Question

To ask His Majesty's Government what assessment they have made of whether the automated decision-making safeguards introduced by the Data (Use and Access) Act 2025 apply to personal AI agents that act on a user's behalf; and when the Information Commissioner's final guidance on those rules will be published.

The UK’s data protection framework is technology neutral, therefore controllers must ensure the safeguards as outlined in Articles 22C of the UK GDPR are in place where relevant regardless of the type of technology used, including AI agents.

Earlier this year, the government made secondary legislation requiring the Information Commission to produce a formal statutory code of practice on AI and ADM, due to be published in draft in 2027. Additionally, the Information Commission published in March draft updated guidance on ADM for consultation, following the updates made by the Data (Use and Access) Act. The final version of the guidance will be published by the end of this year. They have also recently launched a Call for Evidence on Agentic AI to better understand how new and emerging technologies are navigating the existing regulatory landscape, which will close this November. This will help both the government and regulators understand what is working well, where there are tensions, and inform our work to keep the regulatory framework up-to-date.