05/10/26 – As agentic AI evolves from reactive reporting to proactive systems executing workflows, AI agents will be making business decisions of increasingly consequential importance. This is something that jobseekers are already familiar with – AI being used for the screening of CVs and now increasingly also for interviewing and shortlisting of job candidates.
What does the law say about using AI for these purposes?
Since 2018 the EU GDPR and the UK GDPR have prohibited organisations from using automated decision-making (ADM) about individuals if the decision is solely automated (i.e. without any human involvement) and results in legal or “similarly significant” effects on individuals, unless:
• the organisation has obtained the individual’s explicit consent or
• use of the ADM was necessary to perform a contract or
• the ADM was authorised by law
(UK GDPR, Art 22(1), now repealed).
In practice this meant that if an organisation wanted to use AI for, for example, shortlisting job applicants, approving/rejecting loan applications, or adjusting insurance premiums based on risk scoring, the organisation would in the vast majority of cases need to get individuals’ explicit, opt-in consent.
Earlier this year however the UK’s approach to ADM was comprehensively updated with the introduction of a new framework (UK GDPR, Arts 22(A) – 22(D), as introduced by Section 80 of the Data (Use and Access) Act 2025).
So what’s changed?
The most significant change is that there are now separate rules for ADM depending on whether the processing involves special category data or only ordinary personal data. (By way of reminder, special category data is “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation” (UK GDPR, Art 9(1)); special category data does not include details of an individual’s income or financial circumstances.)
ADM with special category data
Where special category data is involved the previous ADM rules requiring individuals’ explicit consents still apply. Accordingly ADM used for activities such as employee absence monitoring (which involves health data) or biometric access controls remains prohibited, unless the individual has given explicit consent or the processing is necessary for contractual or legal reasons alongside substantial public interest grounds.
ADM with ordinary personal data only
Where no special category data is being processed the new framework allows organisations to use any lawful basis to process individuals’ personal data for ADM purposes. This means that an organisation which proposes, for example, to deploy AI agents to carry out employee performance reviews may no longer need to obtain their employees’ consents but instead use legitimate interests as the legal bases.
However this more permissive regime is subject to the organisation implementing and maintaining newly-introduced safeguards (Art 22(C) safeguards) which require the organisation to ensure that individuals are:
• Provided with specific information about the decision.
• Able to make representations on or contest decisions.
• Able to obtain human intervention in relation to decisions.
In practice this means that organisations which are transparent about their use of AI agents and employees’ right in relation to automated decisions can crack on with their agentic AI employee performance reviews, if they think that’s the right thing to do. And for that matter, deploy AI agents to make decisions relating to promotions, disciplinary actions, redundancies and dismissals of employees.
This all sounds like a recipe for disaster. What does the ICO say?
Well first of all no longer the ICO. On 30th September 2026 the Information Commissioner’s Office transitioned into the Information Commission. But to answer your question…
In March 2026 the ICO launched a public consultation on an update to its ADM guidance. Following some delays the final updated guidance is now scheduled to be published by the end of 2026.
Key areas which are expected to make the final version of the Information Commission’s ADM guidance:
• ADM decisions: More detailed analysis on what constitutes a decision for the purposes of the ADM rules. To fall within the ADM rules a decision must result in “a conclusion or outcome, reached after consideration or analysis” which may impact actions taken or engage a person’s rights (e.g. eligibility to rent a property), rather than just applying a rule already set by a human (e.g. whether a specific credit card may be accepted as payment).
• Significance: The Information Commission is likely to take a broader view of whether a decision has significance, having regard to impacts not only on finance, health or employment but also behaviour and choices. For example, the guidance now refers to automated recommendations that ‘nudge’ teenagers towards content that promotes unhealthy eating as potentially being a decision with a behavioural impact.
• Human involvement: To avoid falling within the ADM rules human involvement must be active and it must not be tokenistic. Ad hoc spot checking isn’t sufficient. Furthermore the relevant person must be “suitably trained and qualified to understand the system’s logic, outputs, limitations, and risks”, and the human involvement must come before the ADM decision is applied to a person.
• Art 22(C) safeguards: Individuals must be given information to allow them to “meaningfully understand the decision and the specific aspects of their case that influenced it”. This must be “decision-specific information about the actual outcome, rather than simply repeating information you provide in your privacy notice”.
In short we can expect the Information Commission to encourage and support the use of AI and ADM but at the same time take a robust approach to enforcing the requirements for human involvement and the Art 22(C) safeguards. Whether that will be enough remains to be seen.
Tags: adm, AI, automated decision making, gdpr, ICO, safeguards
Posted in Commercial, Privacy, Technology, Updates | Comments Off on Automated decision making by AI agents – what does the law say?
20/06/26 – As with most LLM provider terms of service, Anthropic’s Commercial Terms of Service confirm that when you use Claude Code:
For anyone using Claude Code to assist with software development – whether in-house or for a client – Anthropic’s confirmation of ownership supported by an indemnity is good news.
So far so straightforward. A trickier question is whether your Claude Code-generated software code benefits from any IP rights – and specifically copyright – in the first place.
