Britain Orders a Statutory AI Code: What SI 2026/425 Requires

On 12 May 2026, a new statutory instrument came into force requiring the UK Information Commissioner to write Britain's first binding code of practice on artificial intelligence and automated decision-making — moving the country from voluntary guidance to a code with statutory footing under data-protection law.

The instrument — The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, SI 2026 No. 425 — was made on 16 April 2026, laid before Parliament on 21 April, and took effect on 12 May. It is made under sections 124A and 124B of the Data Protection Act 2018, and it applies across England and Wales, Scotland and Northern Ireland.

What changes

The delta is the legal status of the guidance. The Information Commissioner has published AI guidance for years as good-practice material. Regulation 2 converts that posture into an obligation: the Commissioner must prepare a statutory code of practice on the processing of personal data in AI and automated decision-making. A statutory code carries evidential weight — regulators and courts take it into account when assessing compliance — where voluntary guidance sits one tier below. Regulation 3 places the code's national-security aspects beyond the review panel's remit, and the Commissioner must produce an impact assessment when preparing the code.

The governance signal

The governance signal is a third regulatory method taking shape. The EU codified obligations in a risk-based Act; we mapped that structure in our EU AI Act coverage. We explored this in detail here. The US produced state-by-state divergence, a pattern we traced through Colorado's SB 26-189. We covered that here. The UK now routes AI governance through existing data-protection law, delegating the substance to a regulator's statutory code. Three jurisdictions, three instruments, one shared destination: named, enforceable expectations for automated decisions that affect people.

Three decisions for the board

1. Which named role owns conformance with the forthcoming ICO code for each automated decision system that processes personal data — by name, in writing, ahead of the code's publication?

2. Where do your automated decision-making systems fall under UK data-protection scope, and which of them lack a documented lawful basis and a human-review path?

3. What evidence would your organization present to demonstrate alignment with a statutory code, given that a statutory code carries evidential weight in enforcement?

Regulatory horizon

The regulations are in effect as of 12 May 2026. The operative document — the code itself — follows, drafted by the Information Commissioner with an impact assessment attached. Organizations that map their automated decision systems to UK data-protection scope now, and assign named accountability ahead of the code's publication, retain the lead time that the drafting window provides. Jurisdiction: United Kingdom. Instrument: SI 2026 No. 425, under the Data Protection Act 2018.