# The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026

S.I. 2026/425 · made 16 April 2026

These Regulations require the Information Commissioner (“the Commissioner”) to prepare a code of practice on the processing of personal data under relevant data protection legislation in relation to developing and using artificial intelligence and automated decision-making. Relevant data protection legislation is defined in regulation 2 as the UK GDPR and the Data Protection Act 2018 (“the 2018 Act”), except Part 4 (intelligence services processing).

Made under: Data Protection Act 2018 (Section 124A, Section 124B)

PDFs: Printed copy https://openlegislation.uk/data-protection-act-2018-code-of-practice-on-artificial-intelligence-and-automated-decision-making-regulations-2026/pdf/uksi_20260425_en.pdf; UK Explanatory Memorandum https://openlegislation.uk/data-protection-act-2018-code-of-practice-on-artificial-intelligence-and-automated-decision-making-regulations-2026/pdf/uksiem_20260425_en_001.pdf

## Introductory text

DATA PROTECTION
Made 16th April 2026
Laid before Parliament 21st April 2026
Coming into force 12th May 2026
The Secretary of State makes these Regulations in exercise of the powers conferred by section 124A(1) and (2) and section 124B(11) of the Data Protection Act 2018. In accordance with section 182(2) of that Act, the Secretary of State has consulted the Commissioner and such other persons as the Secretary of State considers appropriate.

## 1 Citation, commencement, extent and interpretation

(1) These Regulations may be cited as The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026.
(2) These Regulations come into force 21 days after the day on which they are laid.
(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.
(4) In these Regulations, “the 2018 Act” means the Data Protection Act 2018.

## 2 The code of practice

(1) The Commissioner must prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data under the relevant data protection legislation in relation to—
(a) developing and using artificial intelligence, and
(b) automated decision-making.
(2) The code of practice must include guidance as to good practice in the processing of children’s personal data.
(3) In this regulation—
“automated decision-making” means—
(a) decision-making to which Article 22C(1) of the UK GDPR applies, or
(b) decision-making to which section 50C(1) of the 2018 Act applies.
“relevant data protection legislation” means—
(a) the UK GDPR, and
(b) the 2018 Act, except Part 4 of that Act.

## 3 Modification to panel requirements

Section 124B of the 2018 Act applies to the preparation or amendment of the code of practice required under regulation 2 as if after subsection (7) there were inserted—
“(7A) The panel must not consider or report on any aspect of the code relating to national security.”.

## Signature

Ian Murray
Minister of State
Department for Science, Innovation and Technology
16th April 2026

## Explanatory note

(This note is not part of the Regulations)
These Regulations require the Information Commissioner (“the Commissioner”) to prepare a code of practice on the processing of personal data under relevant data protection legislation in relation to developing and using artificial intelligence and automated decision-making. Relevant data protection legislation is defined in regulation 2 as the UK GDPR and the Data Protection Act 2018 (“the 2018 Act”), except Part 4 (intelligence services processing).
Regulation 3 modifies the requirements under section 124B of the 2018 Act for the Commissioner to establish a panel of individuals to consider the code of practice by providing that the panel must not consider or report on any aspect of the code of practice relating to national security.
A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen as a result of the instrument itself. The Commissioner is required to produce an impact assessment when preparing the code of practice under these Regulations.

---
Source: https://www.legislation.gov.uk/uksi/2026/425 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018-code-of-practice-on-artificial-intelligence-and-automated-decision-making-regulations-2026
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.