In May 2026, the UK Information Commissioner’s Office (ICO) consulted on its draft guidance on the Research, Archiving and Statistics (RAS) provisions. These provisions matter for researchers, universities, cultural institutions, public bodies, industry research department and AI developers because they shape when and how personal data may be used and reused for research, how data subject rights apply, and what safeguards must be in place.
CREATe has submitted a response based on the UKRI Metascience AI project, Removing Legal Hurdles in Copyright and Data Privacy for AI-driven Research: Unleashing the Potential of AI for Science, led by Dr Zihao Li, Senior Lecturer in Technology Law at the University of Glasgow. The project examines how copyright and data protection law affect AI-driven research across the full research and technological lifecycle, including data acquisition, organisation, model training, deployment, verification, publication and reuse.
Our response welcomes ICO’s draft guidance. In particular, we welcome the clarification that scientific research could include commercial research, as well as the recognition that consent will often not be the most appropriate lawful basis for research processing. The guidance is also helpful in confirming that further processing for RAS purposes could be compatible with the original purpose where appropriate safeguards are in place, and that broad consent and longe term storage may be appropriate in research contexts. At the same time, we argue that the draft guidance still relies too heavily on a static, project-by-project and individualised model of research. That model does not fully capture the features of contemporary AI-driven research, where datasets are shared and reused, model weights are derived from training data, retraining is iterative, model distillation and orchestration are increasingly central to research practice and research pipelines often involve universities, cultural institutions, infrastructure providers and industry partners.
Our response makes several recommendations:
- The ICO should adopt a lifecycle-aware reading of scientific research. AI research is not a single shot, especially for AI research. It involves acquisition, organisation, training, evaluation, validation, retraining, benchmarking, publication and reuse. The guidance should recognise these activities as integral parts of research, rather than treating them as separate engineering or product-development steps.
- The four proposed criteria for scientific research definition should be treated as flexible indicators, not rigid gates. The draft guidance refers to scientific objective, scientific method, uncertainty and transferability. These are useful indicators, but if applied cumulatively and strictly they could exclude important forms of AI research, including fine-tuning, transfer learning, model distillation, benchmarking, replication studies and applied work carried out through university-industry collaboration.
- Pre-deployment AI development should be capable of falling within scientific research. The response argues that model training, fine-tuning, red teaming and evaluation, including by commercial entities, can form part of scientific research where they are carried out with methodological rigour and appropriate safeguards. Heightened obligations should crystallise at the point of market entry or deployment, rather than being imposed too bluntly at the research and training stage.
- The guidance should distinguish upstream research from downstream decisions about individuals. We agree that the RAS provisions should not be used to justify operational decisions about particular people. However, upstream training, validation and retraining should not be treated as a measure or decision about data subjects merely because a later deployed model may inform such decisions. The relevant transparency, contestability and automated decision-making safeguards should attach at deployment.
- The ICO should give more practical guidance on the disproportionate effort exception. Large-scale AI research, especially involving web-scraped or aggregated corpora, may involve millions of data subjects across many jurisdictions. Individual notification is often impossible in any meaningful sense. The guidance should provide factors and examples for corpus-level transparency, project webpages, opt-out mechanisms, dataset cards, trusted research environments and intermediary communication through publishers or platforms.
- The final guidance should address web-scraped, aggregated and inferential data more directly. Public availability does not itself provide a lawful basis for processing, and AI corpora may contain special category data in non-obvious ways. The response calls for clearer treatment of incidental special category data and inferential special category data, especially where sensitive attributes may be derived from apparently non-sensitive inputs.
- The ICO should coordinate the RAS guidance with copyright reform, especially the text and data mining exception. AI research is shaped by data protection and copyright law at the same time. A project may qualify as scientific research under data protection law while facing copyright barriers to the copying required for text and data mining. Researchers should not be left navigating contradictory obligations across regimes.
Overall, it urges that the ICO should develop a research safe harbour for AI-driven research, including more workable obligations inside the AI research lifecycle, combined with stronger accountability at the edge of market entry. Inside the lifecycle, researchers should be able to collect, retain, share, train and evaluate under robust internal governance. At market entry, transparency, licensing or equitable remuneration, downstream accountability, automated decision-making safeguards and fuller data subject rights should apply.
The underlying concerns discussed above are structural. Data protection law, even as updated by the Data (Use and Access) Act 2025, continues to assume research that is project-based, individualised and relatively static. AI-driven research is iterative, multi-stage, multi-actor and large-scale. If guidance does not engage with that reality, the UK risks a system that is too restrictive upstream, where research is conducted, and too permissive downstream, where models may affect individuals and communities. Addressing this challenge requires coordination across data protection, copyright, platform regulation, sector-specific regulation and emerging AI governance. CREATe’s response urges the ICO to work with IPO, UKRI and the competent policymakers to ensure that obligations on researchers are coherent across the AI research lifecycle.
You can access the full text of the response below.
Access our policy responses here, and stay tuned for our updates by subscribing to our newsletter.