Tech & Legal Updates
Short, executive level legal and commercial updates for founders and leaders of scaling technology businesses.
ICO tightens position on AI training and lawful basis
The Information Commissioner’s Office has clarified that organisations deploying AI models must demonstrate a valid lawful basis for training data, particularly where scraping or repurposing personal data is involved.
This directly impacts product design and deployment timelines. AI-enabled SaaS providers must now treat training datasets as regulated assets, not technical inputs.
Contractually, this drives expanded data warranties, indemnities for unlawful processing, and audit rights over training datasets. Customers are increasingly requiring explicit representations that no unlawfully sourced data underpins AI outputs, with liability flowing back to vendors.
Source Allowed: Information Commissioner’s Office, published March 2026
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/