In short
The ICO's guidance on AI and data protection explains how UK data protection law applies to AI. For organisations using AI tools, it comes down to accountability: know which AI is used, have a lawful basis, be transparent, minimise data, keep it secure, assess high risks with a DPIA and be able to show your decisions.
Get a quote for AI data protection support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the ICO's AI guidance is
The UK's data protection regulator, known for many years as the ICO, publishes "Guidance on AI and data protection" on ico.org.uk. It explains how the data protection principles in UK GDPR apply to AI systems that process personal data. It is aimed at both technology specialists and people with compliance responsibilities, and much of it concerns organisations building or buying AI systems.
The regulator has also published other AI-related work, including a Tech Futures report on agentic AI in January 2026. The ICO says that report is not guidance: it explores how the technology may develop and the data protection questions it raises, rather than setting out what organisations must do.
Guidance is not law. It is the regulator's explanation of how the law applies. Following it is the clearest way to show you have taken your obligations seriously, but the obligations themselves come from UK GDPR and the Data Protection Act 2018, as amended.
We have kept this page deliberately general. Read the current guidance on ico.org.uk for the detail, check the date and status notes on each page, and take advice on specific decisions.
The ICO and the Information Commission
On 30 September 2026 the office of Information Commissioner was abolished and its functions were transferred to a new body corporate, the Information Commission, under the Data (Use and Access) Act 2025. The commencement regulations provide for continuity: things done by or in relation to the Commissioner are treated as done by or in relation to the Commission.
People still search for "ICO guidance", and on this page "the ICO" means the UK data protection regulator. Because the same Act also changed parts of UK GDPR (automated decision-making, international transfers and lawful bases among them), some older guidance may refer to the previous wording. Check whether the regulator has updated a page before you rely on a specific passage.
What it means for staff using AI at work
Translated into the everyday situation of employees using AI assistants, the regulator's expectations come down to a handful of practical actions:
| Expectation | What to do | How Workforce AI Security helps |
|---|---|---|
| Accountability and governance | Know which AI tools are used, assign ownership, record decisions | Discovery of sanctioned and shadow AI apps, tools and MCP servers; reports |
| Lawfulness and purpose | Approve AI use cases and the lawful basis for any personal data involved | AI-based classification of prompts into use-case categories |
| Transparency | Tell people how AI is used with their data; tell staff how AI use is monitored | Interactive user guidance at the point of use |
| Data minimisation | Keep unnecessary personal data out of prompts and uploads | Redaction with labelled placeholders; file and image redaction with OCR |
| Security | Protect personal data from disclosure through AI tools | Copy and paste restrictions, upload controls, blocking unapproved apps |
| Risk assessment | Carry out a DPIA for high-risk AI processing | Usage and data type evidence for the DPIA |
| Demonstrating compliance | Keep records you can show an auditor, a client or the regulator | Audit trails and customisable reports |
None of this needs a large compliance team. It needs visibility, a clear policy and controls that match it. Our AI governance framework shows how the pieces fit together.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Agentic AI: what the Tech Futures report signals
Agentic AI means AI systems that can plan and take actions on a user's behalf, such as reading and sending email, editing files, or calling other tools and systems through connectors such as the Model Context Protocol (MCP). The ICO's January 2026 Tech Futures report looks at this area. As the ICO says it is not guidance, treat it as a signal of the questions the regulator is thinking about rather than a rulebook.
For organisations, the familiar data protection questions become sharper when AI can act:
- Who is responsible for what an agent does with personal data? Your organisation, as controller, when the agent acts for work purposes.
- Is access proportionate? An agent with access to a whole mailbox or file share can process far more personal data than the task needs.
- Is it secure? Agents that read untrusted content are exposed to prompt injection, which could lead them to disclose or alter data.
- Can you see what it did? Without logs, you cannot investigate or demonstrate compliance.
Check Point's Workforce AI Security Enterprise discovers the MCP servers and agents staff use and lets you govern agent actions, for example allowing tools while blocking risky operations. Our MCP security guide covers the wider best practices.
Practical steps to take now
A short plan that lines up with the regulator's expectations:
- Find out what AI is in use. Run discovery across browsers and devices, including personal accounts used for work. Our shadow AI guide explains why this comes first.
- Decide and write it down. Approve tools and use cases, and publish an AI acceptable use policy.
- Assess the higher-risk uses. Use an AI DPIA for AI that processes personal data at scale, in decisions about people or through agents.
- Put controls in place. Redact, warn, restrict and block in line with the policy, starting with the riskiest data types.
- Train people. Explain the policy and why it exists. Our sister site covers safe use of AI training.
- Keep evidence and review. Use reports and audit trails to show the controls work, and revisit decisions as tools and guidance change.
Is AI data protection support the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Is there an ICO AI guidance PDF?
Many people search for a PDF of the ICO's AI guidance. The regulator publishes its guidance on ico.org.uk, and the format and download options are its choice; we do not host copies, because a copy can quickly go out of date after a change in the law. Go to ico.org.uk and search for "AI and data protection" to find the current version and any status notes about updates.
How Forever Systems helps
We help organisations put the regulator's expectations into practice for everyday AI use. That usually means a discovery pilot of Check Point Workforce AI Security, a policy built from what it finds, and controls rolled out in stages, with reports you can use as evidence. The Essentials tier covers AI used in web browsers; the Enterprise tier adds desktop apps, coding assistants and agents. See how Workforce AI Security works.
This page is general information, not legal advice. Data protection law changed in 2025 and 2026, so check the regulator's current guidance and take advice for specific decisions. Contact us to talk it through.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
What is the ICO's guidance on AI?
The ICO's 'Guidance on AI and data protection' explains how UK data protection law applies to AI systems that process personal data. It is published on ico.org.uk. For organisations using AI tools, the key themes are accountability, lawfulness, transparency, minimisation, security and DPIAs for high-risk processing.
Is ICO guidance legally binding?
Guidance is not law; it is the regulator's explanation of how the law applies. The legal duties come from UK GDPR and the Data Protection Act 2018, as amended. Following the guidance is a strong way to show you have met those duties.
Has the ICO published guidance on agentic AI?
The ICO published a Tech Futures report on agentic AI in January 2026. The ICO says that report is not guidance; it explores the technology and the data protection questions it raises. Existing data protection law already applies to AI agents that process personal data.
What happened to the ICO in 2026?
Under the Data (Use and Access) Act 2025, the office of Information Commissioner was abolished on 30 September 2026 and its functions moved to a new body, the Information Commission. The commencement regulations provide for continuity of what the Commissioner had done.
Does the ICO require a DPIA for AI?
UK GDPR requires a DPIA where processing is likely to result in a high risk to individuals, particularly with new technologies, and the regulator publishes a list of processing that needs one. Many AI uses involving personal data meet that test.
Where can I download the ICO AI guidance PDF?
The guidance is published on ico.org.uk, where the regulator decides the formats available. Use the current online version and check its status notes, as guidance may be updated following the Data (Use and Access) Act 2025.
Still have a question about AI data protection support?
Ask us and a member of our team will reply by email.