The ICO is now the Information Commission: what changes, and what it means for AI

On 30 September 2026 the Information Commissioner's Office became the Information Commission. The name most people use, the ICO, stays. What changes is who holds the legal power: a single commissioner has been replaced by a board. For anyone deploying AI that touches personal data in Britain, this is the regulator that will write the rules on automated decisions, so the change matters more than the rename suggests.

What changed on 30 September

The legal mechanism is a commencement order, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015. Regulation 2 brings three provisions into force on 30 September 2026: section 117(4)(a), section 118, which abolishes the office of Information Commissioner, and section 119, which transfers its functions to the Information Commission.

The order also guarantees continuity. Regulation 3 says any act, omission or thing done by or in relation to the Information Commissioner is treated as done by or in relation to the Commission, including legal proceedings. Regulation 4 keeps the old accounting rules for the financial year ending 31 March 2027. The Commission's duties under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations do not change, and neither does the scale of fines, according to the commentary site Measured Collective.

So nothing in your compliance obligations moves today. What moves is governance: decisions are now taken collectively rather than by one person.

Who sits on the board

The ICO's own board page, last updated on 15 July 2026, says the Board consists of a chair, non-executive directors and the chief executive, and that it makes collective decisions on strategic direction and performance. The government is still recruiting the chair. Measured Collective reports that Maggie Carver, a former deputy chair of Ofcom, is interim chair, with a permanent appointment expected in spring 2027.

The board page names seven non-executive directors: Laurie Benson, Maggie Carver, Stephen Cohen, Sukhvinder Kaur-Stubbs, Gary Kildare, Hilary Newiss and Scott McPherson. Their backgrounds, as the ICO describes them, run from media and investment to social housing regulation, corporate governance, law and senior government roles. Regulator boards are usually built for governance rather than technical depth, so on machine learning questions the judgement will largely come from staff, although we have not checked every biography in full.

Paul Arnold, the chief executive, is quoted by Measured Collective as saying: "Today is the beginning of an important new chapter for our organisation."

Why it matters for AI

The AI link is a separate instrument. According to The Modern Regulator, SI 2026/425 came into force on 12 May 2026 and requires the ICO to prepare a statutory code of practice on AI and automated decision-making. The code covers AI development and use, automated decision-making under the amended UK GDPR, and children's data, with a carve-out for national security.

The same article says the code had not yet been drafted when it was written, leaving what it calls a timing gap: the new rules on automated decisions are live, but the authoritative guidance is not. It also cites the ICO's March 2026 recruitment report, which found that "most employers did not recognise that they were making solely automated decisions". If that finding holds, many organisations are already in scope without knowing it.

That is the practical risk. A hiring tool that ranks candidates, a fraud model that blocks a payment, a triage system that sorts benefit claims: each can amount to a solely automated decision if a human only rubber-stamps the output. The code is where the ICO will say what counts as meaningful human involvement. We have not seen a draft, so we cannot say what it will contain.

How this sits beside the other UK bodies

The ICO is one of several regulators touching AI in Britain, alongside the CMA, Ofcom and the FCA. It is different from the AI Security Institute, which evaluates frontier models but has no regulatory powers; we explain the distinction in what an AI safety institute is. The ICO can investigate, issue notices and fine. The Institute publishes evidence.

There is also a governance point. A board spreads responsibility, which can make decisions more robust and, on a bad day, slower. Whether that trade suits a fast-moving field is something only the regulator's output over the next year can show. A regulator asked to write a code on automated decisions, handle complaints about AI and run a sandbox for new technology needs to be both quick and careful. A board that includes a former Ofcom deputy chair has experience of that balance, but experience is not output.

Hype check

Some commentary treats the change as a new AI regulator. It is not. The Information Commission has the same functions and powers as the ICO had. The claim that stands up is narrower: the same regulator, now run by a board, is about to decide how UK data protection law applies to automated decisions.

Our take

Do not wait for the code. If you run any system that decides something about a person, map which decisions involve a human who can actually change the outcome, because the ICO's own evidence says employers misjudge this. We would watch for three things: the first draft of the AI and automated decision-making code, the appointment of a permanent chair in spring 2027, and whether the board publishes how it takes decisions on AI cases.