AI and Digital Hub

1) How does the process work?

Innovators are invited to submit their query to the AI and Digital Hub via the link below. You will be asked to complete a Microsoft Forms application, where you will provide information about your product, service or business model, your cross-regulatory query and why you think you meet our eligibility criteria. Please ensure all questions in the application form are completed and answered comprehensively – not providing sufficient information will make it harder for us to consider if your query is eligible to be progressed through the Hub.

We will review your query and inform you of the outcome. If eligible, we aim to provide informal advice on your query within eight weeks of formal acceptance, but please note that response times will depend on the number of regulators involved and complexity of the query.

All queries and any informal advice issued in response will be subject to the Conditions of Participation.

2) Who can use the service?

Our free service is open to organisations of any size, in any sector, as long as you meet our eligibility criteria outlined below:

• Your product, service or business model that you are asking about is 
  innovative;
• Your product, service or business model that you are asking about focuses on artificial intelligence (AI) or digital;
• Your product, service or business model that you are asking about can 
  demonstrate a benefit to consumers, businesses and/or the UK economy;
• Your query falls within the scope of at least two of the four DRCF members’ regulatory remits.

3) Can law firms and consultants use the service?

Yes, providing they meet the Hub eligibility criteria.

4) How do you define innovation?

Innovation is defined by the DRCF AI and Digital Hub as: “A new or adapted way of conducting an activity within the scope of the Hub. This could include the development of new services or products or creating efficiencies in how these are delivered or a new process or method to meet regulatory requirements.”

5) How will innovators benefit from this service?

The Hub aims to help innovators bring new products and services to market safely and more quickly by providing informal advice from DRCF regulators on issues that cross regulatory boundaries.

As the Hub becomes operational and we start to provide informal advice, innovators will also be able to search a bank of case studies based on the informal advice provided previously by the Hub to increase their understanding of the regulatory framework, or find answers to specific questions without having to submit a query.

6) Will the informal advice from regulators be legally binding?

Our informal advice is not legally binding nor is it a replacement for you obtaining independent legal advice as you develop your product, service or business model. It is ultimately an organisation’s responsibility to assess its position under the law and the regulatory regime, with the benefit of independent legal advice if necessary.

Our informal advice is provided subject to the Conditions for Participation in the Hub.

7) Will the hub provide an endorsement of my product of service?

The provision of the Informal Advice (and publication of a case study) should not be taken to mean that any DRCF Regulator has approved or endorsed a participant’s query or specific business model, product or service.

Neither the participant nor anyone acting on their behalf may publicise, nor make any statement or announcement, either expressly or by implication, that suggests that DRCF Regulators have approved, endorsed, or otherwise accepted that the participant’s query or specific business model, product or service complies with legal and/or regulatory requirements as a result of their involvement with the Hub.

8) What does each regulator’s remit cover?

The Competitions and Markets Authority (CMA) is the UK’s lead competition and consumer authority and an independent non-ministerial department of the UK government. The CMA helps people, businesses and the UK economy by promoting competitive markets and tackling unfair behaviour. The CMA’s ambition is to promote an environment where consumers can be confident, they are getting great choices and fair deals, and competitive, fair-dealing 
businesses can innovate and thrive.

Ofcom is the regulator and competition authority for the UK communications industries. It regulates the TV and radio sectors, fixed line telecoms, mobiles, postal services, plus the airwaves over which wireless devices operate. It is responsible for enforcing the Online Safety Act and regulations requiring communications providers and Digital Infrastructure Service providers comply with security obligations. 

The Information Commissioner’s Office (ICO) is the UK’s independent public authority set up to uphold information rights. It upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

The Financial Conduct Authority (FCA) regulates the financial services industry in the UK. Its role includes protecting consumers, keeping the industry stable, and promoting healthy competition between financial service providers. The FCA regulates the conduct of 50,000 firms in the UK, ensuring our financial markets are honest, competitive and fair.

9) How long will it take to receive a response?

