What does the ICO's 2026 guidance on AI call analysis actually require?
Transcribing and scoring calls is processing in its own right. The ICO's guidance asks for two things most vendors never mention: a written Legitimate Interest Assessment, and notices that name the analysis.
Answered in short
5 things that decide this
- 01The ICO's 2026 guidance on AI call analysis covers transcription and sentiment scoring. It expects two things before the tooling runs: a written Legitimate Interest Assessment, and notices that name the analysis.
- 02An LIA is the ICO's three-part test on paper: the purpose you're pursuing, why the processing is needed, and why your interest doesn't override the caller's.
- 03Analysis is separate from recording. A notice that says calls may be recorded for training does not cover AI sentiment scoring, so your notice wording has to change.
- 04Retention belongs in the LIA too. The ICO expects recordings, transcripts and scores kept only as long as the stated purpose needs, and deleted on a timer.
- 05UK insurance firms have a second reader. The FCA is looking at AI across underwriting, claims and consumer service in 2026, and the same paperwork serves both regulators.
The processing the ICO is worried about
AI call analysis means the layer on top of the recording: transcripts, sentiment scores, topic tags, QA scores for agents. Each of those is processing of personal data in its own right, and callers can't see any of it happening. That invisibility is the ICO's concern. So the guidance centres on a written assessment and plain notice, not on the tech itself.
Legitimate interests is the realistic lawful basis for most firms. The ICO refreshed its guidance on that basis after the Data (Use and Access) Act 2025 changed the wider rules. Either way, the basis only holds if the assessment behind it exists in writing. An LIA you could produce but never wrote is, to a regulator, an LIA that doesn't exist.
Four documents to have before the tooling runs
It all comes down to four records. A written LIA for the call analysis, using the ICO's own template. Privacy notices, and the recorded-line message, updated to name transcription and scoring. A retention schedule for recordings, transcripts and scores, with deletion on a timer. And a log tying each analysed call to the basis and notice that covered it.
One boundary matters more than the rest. If the analysis starts driving decisions about single callers with no real human involvement, you've left this guidance. You're into UK GDPR Articles 22A to 22D, which bring their own safeguards. Scoring calls to coach a team is one thing. Using a score to decline a caller is another.
This record-keeping shape is familiar ground for us. Hashlogics built PremiumAudit, an insurance audit platform. It puts carriers, auditors and policyholders on one shared record, and audit cycles run 75 percent faster. Your call analysis wants the same property: every score traceable to a call, a basis and a notice.
- Call recordedNotice names recording and analysis.
- TranscribedProcessing in its own right.
- ScoredSentiment, topics, QA.
- LIA on filePurpose, need, balance.
- Retention clockDeletion runs on a timer.
The assessment and the notice come before the first transcript, not after the first complaint.
Related questions
01Do we need caller consent for AI call analysis?+
Usually no. Legitimate interests can carry transcription and scoring if the written LIA holds and your notices disclose the analysis. Consent enters where the balance fails, or where special category data like health details gets analysed. Let your DPO make that call, case by case.
02Does the guidance cover inbound calls only?+
No. The duties follow the processing, so inbound and outbound calls are treated the same once you transcribe or score them. Outbound automated calling also picks up the UK's PECR marketing rules, a lane of their own.
03What if the analysis feeds automated decisions about callers?+
Then UK GDPR Articles 22A to 22D apply, the regime that replaced Article 22 on 5 February 2026. A big decision made with no real human involvement needs its own safeguards. You must tell the person, offer human help on request, and give a route to contest it.
Related
- Software for insurance agencies →Our insurance hub: what agencies actually build.
- Is an AI receptionist legal under UK GDPR Articles 22A-22D? →The automated-decision regime next door.
- What to automate first in an insurance agency →Which jobs to automate first, and why.
- Insurance AI wins where the rules are written down →Why rule-bound work automates well.
