ICO reviews guidance on automated decision-making and AI

The Information Commissioner’s Office has recently consulted on updated guidance covering automated decision-making, including profiling.

The consultation opened on 31 March 2026 and closed on 29 May 2026. The ICO says the updated guidance follows the introduction of the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025.

Why this matters for health and care providers

As more organisations consider using AI tools to support administration, triage, recruitment, risk assessments or service planning, data protection remains a key governance issue.

The ICO’s AI guidance reminds organisations that data protection law applies to AI systems where personal data is used. Its AI guidance covers areas including accountability, governance, transparency, lawfulness, accuracy, fairness, security, data minimisation and individual rights.

The ICO also highlights practical resources for organisations, including its AI and data protection risk toolkit, designed to help organisations assess risks to people’s rights and freedoms when using AI systems.

What providers should be watching

The key issue is not simply whether AI can be used, but whether organisations can explain and justify how it is being used.

The ICO has identified three major areas of public concern around AI and biometrics:

• transparency and explainability
• bias and discrimination
• rights and redress.

For health and care providers, this means AI governance should include clear oversight, documented risk assessments, staff guidance, data protection impact assessments where required, and routes for people to challenge or query decisions that affect them.

What providers should do now

Health and care organisations using or considering AI should:

• review the ICO’s AI and data protection guidance
• check whether any tools involve automated decision-making or profiling
• ensure there is meaningful human oversight where decisions affect people
• assess risks around bias, accuracy and transparency
• involve information governance leads before AI tools are introduced
• keep policies under review as final ICO guidance develops.

Further reading

Useful resources include:

• ICO: Artificial intelligence guidance
• ICO: Guidance on AI and data protection
• ICO: Explaining decisions made with AI
• ICO: AI and data protection risk toolkit
• ICO: Consultation on automated decision-making, including profiling

Stay informed with the stories shaping health and social care.

Register with The Daily Round for the latest sector news, exclusive investigations, wellbeing content, workforce insights, expert features and practical updates—delivered free to your inbox.