We aim to respond within eight weeks from the Hub formally accepting a query. This is an indicative timeline and may vary depending on the complexity of the query (for example, how many regulators’ remits it interacts with). Our consideration of each application and the time taken to formally accept a query for a response by the Hub may also vary according to:

• the number of DRCF regulators the query concerns
• the complexity of the query and/or product, service or business model
• whether we require further information from you in order to respond to your query.

If your query is confirmed as eligible by the Hub, we will keep you informed of the timeline for a response. 

10) How much detail will you go into in your response?

We will provide as much information as we can to help you determine what regulatory frameworks within the DRCF member regulators’ remits are likely to apply to the product, service or business model that you are asking about, how those may apply and what matters you should consider in the further development of your product, service or business model.

The informal advice provided will be limited to regulations and rules in force at the time your query is accepted, to the information you have provided and the extent of the assessment possible within an eight-week timeframe. Our informal advice should not be treated as an exhaustive account of the issues linked to your product or service, and is not a substitute for independent legal advice.

11) Is there an opportunity for follow-up queries?

While the service is not intended to be an ongoing support service, you will be able to clarify any aspects of our response which are unclear, to confirm your understanding of the information in the informal advice. Once the informal advice is provided, we do not envisage any ongoing communications to amplify or expand the advice given. 

12) Will my query go straight to the relevant regulator/s?

The Hub is resourced by a team from across the four regulators. The advice will come jointly from those regulators who have accepted the query. 

13) Will I hear back from one regulator, or more?

You can expect to receive a response from a DRCF AI and Digital Hub representative. For a query to be eligible, it must fall within the scope of at least two regulators’ remits. Our goal is to provide you with one response incorporating the views of each of the DRCF regulators that have accepted your query.

14) What if I don’t want my idea/query published?

You can request to anonymise the case study and we will consult with you to ensure we have paid due regard to any confidentiality concerns you may have.

15) I participated in the Hub previously; can I submit another query?

Yes. You are free to submit queries whether you have been previously involved in the Hub or not.

16) Can you decline to respond to a query?

Acceptance of a query is at the discretion of the DRCF regulators, taking account of the Hub’s Conditions for Participation, due diligence carried out by each regulator, whether we have sufficient space in the Hub, whether there are any ongoing investigations into the product, service or business model or any aspect of it and whether the regulators consider that the Hub is the correct vehicle to respond to a particular query.

In order to assess your query properly, we may need to ask for additional information from you and note that any response will be limited to the information you provide us with. If your query falls solely within only one regulator’s remit, we will provide you with the relevant contact for you to approach that regulator individually.

17) Will you take action against me if you learn of something non-compliant?

Our goal is to offer innovators a platform to submit queries to help bring products, services or business models to market safely and more quickly. 

However, Hub participation does not in any way limit the DRCF regulators’ duties and obligations under applicable legislation. This means that if you share any information that indicates a planned product, service or business model may fall foul of the law, DRCF members will consider the information you have provided in line with their usual procedures.

Where relevant we retain the right to forward issues identified in a response which may require further consideration by a relevant service within a regulator(s).

The provision of informal advice does not prevent a regulator (DRCF or non-DRCF) from taking any enforcement action in the future in relation to the product, service or business model that is the subject of your query.

18) I have a question which isn’t answered here, who should I send it to?

For questions, support and advice regarding the Hub, please send your questions to AIHubDRCF@ico.org.uk.

We aim to respond to emails within five working days. We will let you know if it will take us longer to respond.

Please note, the ICO is responsible for managing the DRCF AI and Digital Hub inbox. Any emails received to this inbox will be handled by the ICO in the first instance. The ICO may share your email with other regulators in order to respond to you.

1) The multi-regulator informal advice (Informal Advice) offered by some or all of the CMA, FCA, ICO and Ofcom as applicable, to participants through the Hub is solely in relation to their specific queries. As a result, the Informal Advice should not be viewed as a full examination or audit and will not identify all of the risks associated with the product or service to which the participant’s query relates. This remains the case even if the Informal Advice raises issues that the participant has not expressly mentioned in their query. 

