The UK’s AI rulebook has an author now, and it is the ICO.

Most coverage of UK AI regulation describes an absence. There is no UK AI Act, no equivalent of the EU's risk tiers, and a stated preference for existing regulators applying existing law.

That framing misses what happened in April. A statutory instrument now obliges the Information Commissioner to produce a code of practice on artificial intelligence and automated decision-making, and a code of practice under the Data Protection Act is not a blog post. It is a document a court and a regulator take into account.

Why the order matters

The substantive duties landed on 5 February 2026, when Articles 22A to 22D replaced Article 22 of the UK GDPR. Firms have been obliged since then to provide information about automated decisions, accept representations, offer human intervention and allow a decision to be contested.

The code explaining what good looks like comes afterwards. That gap is uncomfortable and it is also normal, and the practical consequence is specific: a firm designing an automated decision today is designing against the statute rather than against guidance, and will be reading the code later to find out whether it guessed right.

Three things that follow for a small firm

1. Keep your design decisions written down. Not the system — the reasoning. Why this threshold, why a human sits here, what the system refuses to decide. When the code arrives you will need to compare it against something, and "we always did it this way" is not something.
2. Children's data is named in the duty. If any part of your processing touches under-18s, the code will speak to you directly, and the ICO's record on children's data is that it treats it as a separate and stricter question.
3. Expect consultation before a code. A code of this kind is consulted on, which means the profession gets to argue with the draft. That is a genuine opportunity for trade bodies and a reason to read the consultation rather than wait for the outcome.

What this is not

It is not an AI act, and a code of practice is not legislation. It guides the interpretation of duties that already exist under data protection law; it does not create new ones and it does not reach AI that touches no personal data at all.

It also does not settle the hardest question in this area, which is what counts as meaningful human involvement in a decision. That will be argued over in the consultation and then in cases, and the firms that come out of it well will be the ones that can produce evidence rather than intention — an override rate that moved, a reviewer who saw the inputs, a record of what the system declined to do.

The mechanics are in the note on Articles 22A to 22D, and the recruitment case is where most small firms meet it first.

If you are building anything that decides, the audit layer is the part that survives a rulebook you have not read yet, because it records what happened rather than what you intended. That is also the argument in the trail note, and the register is where we keep every rule we cite, with the date it was last checked.