UK Automated Decision-Making Code Now Binding Law

The UK Data Protection Act 2018 (Code of Practice on AI and Automated Decision-Making) Regulations 2026, enacted as SI 2026/425, came into force in August 2026, transforming the ICO's previously advisory guidance on automated decision-making into a binding code of practice. Law firms using AI systems that make or substantially influence decisions affecting data subjects — including client intake, matter allocation, credit assessment, or staff performance management — are now subject to enforceable standards on transparency, human oversight, and challenge rights. The Regulations sit alongside rather than replace the GDPR's existing Article 22 automated decision-making framework, creating a layered compliance obligation. Firms that have mapped their AI systems to Article 22 but have not reviewed the new ICO Code should conduct that review before year-end.