# The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, Note: Explanatory note


(This note is not part of the Regulations)
These Regulations require the Information Commissioner (“the Commissioner”) to prepare a code of practice on the processing of personal data under relevant data protection legislation in relation to developing and using artificial intelligence and automated decision-making. Relevant data protection legislation is defined in regulation 2 as the UK GDPR and the Data Protection Act 2018 (“the 2018 Act”), except Part 4 (intelligence services processing).
Regulation 3 modifies the requirements under section 124B of the 2018 Act for the Commissioner to establish a panel of individuals to consider the code of practice by providing that the panel must not consider or report on any aspect of the code of practice relating to national security.
A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen as a result of the instrument itself. The Commissioner is required to produce an impact assessment when preparing the code of practice under these Regulations.

---
Source: https://www.legislation.gov.uk/uksi/2026/425/note (the official version)
Page: https://openlegislation.uk/data-protection-act-2018-code-of-practice-on-artificial-intelligence-and-automated-decision-making-regulations-2026/note
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.