Status: Formal Information Commissioner’s Office (ICO) regulatory expectations interpreting existing UK General Data Protection Regulation duties. This is not new legislation.
Published: 8 October 2026.
Applicable date: Existing data-protection duties remain immediately applicable. No transition period was specified.
What changed
The ICO’s foundation-model report and accompanying regulatory expectations clarify that:
- a trained foundation model can itself contain personal data, which calls for a case-specific assessment that includes singling-out and linkability testing;
- developers must establish an Article 6 lawful basis before processing personal data for training;
- each category of special-category data requires an applicable Article 9 condition;
- “manifestly made public” is unlikely to justify special-category data obtained through web scraping;
- the scientific research condition is available only where the processing genuinely qualifies and the associated safeguards are satisfied; and
- transparency and data-subject-rights mechanisms must cover indirectly collected training data, not only the data of registered users.
The ICO acknowledges that the Article 9 conditions it has identified will not cover every use of special-category data in foundation-model training. This may limit whether some models can lawfully be trained using health information.
The ICO has also opened a call for evidence on agentic AI, closing 20 November 2026. It covers security, transparency, accountability, automated decision-making, fairness, purpose limitation and lawfulness. It will inform future guidance on agentic AI and the forthcoming statutory code on AI and automated decision-making. The consultation creates no present requirement, and no publication date for the final guidance or the code has been given.
Why it matters to NHS boards
The expectations apply directly to any NHS trust, foundation trust or other NHS body that develops, fine-tunes or evaluates foundation models using personal data. They also bear on procurement and deployment wherever such a body is a controller, joint controller or customer relying on supplier assurances about training data, embedded personal data and data-subject rights.
Health information is special-category data. A model that may contain such information can therefore affect data-protection impact assessments, records of processing, security testing, transparency, rights handling, incident response, supplier exit arrangements and decisions about whether an organisation’s data may be used for model improvement.
Board and control attention
Each NHS board remains accountable for its own organisation’s system of internal control. Proportionate assurance should establish whether that organisation’s controls over AI use and procurement:
- distinguish model development, fine-tuning, evaluation and deployment;
- identify any agentic systems or autonomous supplier functionality;
- require documented Article 6 and Article 9 analyses where an organisation’s data could support model development;
- test contractual claims about training-data provenance, model memorisation, deletion, rights handling and supplier reuse; and
- prevent production use until material data-protection risks and responsibilities are resolved.
None of this requires a board to approve every AI tool. Escalation should follow each organisation’s own reserved-matter and risk thresholds. Directors govern. The board decides. Systems support.
Questions a board might ask
Few boards will know, without asking, whether their organisation develops or fine-tunes foundation models, permits suppliers to use its data for model improvement, or already uses agentic AI. Controller, processor and joint-controller responsibilities will depend on each technical and contractual arrangement, and those arrangements are rarely visible from the boardroom.
Two matters remain open at the regulator. The ICO is still considering how Article 9 should apply where neither identified condition supports the proposed training. The content and commencement of the future statutory code are unspecified. A board that asks the questions now will be better placed when the answers arrive.
Source: Information Commissioner’s Office, foundation-model report and regulatory expectations, 8 October 2026; ICO call for evidence on agentic AI, closing 20 November 2026.
