Veridio

Briefing #2 · 2 May 2026

ICO Sharpens Its Grip on AI: Grok Probe, GenAI Action and Clearview Jurisdiction

This week's developments make one thing unambiguous: the Information Commissioner's Office is no longer signalling its intent on artificial intelligence, it is acting. Three stories define the regulatory landscape over the past seven days. The ICO has opened a formal investigation into Grok, the generative AI system developed by xAI. It has also launched what is being described as its first enforcement action specifically targeting generative AI use, confirming that existing UK GDPR powers are sufficient to police AI deployments. And the Clearview AI litigation has produced further appellate clarity on the territorial reach of UK data protection law, with consequences for any overseas controller whose models touch data about people in the UK. Taken together, these developments point to a regulator that is confident, active, and willing to test the edges of its jurisdiction without waiting for a dedicated UK AI statute.

ICO opens investigation into Grok

The ICO has confirmed publicly that it is investigating Grok, xAI's generative AI system. The detailed scope has not been published, but the announcement itself is significant. An investigation is not a finding of breach, but it does mean the regulator considers there are questions worth answering about how personal data is collected, processed, or surfaced by the system.

The regulatory context is straightforward. The ICO enforces UK GDPR and the Data Protection Act 2018. Generative AI is not a regulatory grey zone in the UK; it sits squarely within existing data protection law. Training data provenance, lawful basis, transparency, and the rights of data subjects all apply, regardless of how novel the technology is.

For organisations using or building on large language models, three actions follow. First, document the data lineage of any model you rely on, including third-party systems integrated into your products. Second, treat external AI as part of your processing inventory; if a model touches personal data through your service, the controller accountability is yours. Third, separate UK obligations from EU ones. Compliance with the EU AI Act does not deliver UK GDPR compliance, and vice versa. The Grok investigation is a reminder that the ICO will look behind the model to the data that fed it.

ICO's first enforcement action on generative AI

Reported this week by Addleshaw Goddard, the ICO has taken its first formal enforcement action involving generative AI use. The specifics of the case, the organisation involved, and the precise nature of the breach warrant close reading of the ICO's own communications when fully published. What matters at this stage is the precedent: the regulator has moved from guidance to action.

This shifts the practical posture for governance teams. For more than a year, the ICO has been clear that generative AI deployments must satisfy existing data protection obligations. Until now, organisations could reasonably treat that as forward-looking guidance. They no longer can. Existing UK data protection law is the binding floor for AI deployments today.

Three practical steps follow. First, map every generative AI tool in use across the organisation, including shadow deployments adopted informally by individual teams. You cannot defend what you cannot see. Second, document the lawful basis for any personal data processed by these systems, whether at training, fine-tuning, or inference stage. The ICO expects this to be recorded before deployment, not reconstructed afterwards. Third, review transparency notices and Data Protection Impact Assessments. If a generative AI system processes personal data and no DPIA exists, that is the first gap to close. Treat DPIAs as live governance documents, revisited as the system or its use evolves.

Clearview AI and the territorial reach of UK GDPR

The Clearview AI litigation has continued to refine the question of when UK GDPR bites on overseas controllers. The original ICO enforcement notice and monetary penalty concerned the scraping of public web images to build a facial recognition database. The First-tier Tribunal initially found the ICO lacked jurisdiction because Clearview's clients were foreign law enforcement and national security bodies. The Upper Tribunal has since taken a different view on the scope of the relevant exemption, sending the matter back for further consideration.

The clarified position is that monitoring the behaviour of individuals in the UK is sufficient to engage UK GDPR's territorial scope under Article 3(2)(b), regardless of where the controller is established or where its customers sit. The foreign government client exemption is narrower than some had read it, and reliance on customer identity as a jurisdictional shield carries real risk.

For AI governance teams, the lesson is that territorial scope tracks the data subject, not the customer. If your training data includes information about UK residents, or your model's outputs concern them, you should assume UK GDPR applies. Three actions are worth taking now. Map where the personal data in your training sets and inference inputs originates, focusing on country of data subject rather than country of customer. Record a documented territorial scope assessment for each AI system, covering Article 3 UK GDPR. Review whether any exemption you rely on genuinely applies to your processing chain end to end. Data sourcing decisions made years ago continue to surface as enforcement matters today.

Practical next steps

The common thread across this week's developments is documentation. The ICO is not asking organisations to invent new categories of evidence; it is testing whether the records already required under UK GDPR actually exist and stand up to scrutiny.

  • Inventory. Maintain a current register of every AI system in use, including third-party and shadow deployments. Record the data categories processed at training, fine-tuning, and inference stages.
  • Lawful basis. For each system that processes personal data, record the identified lawful basis and the reasoning behind it, before deployment.
  • Territorial scope. Conduct and document an Article 3 assessment for each system, focusing on whose behaviour is being monitored, not where customers are located.
  • DPIAs. Treat Data Protection Impact Assessments as living documents. Revisit them when the model, its data sources, or its use cases change.
  • Transparency. Review privacy notices and ensure meaningful information about automated decision-making logic is accessible to affected individuals.
  • Exemptions. If you rely on a statutory exemption, test it end to end. Tribunal scrutiny is narrowing what can be relied upon.

The ICO has now demonstrated, in three different forms this week, that existing law is enough to act on. Organisations that have treated AI governance as a future regulatory question should reset that assumption.

For teams strengthening the data protection foundations of their AI work, the governance document templates organisations are now being asked to produce are catalogued at https://templates.veridio.co.uk/catalogue.