New UK regulations have been laid before Parliament requiring the Information Commissioner's Office to prepare a code of practice on AI and automated decision-making. This follows new powers granted under the Data (Use and Access) Act 2025, which amended the Data Protection Act 2018 by inserting section 124A, which gives the Secretary of State authority to instruct the ICO to prepare codes of practice on any relevant topic.

We expect this new code to be of interest to organisations using automated tools in recruitment and workforce decision-making. Last month, the ICO published its ‘Recruitment Rewired’ report, which identified significant compliance gaps in the use of ADM in recruitment processes. In particular, many organisations claiming to include human review (thereby removing the process from the scope of ADM restrictions under UK GDPR) were doing so in a manner that was often inconsistent, superficial or unevenly applied (meaning automated decisions were forming part of many recruitment processes, unknown to applicants).

No indication on timelines for a draft code yet. In parallel, the ICO is consulting on draft (non-binding) guidance on automated decision-making, with responses due by 29 May 2026. We expect consultation responses will ultimately feed into the draft code of practice, though it remains to be seen whether updated guidance will appear in the meantime (ahead of the statutory code). Watch this space.