Is it allowed for organisations in the UK to rely on opaque, unexplained AI outputs that process personal data without telling people how their data is used?

Last updated on October 4, 2025

NO — The UK Information Commissioner’s Office (ICO) guidance on AI and data protection requires organisations to be transparent about how they process personal data in AI systems. That includes describing what personal data is used, the purposes of processing, and giving meaningful explanations of decisions where appropriate. The ICO explicitly advises organisations to consider fairness, transparency and accountability throughout the AI lifecycle and to provide privacy information to individuals whose data is used or whose rights might be affected. Using complex AI “black boxes” without informing data subjects or without adequate safeguards is inconsistent with ICO guidance.

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/

2023 (guidance updates 2023–2024)