UK regulator-ready answers on every AI decision — before the ICO asks.

What the ICO Code asks. Every AI processing activity must have an identified UK GDPR Article 6 lawful basis. Where special-category data is involved (health, biometric, ethnic origin), an additional Article 9 condition is required. A DPO (or equivalent accountable person) oversees AI systems. The Article 30 ROPA includes AI systems and automated decisions — purpose, lawful basis, data categories, retention, recipients, ADM logic + significance.

What counts as compliant. A lawful-basis register with one entry per AI system; an Article 9 condition register where special-category data flows; named DPO oversight with sign-off cadence; ROPA updated to capture AI processing including the ADM logic disclosure.

What Secruna ships for Theme 1. Four rules covering lawful-basis identification, the Article 9 condition register, DPO oversight and ROPA updates. The AI inventory feeds the ROPA refresh; verdict rows cite the AI-system entry that drove them.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=LB with the lawful-basis register state per tenant.

What the ICO Code asks. The privacy notice describes AI use in plain English (UK GDPR Articles 13 / 14). Where solely automated decisions are taken, the data subject is given meaningful information about the logic involved and the significance + envisaged consequences. Vague references to “proprietary models” do not meet the obligation.

What counts as compliant. A plain-English AI section in the privacy notice; layered disclosure with click-through detail; ADM decision-rationale embedded in the outcome letter; consequence-language template on every ADM outcome notification.

What Secruna ships for Theme 2. Three rules covering the privacy-notice AI section, the ADM logic disclosure and the significance + consequences disclosure.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=TR with privacy-notice state per tenant.

What the ICO Code asks. Article 22 UK GDPR — the data subject has the right not to be subject to a solely automated decision with legal or similarly significant effect, unless one of the Article 22(2) exceptions applies (contract necessity, authorised by law, explicit consent). Meaningful human intervention must be available on request; the data subject can contest the decision.

What counts as compliant. An ADM register; a documented Article 22(2) exception basis per decision type; a meaningful human-intervention path (an authorised operator with authority to change the decision); a contest path with outcome tracking.

What Secruna ships for Theme 3. Four rules covering ADM identification, the Article 22(2) exception basis, meaningful human intervention (reusing the Plan 75 HITL queue), and the right to contest. A specialised ADM-contest workflow is scaffolded as Plan 141.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=ADM with the ADM register + contest state per tenant.

What the ICO Code asks. A Data Protection Impact Assessment is required before deploying an AI system likely to result in high risk to rights and freedoms — the ICO has signalled that most operational AI systems processing personal data meet this threshold. The DPIA must cover bias, discrimination and data-accuracy risks. The DPIA is reviewed on material change to the system.

What counts as compliant. A DPIA workflow integrated into the AI system go-live gate; DPO consultation evidence attached to every DPIA approval; an AI-system DPIA template with explicit bias / discrimination / accuracy sections; a DPIA refresh trigger on every material model change.

What Secruna ships for Theme 4. Three rules covering DPIA-before-deployment, bias / discrimination / data-accuracy coverage, and the DPIA-review-on-change trigger. The DPIA template ships per Plan 90; full DPIA-versus-AI-system linking is a Plan 90 follow-up.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=DPIA with the DPIA register per tenant.

What the ICO Code asks. Bias testing on training data and model outputs; documented methodology and pre-set thresholds. Special-category attributes (race, sex, etc.) are handled per the ICO guidance with a documented Article 9 condition (typically Article 9(2)(g) substantial public interest). Outputs are periodically reviewed for adverse impact on protected groups; detected impact triggers investigation.

What counts as compliant. A pre-deployment fairness audit on every customer-facing AI system; sensitive-attribute access controls; outcome-disparity dashboard with named owner; quarterly adverse-impact review fed back to the AI governance committee.

What Secruna ships for Theme 5. Three rules covering bias testing, special-category attribute handling and adverse-impact review. Bias testing (F.01) is tenant-attested in v1 — Secruna provides the evidence-capture surface but the statistical fairness analysis is the customer’s. A bias-testing surface is scaffolded as Plan 140.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=F with the bias-testing evidence per AI system.

What the ICO Code asks. A Subject Access Request touching an AI decision must include an explanation of the decision, the logic involved and the significance. Incorrect personal data fed to the AI is correctable. Training data is subject to standard erasure rights, with documented Article 17(3) exceptions; the retraining cadence respects erasure requests.

What counts as compliant. A SAR-handling playbook with an AI-decision explanation template; a rectification path tied to the AI feature store; a training-data erasure ticket workflow with retraining cross-reference.

What Secruna ships for Theme 6. Three rules covering the right of access, rectification and erasure for AI systems and training data.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=DSR with the data-subject-rights state per AI system.

What the ICO Code asks. Where the AI system processes the personal data of children (under 18 in the UK), additional protections apply: lawful basis is scrutinised more closely, parental consent for under-13s, age-appropriate disclosure, high transparency. Services likely to be accessed by children must align with the 15 standards of the ICO Age-Appropriate Design Code, including data-minimisation and no-profiling-by-default.

What counts as compliant. An age-gate + parental-consent flow for under-13 users; plain-language disclosure designed for the age group; Age-Appropriate Design Code self-assessment for every consumer-facing AI feature; no-profiling-by-default toggle on services with a likely-child audience.

What Secruna ships for Theme 7. Two rules covering children-data protections and Age-Appropriate Design Code alignment.

See this in your dashboard at: /inventory?framework=ico_ai_adm_code&theme=CH with the children-data state per AI system.