What the regulator found
The ICO issued a reprimand and enforcement notice after Metropolitan Police officers and staff used an unapproved retail-crime intelligence platform to share personal information. Its findings concern data governance, safeguards and approval processes. The source does not establish that the platform was an AI system. [1]
Remediation did not end the wider concern
The ICO acknowledged improvements made before the platform returned to use in January 2026. It nevertheless required stronger controls over identifying, assessing and approving third-party services, plus periodic implementation updates. [1]
ADM perspective
A service can become embedded in a workflow before formal procurement notices it. Maintain an inventory of tools actually used, restrict unapproved access and give staff a practical route to request safer alternatives. Automation makes this control more important because an unreviewed workflow can repeat the same disclosure at scale.
Read the original sources
The original publications provide the full detail, evidence and limitations.
- ICO · Primary publicationICO takes action against Metropolitan Police Service over information governance failures
An AI-assisted, source-led summary. “ADM perspective” is editorial interpretation, separate from the source’s findings. Our editorial approach.