Answer capsule
The ICO says its AI guidance is under review after the Data (Use and Access) Act. Executive-coaching buyers should date the authority, map actual data handling, and contract for change.
What the source establishes
- The ICO's artificial-intelligence page states that its guidance is under review because of changes made by the Data (Use and Access) Act and may be subject to change.
- The ICO says the guidance is suitable for businesses in the public, private, and third sectors.
- The page links detailed guidance on applying UK GDPR principles to AI and on explaining decisions delivered or assisted by AI to affected individuals.
- The page also links an AI and data-protection risk toolkit and a data-analytics toolkit; their availability does not establish compliance or appropriate handling by a particular coach.
Date the authority in the engagement record
A buyer should record the ICO page, review date, jurisdiction considered, and guidance version relied upon. The visible under-review notice means an old privacy questionnaire or coaching agreement should not be represented as aligned with an unchanging authority. Assign an owner to monitor the ICO's update plan and reopen the engagement terms when the governing source, coach's technology, client population, or data flow changes. That is evidence hygiene, not a legal conclusion.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Map what the named coach actually does with AI
Ask whether AI is used for intake, research, preparation, recording, transcription, notes, summaries, exercises, roleplay, follow-up, measurement, or client-facing conversation. For each use, identify the provider, account, information entered, purpose, retention, access, reviewer, output recipient, deletion path, and fallback. A human-led engagement can still expose protected strategy, personal context, employee information, or board material through an undisclosed tool.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Put explanation and correction into the client path
The client should be able to understand when AI materially assisted the service, inspect or correct important information where applicable, object or choose an alternative, and reach the named coach. Test the path before sensitive work begins. A privacy notice on a provider website does not show what the coach configured, what the sponsor receives, or whether a client can continue without the tool. Preserve the actual explanation and decision, not only a link.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Contract for a changing source and service
Define permitted technology uses, prohibited information, confidentiality, sponsor boundaries, records, subprocessors, incident notice, data return or deletion, and the trigger for renewed consent. Separate ICO guidance from the coach's promises and observed practice. The page's under-review status does not make existing duties disappear, and it does not tell this publication how a particular engagement should be treated. Qualified review must apply current law and facts.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Decision test
Ask whether the source changes the decision itself, the evidence required, the implementation sequence, or only the language used to describe an existing capability. Record which claims are directly supported, which are provider statements, which require an independent test, and which remain unknown. A source-linked review should make uncertainty easier to see, not bury it inside a blended score.
Questions to take into review
The publication supports research and executive decision preparation. It does not provide legal, financial, accounting, employment, clinical, cybersecurity, investment, procurement, or implementation advice.