The ICO is developing a statutory code of practice for organisations developing or deploying AI and automated decision-making to ensure they safeguard people’s privacy.

As part of the data regulator’s new strategy, it will focus particularly on policing and recruitment, including reviewing the use of automated decision making (ADM) systems by the recruitment industry.

Qualitative research with job seekers by the ICO found that participants acknowledged the increasing use of ADM in recruitment but generally had a limited understanding of how it worked.

The ICO will also conduct audits and produce guidance on the use of facial recognition by police forces as part of the new strategy. A survey by the regulator found that 54% of participants were concerned that the use of facial recognition technologies by police would infringe on their right to privacy.

The regulator is also placing more scrutiny on emerging AI ‘risks and trends’, including the increase in agentic AI, used by organisations to act autonomously.

John Edwards, UK Information Commissioner, said: "Our personal information powers the economy, bringing new opportunities for organisations to innovate with AI and biometric technologies. But to confidently engage with AI-powered products and services, people need to trust their personal information is in safe hands. It is our job as the regulator to scrutinise emerging technologies – agentic AI, for example – so we can make sure effective protections are in place, and personal information is used in ways that both drive innovation and earn people’s trust.”