In this article we look at the status of copyright protection of AI-generated software code in the UK, and also briefly look at the position in the EU and in the U.S. We conclude with some practical suggestions how to manage some of the risks involved.
UK
In common with most countries the UK provides ‘standard’ copyright protection for human author-created works. Under the UK Copyright, Designs and Patents Act 1988 (“CDPA“) copyright subsists in “original literary, dramatic, musical or artistic works” (CDPA, s.1), with literary work defined to include computer programs (CPDA, s.3). The originality of a work must meet the “author’s own intellectual creation” test which derives from the EC Copyright Directive 2009, and which the UK courts have confirmed continues to apply post-Brexit. Copyright continues for 70 years from the end of the calendar year in which the author dies (CPDA, s.12).
Unlike most countries however the UK has a separate regime for the protection of computer-generated works. A computer-generated work (CGW) is defined as a work “generated by a computer in circumstances such that there is no human author of the work” (CDPA, s.178). Copyright in a CGW continues for 50 years from the end of the calendar year in which the work is made (CDPA, s12(7)).
CGW cannot, by definition, be assessed by the “author’s own intellectual creation” test applicable when considering whether human-authored works has sufficient originality to be eligible for copyright protection. There is therefore some dispute about the circumstances in which the CGW regime will actually apply. The most widely held view appears to be that copyright protection is available to a computer-generated work which would be original had it been created by a human.
Where copyright does subsist in AI-generated code under the CGW regime, authorship (which with some exceptions also means ownership) is ascribed to the person who “undertakes the necessary arrangement to create the work” (CDPA, s.9(3)). Determining who makes the necessary arrangements in the case of Claude Code-generated software may not be straightforward; if the user provides detailed and well-defined prompts there is a strong argument that they have made the “necessary arrangement” and as a result they are the author; conversely where the user only communicates a general idea or concept via prompts and Claude Code makes the key structural and expressive choices in the code it’s likely that it’s Anthropic which has made the necessary arrangement and is the author. In most circumstances this will all be academic because the IP in the code vests in the customer under Anthropic’s Terms of Service. However software developers who are using Claude Code (or any other AI coding assistant) may want to check their client contracts, including any restrictions on sub-contracting the development work to third parties and any ‘original author’ warranties.
EU
The EU provides ‘standard’ copyright protection for human author-created works, including software, much in the same way as the UK does. The EU does not however have an equivalent to the UK’s CGW regime. As a result software code generated by Claude Code without human creative control will have no IP protection at all.
Furthermore, a recent decision by a Munich court has confirmed that even when a human is involved the level of creative control that a human must contribute in order for copyright to subsist is very high. The case concerned three AI-generated logos (one created with a single, simple prompt, one with a 1,700-character prompt, and one with the design of the logo refined on an iterative basis by successive prompts), all of which were held by the court to lack sufficient human creative control in order for copyright to subsist. The court did say that it’s possible for copyright to subsist in AI generated output but only if the human-created elements forming part of the prompts are so dominant in the output that the work can be regarded as the author’s own original creation.
U.S.
In January 2025 the U.S. Copyright Office (“USCO”) published Part 2 of its Report on Copyright and Artificial Intelligence. Its conclusions and recommendations included the following:
In March 2025 the USCO’s approach to AI-generated outputs was affirmed by the U.S. Court of Appeals for the District of Columbia in Thaler v. Perlmutter. The USCO’s approach has however not yet been considered by the U.S. Supreme Court.
For the time being the position in the U.S. is therefore not dissimilar in effect to that in the EU: copyright in Claude Code-generated software code can only be registered (i.e. subsist) where and to the extent that there is sufficient human creative control.
Managing the risk
Determining whether copyright subsists in the software that Claude Code has written for you, and if copyright does subsist deciding who the owner of the copyright is, will not always be straightforward. Although the outcome will depend on which legal system applies and the factual circumstances, you may want to consider the following:
Tags: AI, claude code, coding assistants, copyright, IP, software, software code
Posted in Commercial, Technology, Updates | Comments Off on Protection of IP in the age of Claude Code
04/06/26 – In Part 1 of Making progress with AI governance we looked at the key elements which are likely to form part of an organisation’s cross-functional AI Policy. In this Part 2 we focus on the procurement of an AI system (which could be generative and/or agentic) and consider some of the key questions and issues that a potential customer may want to keep in mind.
Due diligence
Questions that the customer may want to ask as part of the procurement process:
Supply contract
When negotiating the supply contract, the customer may want to pay particular attention to the following areas:
Ownership of AI output
Whether AI output can be copyright protected under English law is still a moot point. But to the extent copyright does subsist in the output, the supplier and the customer can agree that ownership in the copyright (and any other IP) vests in the customer.
If the supplier wants to use the customer’s data and output data for further training of the AI system, and therefore for the benefit of other customers, the customer will need to consider whether this is acceptable from legal and commercial perspectives. If it is, the customer will want to consider whether use by the supplier (and potentially by third parties) needs to be subject to anonymisation and confidentiality safeguards. The customer may also want to consider whether some form of compensation should be payable for its contribution to the development of the AI system.
