Businesses in the UK should address privacy risks before putting generative AI products into use, the Information Commissioner’s Office (ICO) has warned. The watchdog says companies must assess how personal information is handled in the specific setting where they plan to use the technology.
The warning puts responsibility on businesses even when they rely on an existing AI system or API. The ICO says it will check whether privacy risks have been considered and may take action if poor data use creates a risk of harm to people.
Risk depends on how a product is used
The ICO’s message is that using the same underlying technology does not make every application equally risky. Businesses will need to show how they considered risks in their own context, rather than assuming a general assessment by a technology provider covers their responsibilities.
That distinction matters because applications can involve different kinds of personal information and different consequences for the people using them. A generative AI feature in a health service may raise different concerns from one in a retail app. The ICO’s stated approach asks businesses to consider those circumstances before rollout.
For developers and organizations adopting AI, this makes privacy review part of product planning. They are expected to understand how the system uses personal information, identify risks, and take steps to reduce them before introducing the service.
Due diligence before launch
Stephen Almond, the ICO’s executive director of regulatory risk, was set to tell businesses that there can be no excuse for overlooking risks to people’s rights and freedoms before rollout. He also acknowledged that generative AI may help businesses improve customer services or reduce costs, while warning that those opportunities do not remove privacy responsibilities.
The ICO’s advice is to spend time at the outset understanding how AI processes personal information, mitigate risks that emerge, and then roll out an approach with confidence. In practice, that means asking questions before a product reaches users, while there is still an opportunity to change how it works.
The article notes that the ICO had previously published eight questions for generative AI developers and users. They covered issues including the legal basis for processing personal data, transparency obligations, and whether a data protection impact assessment had been prepared. The latest warning makes the expectation clearer: businesses should act on relevant guidance, not simply take note of it.
Regulatory exposure and evolving guidance
UK data protection legislation allows fines of up to £17.5 million or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. That potential exposure adds financial stakes to the ICO’s warning, alongside the possibility of action where data use risks harming people.
The UK’s broader approach to AI regulation is still taking shape. Under the government’s AI white paper, sector-focused and cross-cutting regulators are expected to develop flexible principles and guidance suited to different contexts. The article identifies the competition authority, financial conduct authority, Ofcom and the ICO among the bodies involved.
As those regulators develop guidance, businesses may face a patchwork of expectations across sectors. The ICO’s message gives companies a practical starting point within that changing landscape: assess the use case, understand the data involved, and consider the impact on people before launch.
Earlier concerns about AI risks
The warning also follows the ICO’s earlier concerns about “emotion analysis” AI. Last fall, the watchdog described the technology as immature and said it presented greater risks of discrimination than potential opportunities, apart from purely trivial uses such as kids party games.
The UK government has signaled that it favors guidance from existing regulators over a dedicated AI legislative framework or an exclusively AI-focused oversight body. More recently, Prime Minister Rishi Sunak announced a plan to host a global summit on AI safety this fall. Together, these developments show that AI oversight is being discussed across several fronts, while the ICO focuses on privacy and data protection in specific business uses.