Mind the gap: IC sets expectations for AI model developers, how this differs from the EDPB

What happened

The U.K. Information Commissioner's Office released an update on 8 October 2026 outlining expectations for developers of foundation models, covering transparency, lawful basis, data‑subject rights, model‑personal data interactions, and special‑category data. It compared these expectations with the European Data Protection Board’s draft guidelines on web‑scraping for generative AI. The IC highlighted the risk that training data may inadvertently include special‑category information and called for evidence on emerging agentic AI. No enforcement action or penalty was announced.

Why it matters

AI developers must evaluate how their training data collection aligns with UK privacy expectations, especially regarding special‑category data, and be prepared to demonstrate safeguards similar to EU guidance.

Business impact

Failure to address these expectations could expose organisations to regulatory scrutiny and limit the deployment of generative‑AI products in the UK market.

Checklist

• Review transparency disclosuresHigh priority

  Ensure model documentation clearly explains data sources, processing purposes, and any limitations.

• Validate lawful basisHigh priority

  Confirm that each data category used for training has a compliant legal justification under UK data protection law.

• Assess special‑category data riskMedium priority

  Identify any special‑category information in training datasets and apply the four EDPB‑derived conditions to justify processing.

• Implement data‑subject rights mechanismsMedium priority

  Put processes in place to handle access, correction, and deletion requests related to data used in AI models.

Who reported it

Discussion