UK Data Protection Act 2026 — Automated Decision-Making Code of Practice Now in Force

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force as UK statutory instrument 2026/425, creating a binding code of practice that applies to organisations using AI for automated decision-making with legal or similarly significant effects. For law firms, the code creates compliance obligations at the intersection of UK GDPR, the Data Protection Act, and AI use: any firm using AI to make or substantially influence decisions about individuals — including in areas such as client risk scoring, matter allocation, staffing decisions, or automated contract review tools that generate outputs acting on without meaningful human oversight — needs to assess the code's applicability and align its AI governance documentation accordingly. The code sits within the UK's principles-based regulatory approach, which diverges from the EU AI Act's prescriptive obligations but will increasingly converge in practical effect as both regimes require documented AI governance, risk assessment, and accountability. For transatlantic practices advising clients with UK and EU operations, the combination of the UK's automated decision-making code and the EU's Article 50 obligations creates the most operationally significant compliance pairing of the year — affecting client-facing AI tools, internal workflow automation, and any AI system involved in decisions with individual impact.