The document is confirmed. SI 2026/425 is now laid before Parliament, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026. The title alone tells the compliance story: the UK is governing AI data processing not through a standalone AI law, but through its existing data protection framework. The Information Commissioner’s Office will be responsible for producing the code of practice. That’s the ICO, which already oversees GDPR-equivalent enforcement in the UK. The regulatory infrastructure is already there. The mandate is now statutory.
Legal commentary on the SI reports a commencement date of May 12, 2026. Organizations should verify this date directly against the full SI text at legislation.gov.uk before treating it as a confirmed compliance deadline, the commencement provision is sourced to secondary legal commentary rather than confirmed primary text in this reporting cycle.
What is confirmed: the SI exists, it’s been laid before Parliament, and it tasks the ICO with issuing AI-specific guidance on data processing. The practical implications of that mandate are clear even before the code is published. Any organization currently using AI systems to process UK personal data needs to be preparing for ICO guidance that will have binding weight under the Data Protection Act 2018 framework.
Three areas are flagged in legal commentary as being specifically addressed in the code: the processing of children’s data in AI systems; automated decision-making pipelines; and national security exclusions from the advisory panel’s remit. EdTech operators and platform services handling child users in the UK should treat the children’s data angle as a priority, the UK’s existing protections for children’s data under GDPR-equivalent law are already strict, and AI system integration will tighten that further. These provisions are drawn from legal commentary on the SI and should be verified against the primary text.
The UK’s architectural choice here is worth understanding. The EU built a standalone AI Act. Japan passed a standalone AI Promotion Act. The UK is routing AI governance through its existing data protection statute. Each choice carries different compliance implications. For organizations that already have UK GDPR programs in place, this means the ICO’s AI code of practice lands within a framework they’re already obligated to follow, there’s no separate AI compliance track. The obligations attach to existing data protection infrastructure.
That’s a materially different compliance burden than preparing for the EU AI Act’s risk-tier requirements, which demand separate conformity assessments and documentation for high-risk applications. The UK approach is more familiar, but “more familiar” doesn’t mean lower stakes. ICO enforcement has real teeth.
This is one of two major statutory AI framework developments this week, Japan’s AI Promotion Act Basic Plan activation is covered in a separate brief. Together, they mark a significant moment: three major democratic jurisdictions now have active or imminent statutory AI frameworks, each with a distinct architecture. See today’s deep-dive for the full three-jurisdiction comparison.