11/05/2026
SUBJECT ACCESS REQUESTS - ICO updated Guidance on use of AI when submitting a request.
Organisations are increasingly encountering Subject Access Requests drafted using artificial intelligence and whilst it may feel like a shortcut, the downsides are becoming harder to ignore.
AI-generated SARs are often:
• unnecessarily lengthy and repetitive;
• unclear or imprecise in scope;
• legally inaccurate or poorly framed;
• filled with generic or irrelevant demands; and
• broader than the individual actually intends.
In practice, many of these requests include references to rights or legal obligations that are incorrect, or ask for categories of information without a clear understanding of what is being sought. This creates avoidable delay, additional cost, and greater administrative burden for both sides.
Importantly, poorly understood or overly broad requests can slow down access to your own personal data. Where a SAR is vague, contradictory or excessive, organisations are more likely to seek clarification or rely on exemptions to narrow or manage the request. That inevitably pushes back response times and can delay disclosure of the information you are trying to obtain.
The core issue is not the use of AI itself, but the tendency to rely on its output without properly checking or understanding it. AI can produce confident but incorrect legal assertions and introduce unnecessary complexity that works against the requester’s interests.
If you do not fully understand what has been submitted, you are more likely to face clarification requests or exemption-based resistance, both of which slow down access to your data.
Clear, focused and well-understood SARs remain the most effective route to timely disclosure.
If you have received a SAR and not sure what to do, get in touch.
[email protected]