The ICO AI guidance timetable now sits in one place on the regulator's own website, and it tells a firm what is coming and roughly when. Seven guidance products are listed under technology, four of them bearing on the way a law firm uses AI or the data behind it. Reading the page takes five minutes and it saves a difficult conversation later.
What makes it useful is that the ICO publishes stages rather than promises. Each entry says whether the guidance is being drafted, out for consultation, being redrafted after one, or finished and live. That lets you tell the difference between a rule you have to work to soon and a document that arrives in eighteen months.
That lets you tell the difference between a rule you have to work to soon and a document that arrives in eighteen months.
The agentic AI consultation opens next month
Agentic AI guidance sits at the drafting stage, with a public consultation due to launch in September 2026 and the final version set for Spring 2027. Agentic tools are the ones that act rather than answer, opening files, sending messages and carrying work forward without a person at every step. Before it settles a position, the regulator wants to know how organisations are handling the data protection risks that come with a tool acting on its own.
A firm already running or trialling anything agentic has a short opening to describe what the work looks like from the inside. Responses to consultations of this sort come largely from technology companies and thinly from small professional practices, so a page from a twelve-person firm carries further than its length suggests. Even if you write nothing, reading the draft when it appears tells you what the ICO will expect of you in a year's time.
The automated decisions update lands this winter
The update to the guidance on automated decision-making and profiling is in drafting, its consultation has closed, and the final version is due in Winter 2026. It carries through the amendments the Data (Use and Access) Act made to the UK GDPR. Of everything on the page, that is the entry most likely to change something in your firm within months rather than years.
The question worth settling before it arrives is whether anything in your practice reaches a decision about a person without a human making it. Enquiry triage that sorts new work, a tool that scores a file for risk, recruitment software that filters applicants at the first sift. Where a decision is solely automated and carries a legal or similarly significant effect for someone, the reformed regime brings duties with it, and the finished ICO guidance is the document you will be measured against.
What to do with the rest of the list
Three other entries repay a look. The consultation on anonymisation and pseudonymisation for research purposes is open now, which matters to any firm minded to analyse its own closed files for patterns. Guidance on foundation models was due in Summer 2026 and has not yet appeared, so it is worth watching over the next few weeks. Neurotechnology and smart data sit further from ordinary legal work, and you can pass over them.
The step to take is a small one. Put two dates in the diary, September for the agentic consultation and the turn of the year for the automated decisions guidance, then give one person in the firm the standing job of checking the page each quarter. The ICO says it updates the list regularly, and a quarterly look keeps you ahead of a change rather than reacting to it after a client has asked.
The list is published as the ICO's plans for new and updated guidance on technology, which is open to anyone and asks for no sign-in.
If you want a view of which entries on that list touch your firm and which do not, we work that through in an afternoon: start with a conversation.