2) Unless expressly stated otherwise, the Informal Advice will be based on the specific information that the participant shared with the Hub and the relevant DRCF Regulators’ understanding of the legal and regulatory frameworks within their remit in force as at the date of the provision of the Informal Advice. The Informal Advice is only directly applicable to the relevant participant and is specific to their circumstances at the specific time of their query and as described by them through the information they provided to the Hub.

3) The Informal Advice does not cover any legal or regulatory aspects outside the scope of the DRCF Regulators’ remits that may arise from a participant’s query (for instance under the National Security and Investment Act 2021). With regards to the CMA’s remit, the Informal Advice will not cover the CMA’s functions under the Subsidy Control Act 2022 and the UK Internal Market Act 2020.

4) Participants are not required to take account or rely on the Informal Advice, and it is not a replacement for any independent legal advice participants may have obtained or may wish to obtain. Participants remain responsible for compliance with all legal and regulatory obligations, whether within the remit of DRCF Regulators or otherwise.

5) Participants will need to remain open and transparent at all times in relation to their query including before and during the time of their participation in the Hub. If participants are aware of any information that they believe would affect the Informal Advice, they should inform the Hub in writing immediately, in particular they should inform the Hub of any change of circumstances which could mean that they no longer meet the eligibility criteria for the Hub.

6) A separate case study based on the Informal Advice and giving due regard to any confidentiality concerns (and after consultation with the participant), will be published. Participants should clearly identify confidential information in their submission to the Hub, including any third-party confidential information, and provide clear reasons why they regard such information to be confidential. They should also clearly identify, within five working days of receipt of the Informal Advice, which information contained in the Informal Advice they consider to be confidential information and provide clear reasons why they regard such information to be confidential. Please note that if the submission or any related correspondence does contain third party confidential information (e.g. from a business partner), then the Participant must ensure that it has the permission of the third party in question to use that information for the purpose of engaging with the Hub. Where the confidential information contains personal data the Participant must ensure that the disclosure is compliant with UK GDPR.

7) The provision of the Informal Advice (and publication of a case study) should not be taken to mean that any DRCF Regulator has approved or endorsed a participant’s query or specific business model, product or service. It does not fetter the discretion of any DRCF Regulator to subsequently take a different regulatory position or action. Any Informal Advice is given without prejudice to any decision or action that DRCF Regulators may individually take against participants in the future, including any enforcement in line with their statutory powers or other legal or regulatory action. The positions reflected in the Informal Advice may change over time, for example on receipt of further information, or following a change in law, court judgments, regulatory guidance or DRCF Regulators’ policy.

8) Working with the Hub does not prevent legal or regulatory action by the DRCF Regulators or by any other competent regulatory body or authority. The Informal Advice does not affect rights conferred on third parties (such as participants’ customers), nor does it bind or create any precedents for any courts and may not reflect the views of other competent regulatory body or authority within or outside of the UK.

9) Participants’ involvement in the Hub will end upon the participant’s receipt of the Informal Advice unless it ended earlier. DRCF Regulators may, at any time terminate, with immediate effect, a participant’s involvement with the Hub in particular if: (i) we determine that the participant’s conduct, either in involvement with or outside of the Hub, is contrary to the public interest or is likely to bring DRCF Regulators into disrepute; or (ii) DRCF Regulators cease to operate the Hub for any reason; or (iii) a change in circumstances means that the participant no longer meets the eligibility criteria for the Hub to review their query.

10) Neither the participant nor anyone acting on their behalf may publicise, nor make any statement or announcement, either expressly or by implication, that suggests that DRCF Regulators have approved, endorsed, or otherwise accepted that the participant’s query or specific business model, product or service complies with legal and/or regulatory requirements as a result of their involvement with the Hub. 

11) The participant must not share the Informal Advice with any other party (either in part or in full) without the relevant DRCF Regulators’ express permission. This does not prevent the participant from disclosing the Informal Advice to their legal advisers or auditors provided attention is drawn to this disclaimer and the Conditions for Participation when doing so.

