Library
ICO's AI and ADM Code: Status Tracker
As of 13 August 2026 the ICO is under a statutory duty to prepare a code of practice on AI and automated decision-making (SI 2026/425, in force 12 May 2026). The code itself has not been published. Separate ADM guidance was consulted on until 29 May 2026; the ICO currently lists the final version as due in winter 2026.
Last reviewed
MikeFounder & developer
- UK AI
- Compliance
On this page
Who this is for
- UK controllers waiting to “see the ICO code” before they change an ADM process (you should not wait)
- Operators already live under Articles 22A–22D who need to know the code is not a pause button
- Anyone tracking whether the code has moved from duty, to draft, to consultation, to Parliament, to force
- Readers putting UK dates on the global calendar
Status board: 13 August 2026
| Item | Status | Source | What it means for you |
|---|---|---|---|
| Duty to prepare a statutory code on AI and ADM | Live since 12 May 2026 | SI 2026/425, regs 1–2. Laid 21 April 2026, made 16 April 2026. | The Commissioner must write the code. You do not yet have a code to follow as a statutory benchmark. |
| Scope of the future code | Set | SI 2026/425 reg. 2: good practice in processing personal data when developing and using AI, and automated decision-making (defined by reference to UK GDPR Art. 22C(1) and DPA 2018 s.50C(1)). Must include children's personal data. | When it lands, it will cover development and use, not only chatbots. |
| Panel / national security carve-out | Set | SI 2026/425 reg. 3, modifying DPA 2018 s.124B | Process detail. Not an operator duty. |
| Draft of the statutory code | Not published | No ICO consultation on the code itself as of 13 August 2026 | Do not cite a “draft code”. There isn't one in public. |
| ADM guidance (not the code) | Consultation closed 29 May 2026 (opened 31 March 2026). Draft still on the ICO site. Final version listed as winter 2026. | ICO consultation page; ICO “Technology” guidance plan (ADM entry: stage drafting / consultation closed / final due winter 2026) | This is the nearest public read of how the ICO will apply Arts 22A–22D. It is guidance, not the statutory code. |
| Statutory code consultation | Not opened | ICO has not announced a consultation window for the code as of 13 August 2026 | Secondary commentary sometimes says “spring 2027”. That is not an ICO date we can verify. Treat consultation timing as unclear as of 13 August 2026. |
| Code in force | No | A DPA 2018 code of practice takes effect only after the statutory panel/laying process | Courts and the ICO must take a finished, in-force code into account. We are not there. |
Warning: Section 80 ADM rules are already in force (5 February 2026). Waiting for this code does not pause Articles 22A–22D.
What this page is not
This page does not guess what the code will say. The code has not been drafted in public. Guessing the contents would make this page false the week a draft appears.
The ICO's existing AI-and-data-protection guidance, and the draft ADM guidance, remain the documents you can actually open. The regulator map is on Who enforces what.
What to do while you wait
- Run ADM against Article 22C now. Safeguards, not slogans.
- Align processes with the draft ADM guidance where it is clearer than the statute, and record that you did so knowing it may move in winter 2026.
- Put a review date on the inventory when the code is consulted. Building an AI system inventory.
- Revisit this page. A tracker is only useful if someone actually reopens it.
Questions
Is the AI and ADM code in force?
No. SI 2026/425 is in force. That instrument is the duty to prepare the code, not the code.
Is the ADM guidance the code?
No. The guidance update is a separate ICO product. Consultation closed 29 May 2026. Final version due winter 2026 on the ICO's own plan. The statutory code comes after, via the DPA 2018 procedure.
When will the code be consulted on?
Unclear as of 13 August 2026. The ICO has not published a consultation date for the code. Do not plan against a blog's “spring 2027” unless the ICO says it.
Do we have to follow a code that does not exist?
You have to follow the UK GDPR as amended. A future code will be the statutory reading of good practice. Building to 22C and to the draft guidance is the honest position today.
What changed
- 13 August 2026: First publication. Cadence: high-risk / fast-moving (30–90 days). Next review due 13 October 2026. Off-cycle the day the ICO opens a code consultation, publishes a draft, or ships the winter 2026 ADM guidance.
Note: This is compliance consulting and training, not legal advice. We work alongside your legal counsel, translating regulation into operational reality rather than replacing them. For a structured pass, see AI compliance.
Was this helpful?
Also in the library
- The Data (Use and Access) Act 2025 and the New UK ADM RegimeSection 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A–22D from 5 February 2026. The old default was prohibition-plus-exceptions. The new default for most significant automated decisions is permission-plus-safeguards. Special-category decisions stay tighter.
- The Global AI & Data Regulation CalendarNext hard date after 13 August 2026: 2 December 2026. EU Article 50(2) marking grace ends, and two new Article 5 prohibitions apply. The table below is every live and upcoming deadline we currently track from the EU, UK, US and China pages. It will move. That is why the page exists.
- UK AI Regulation: Who Enforces WhatAs of 13 August 2026 there is no UK AI Act and no government AI bill before Parliament. Enforcement sits with existing regulators: ICO, CMA, FCA, MHRA, Ofcom, under existing law. A statutory ICO code on AI and ADM is required; the code itself is not yet in force.