IP Infringement
Infringement of IP may arise in two areas:
If the supplier is reluctant to give indemnities for 3rd party infringement claims, arguing that infringement by LLMs is out their control, the customer may want to point out that most of the LLM providers offer robust IP infringement indemnities as part of their Terms of Use, certainly for their professional, subscription-based AI models (see for example section K.1 of Anthropic’s Commercial Terms of Service and section 13.1 of the OpenAI Services Agreement).
Hallucinations and accuracy
As much as it goes against conventional contracting normal, the customer may need to accept that hallucinations are an integral feature of GenAI and that the supplier is unlikely to be able to provide warranties regarding the accuracy and completeness of the AI system’s outputs of the type that are commonplace in SaaS contracts. The exception to this is where the supplier has suggested that its AI system meets accuracy thresholds; if so the customer may want to repurpose these into contractual service levels, supported by meaningful service credits. The customer may also want to negotiate a critical service level failure threshold (e.g. accuracy falls below x% in n consecutive months), resulting in the customer having an early termination right.
Bias and discrimination
Depending on the nature of the AI system, the types of data on which it was trained, and how the AI system will be deployed, the customer may want contractual commitments regarding bias and discrimination, and the effectiveness of the AI system’s guardrails. For example if the AI system is to be used for screening and filtering CVs, the customer may want to require the supplier to measure rejection rates broken down by protected characteristics (including sex, race, disability, age) on a 6- or 12-monthly basis. The customer can incorporate the agreed bias testing benchmarks as contractual service levels, again supported by meaningful service credits and a critical service level failure/early termination trigger.
EU AI Act
If the customer will be using the AI system in the EU, or if the output of the AI system will be used in the EU, they will want the supplier to not only warrant the AI system’s compliance with the EU AI Act but also to help the customer comply with its own obligations regarding transparency, explainability of output and employee literacy as a deployer of the AI system. In practice the customer will want contractual commitments that the supplier will provide sufficient information and documentation regarding: how the AI system was developed, what data was used to train it, how it works; how the AI system is tested for bias; and how the AI system performs over time.
Tags: agentic AI, AI, AI system, AI tools, bias, generative AI, hallucination, LLMs
Posted in Commercial, Technology, Updates | Comments Off on Making progress with AI governance (Part 2): procuring an AI system
21/01/26 – As AI tools and systems scale from evaluations/POCs to live deployments, businesses will want to start thinking about AI governance – putting in place policies, practices and processes (more…)
Tags: #aigovernance, AI, aipolicy, ethicalai, governance
Posted in Commercial, Technology, Updates | Comments Off on Making progress with AI governance (Part 1): creating an AI Policy
26/04/21 – The European Commission aims to turn the EU into ‘the global hub for trustworthy Artificial Intelligence (AI)’. With that objective in mind, on 21st April 2021 the Commission published its Proposal for a Regulation on a European approach for Artificial Intelligence.
Very interesting, I’m sure. But presumably not relevant to those of us who are no longer in the EU? Or to those of us who aren’t building robots to conquer the human race, haha?
On the EU point, the regulation applies to both EU and non-EU providers who market or deploy AI system in the EU, all users of AI systems in the EU, as well as providers and users of AI systems that are located outside the EU but where the outputs of the AI systems are used in the EU. In other words, the regulation potentially extends far beyond the EU’s borders.
And for the Asimov fans out there, the regulation’s definition of ‘AI system’ is perhaps a little disappointing: ‘software that is developed with one or more of the techniques and approaches listed in Annex I and [which] can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing environments they interact with’.
Annex I in full:
‘(a) Machine learning approaches, including supervised, unsupervised and reinforcement learning, using a wide variety of methods including deep learning;
(b) Logic- and knowledge-based approaches, including knowledge representation, inductive (logic) programming, knowledge bases, inference and deductive engines, (symbolic) reasoning and expert systems;
(c) Statistical approaches, Bayesian estimation, search and optimization methods.’
Ah I see what you mean. So what do I need to know?
Well, the proposed regulation runs to 107 pages (not including the Annexes), so there’s quite a bit to digest. But by way of an overview:
Stand-alone systems will be subject to conformity assessments, as well as quality and risk management systems and post-market monitoring. Following the conformity assessments, the AI systems must then be registered in a European Commission-managed database, to ensure public transparency and assist ongoing supervision.
I see what you mean about quite a bit to digest. Anything I need to do now?
Although the regulation is likely to be subject to various changes over the next few months – particularly in the areas of biometric testing and social scoring – the fundamental principles are unlikely to change. So if you’re involved with the development, marketing, sale or distribution of software that constitutes a high-risk AI system then you may want to start thinking about how the regulation will impact areas such the accuracy of your datasets, risk of bias, and algorithmic transparency.
Tags: AI, artificial intelligence, brexit, EU, machine learning, ML
Posted in Technology, Updates | Comments Off on Overview of the European Commission’s proposed AI regulation
"*" indicates required fields