ICO: AI and Biometrics Strategy
On 5 June, the ICO published their new AI and biometrics strategy, ‘Preventing Harm, Promoting Trust’. Addressing the growing presence of AI and biometric technologies, the strategy emphasises that their successful deployment is contingent on public trust. This trust can be built through transparency, fairness, and appropriate governance and technical protections.
The strategy is divided into four sections:
What we have achieved so far on AI and biometrics
Why we need to act
Where we will focus
Our plan of action
Within the strategy, the ICO have also pledged to develop a further statutory code of practice for organisations developing or deploying AI, and automated decision-making (ADM).
The ICO have flagged two key challenges to ensuring AI and biometric technologies support responsible innovation while protecting people’s rights:
Private and public sector organisations can lack the regulatory certainty and confidence to invest in and use AI and biometric technologies compliantly.
Limited transparency about how personal information is used can undermine public trust.
The strategy focuses on the development of foundation models, the use of ADM, and the use of facial recognition technology by the police, as examples of “high-impact cases with significant potential for public benefit”.
To improve transparency, the ICO recommend organisations work to clarify when and how AI systems affect them. They also note that AI systems that seek to infer traits, emotions or intentions from physical or behavioural characteristics may raise particular concerns around bias and fairness. Similarly, the strategy recognises emerging challenges around transparency and accountability, and building trust in agentic AI systems, where it becomes more difficult to trace decisions back to a human controller.
Having set out these challenges, the strategy concludes with the ICO’s plan of action for 2025-26. This includes commitments to:
Consult on their updated ADM and profiling guidance by Autumn 2025.
Develop a statutory code of practice on AI and ADM.
Set out clear regulatory expectations to ensure high standards of ADM in central government.
Set clear expectations for the responsible use of ADM in recruitment.
Publish guidance on how police forces can govern and use facial recognition technology in line with data protection law.
Anticipate and act on emerging AI risks, including establishing the data protection implications of agentic AI.
techUK looks forward to working with the ICO on this forthcoming programme of work on AI and biometric technologies. To discuss any of the challenges or recommendations raised in this strategy, please contact Audre (audre.verseckaite@techuk.org) and Dani (daniella.bennettremington@techuk.org).
