ICO Guidance on Self-Hosted AI in the UK

The ICO has published AI-specific guidance interpreting UK GDPR for AI systems. For businesses running AI on UK dedicated hosting, these expectations shape what you need to document and implement.

Contents

• Lawful basis
• DPIAs
• Individual rights
• Implementation

Lawful Basis

Before processing personal data through an AI system, identify your lawful basis (consent, contract, legitimate interests, etc.). For inference on customer text input, contract basis usually covers the processing; legitimate interests can cover improvements.

Training on customer data needs more careful analysis – specific consent or explicit contractual terms are safer than legitimate interests for training.

DPIAs

A Data Protection Impact Assessment is required when processing is likely to result in high risk to individuals. AI systems making automated decisions with significant effect trigger DPIA requirements.

A good DPIA describes: the system, its data flows, identified risks, mitigations, and residual risk. Keep it current – revise when model or scope changes.

Individual Rights

UK GDPR gives data subjects rights to information, access, correction, erasure, and objection to automated decision-making. For AI:

• Explain in plain language what the system does with their data
• Enable access requests including what inferences the system made
• Provide human review for significant decisions
• Allow correction of input data and objection to automated processing

Implementation

Dedicated hosting supports this by:

• Keeping inference logs on infrastructure you control (audit trails)
• Letting you pin model versions (explainability stability)
• Avoiding opaque third-party processors
• Keeping data within UK jurisdiction

See UK AI Act implications and GDPR-compliant AI inference.