutory code on AI and ADM.

The shift reflects the ICO’s aim to sharpen regulatory expectations for organisations that deploy automated systems. The regulator says final guidance will clarify how data‑protection requirements apply to systems that make or assist decisions about people, and that a statutory code will make certain standards binding where its new powers allow.

For employers, the move raises the regulatory stakes for AI used in recruitment, candidate screening, performance management and workplace monitoring. Tools that score CVs, rank applicants, flag ‘suitability’ or automate disciplinary or performance decisions will be subject to closer scrutiny under the existing data‑protection framework, and the ICO’s planned code is likely to set clearer legal baselines for acceptable practice.

The development is part of a broader regulatory trend: authorities in the UK and overseas are increasingly focused on the consumer‑ and worker‑facing risks of automated systems. The ICO’s approach — combining updated guidance with a statutory, enforceable code — mirrors a move by regulators to pair interpretive guidance with hard standards that can be used in investigations and enforcement.

The ICO’s material does not, however, resolve several practical questions that matter to employers and HR teams. The annex does not specify firm publication dates for the final guidance or for the statutory AI/ADM code, nor does it set out the precise scope of obligations that will become mandatory under the code. The regulator has not detailed whether the code will include sector‑specific provisions for employment technology, mandatory algorithmic impact assessments, independent bias audits, or explicit certification routes for vendors and in‑house systems.

The ICO also stops short of explaining how the code will interact with other forthcoming UK AI measures or with regulators outside the data‑protection sphere, leaving uncertainty about cross‑regulatory coordination for complex systems used by large employers and platforms.

For HR leaders and in‑house counsel, the practical implication is a narrowing window to get documentation and governance in order. Organisations that rely on automated tools should expect expectations to harden: the difference between guidance and a statutory code is enforcement teeth, and the ICO’s timetable signals that data‑protection compliance will increasingly be tested against AI‑specific benchmarks.

As the ICO moves from consultation to a binding code, employers will need to track how the regulator defines fairness, transparency and human oversight in the context of workplace systems. The regulator’s next steps — publication of final guidance and the drafting of the statutory code — will determine whether routine talent‑technology practices require redesign or formal mitigation measures to remain lawful under UK data‑protection law and the forthcoming AI‑specific obligations.