UK ICO Gets New Statutory Duty to Produce AI Code of Practice

Arnold & Porter's August 17 advisory confirmed that the UK Information Commissioner's Office has acquired a new statutory duty to produce an AI Code of Practice under the Data (Use and Access) Act 2025 — a legally binding framework governing how organizations subject to UK GDPR develop and deploy AI systems. The Code, when published, will create formal obligations for assessing AI automated decision-making, data minimization in AI training, and explainability for AI outputs that affect individuals. The advisory recommends that all organizations using AI that are subject to UK GDPR begin now by inventorying their AI and automated decision-making systems, mapping data flows, and assessing the adequacy of current documentation and human-oversight mechanisms. For law firms advising clients with UK operations on AI governance, the ICO Code will become a mandatory compliance layer alongside the EU AI Act for EU-market operations — creating a two-jurisdiction compliance framework for transatlantic legal teams, with UK law remaining separate from the EU regime post-Brexit. The ICO Code's publication timeline has not been confirmed; early engagement with the ICO's consultation process is recommended.