---
title: "The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026"
id: 85dea6c7-c8cd-48aa-8adc-09713826d228
authority: uk
place: "United Kingdom"
applies_also_from: []
kind: regulation
in_force: true
publisher_url: https://www.legislation.gov.uk/uksi/2026/425
attribution: "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
solon_url: https://solon.orangecat.ch/law/85dea6c7-c8cd-48aa-8adc-09713826d228
language: en
in_force_from: 2026-05-12
date_basis: publisher
status: consolidated
source_url: https://www.legislation.gov.uk/uksi/2026/425/data.xml
read_on: 2026-11-10
sha256: d63a03fe399ba016bfc147e93eed1c2a55df52f0dc2899c3516a2addc2e20512
provisions: 4
---

# The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026

## Title and introductory text {#prelims}

2026 No. 425
DATA PROTECTION
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
Made
16th April 2026
Laid before Parliament
21st April 2026
Coming into force
12th May 2026
The Secretary of State makes these Regulations in exercise of the powers conferred by section 124A(1) and (2) and section 124B(11) of the Data Protection Act 2018. In accordance with section 182(2) of that Act, the Secretary of State has consulted the Commissioner and such other persons as the Secretary of State considers appropriate.

## 1 Citation, commencement, extent and interpretation {#regulation-1}

(1) These Regulations may be cited as The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026.
(2) These Regulations come into force 21 days after the day on which they are laid.
(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.
(4) In these Regulations, “the 2018 Act” means the Data Protection Act 2018.

## 2 The code of practice {#regulation-2}

(1) The Commissioner must prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data under the relevant data protection legislation in relation to—
(a) developing and using artificial intelligence, and
(b) automated decision-making.
(2) The code of practice must include guidance as to good practice in the processing of children’s personal data.
(3) In this regulation—
“automated decision-making” means—
decision-making to which Article 22C(1) of the UK GDPR applies, or
decision-making to which section 50C(1) of the 2018 Act applies.
“relevant data protection legislation” means—
the UK GDPR, and
the 2018 Act, except Part 4 of that Act.

## 3 Modification to panel requirements {#regulation-3}

Section 124B of the 2018 Act applies to the preparation or amendment of the code of practice required under regulation 2 as if after subsection (7) there were inserted—
(7A) The panel must not consider or report on any aspect of the code relating to national security.
.