Version II – 16 May 2024 

1) General Information

This privacy notice (the “Privacy Notice”) describes how your personal information is  collected and used for the purposes of responding to queries submitted to the Digital Regulation Cooperation Forum (“DRCF”) AI and Digital Hub and in accordance with the UK GDPR and Data Protection Act 2018. Unless otherwise defined, the terms used in this Privacy Notice shall be interpreted in accordance with these applicable laws.

The Privacy Notice should be read in conjunction with the Cookies Policy for the DRCF.

2) Data Controllers

The DRCF is a voluntary forum comprising the following four member regulators, who are joint controllers for the processing of personal information in relation to the DRCF AI and Digital Hub:

• The Competition and Markets Authority (CMA)
• The Financial Conduct Authority (FCA)
• The Information Commissioner (ICO)
• Office of Communications (Ofcom)

The DRCF website is hosted by Ofcom and complies with Ofcom’s data protection and information security standards.

In the Privacy Notice, we refer to the DRCF member regulators collectively as “the 
Controllers” or “we”, as applicable.

3) Contact Details for the Data Controllers and their Data Protection Officers (DPO)

CMA

Competition and Markets Authority
The Cabot
25 Cabot Square
London
E14 4QZ
United Kingdom

The CMA’s DPO can be contacted at:

Email: dpo@cma.gov.uk
Telephone: 020 3738 6000

FCA

Financial Conduct Authority 
12 Endeavour Square
London
E20 1JN
Telephone: 0800 111 6768 (freephone), 0300 500 8082 (from the UK), +44 207 066 1000 (from abroad)

The FCA’s DPO can be contacted at: 

Email: dataprotection-individualsrightsrequests@fca.org.uk

ICO

The Information Commissioner
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Fax: 01625 524510

The ICO’s DPO can be contacted at:

The ICO Data Protection Officer is Louise Byers. She may be contacted via this online form or via the ICO postal address. Please mark the envelope “Data Protection Officer”.

Ofcom

Ofcom
Riverside House
2a Southwark Bridge Road
London
SE1 9HA

Ofcom’s DPO can be contacted at:

Email: corporationsecretary@ofcom.org.uk
Telephone: 020 7981 3000

4) The personal information we collect and purposes of processing

When you contact us to make an enquiry through the DRCF Digital and AI Hub, we will collect the information provided for the purpose of processing your query and providing you with an answer. This will include the processing, where necessary, of any personal information provided (e.g. contact names, email addresses and any other relevant contact details).

We may publish information relevant to your question on our website, as well as our answer. Before we do this, we will consult you on the proposed publication. If you do not consent to the publication of any personal information or information identifying your business, we will remove this information from the proposed publication.

The website for the DRCF Digital and AI Hub collects information that your browser sends whenever you visit the site (“Log Data”). This Log Data may include information such as your computer's Internet Protocol (“IP”) address, browser type, browser version, the pages of our Site that you visit, the time and date of your visit, the time spent on those pages and other statistics. In addition, we may use third party services, such as Google Analytics, that collect, monitor and analyse this.

We use Google Analytics to understand how many visitors are viewing the site. This information is shared in an aggregate format with the Controllers.

We use Microsoft Forms for receiving applications to the DRCF AI and Digital Hub.

5) Lawful bases for processing

The lawful basis we rely on as Controllers to process your personal information is Article 6(1)(e) of the UK GDPR, which allows us to process personal information when this is necessary for us to perform our public tasks as regulators.

If the information you provide to us in relation to your enquiry contains special category data, such as health, religious or ethnic information the lawful basis we rely on to process it is Article 9(2)(g) of the UK GDPR, which also relates to our public task and the safeguarding of your fundamental rights and Schedule 1 Part 2(6) of the DPA 2018 which relates to statutory and government purposes.

6) How we store your personal information

Your personal information is securely stored. The Controllers have each put in place appropriate technical and organisational measures to protect your personal information and to prevent any unauthorised or unlawful processing and any accidental loss, destruction or damage to it.

7) How long we keep your personal information

The Controllers will keep the personal data processed for the purposes of the DRCF Digital and AI Hub for 6 years. 

8) Sharing your information

We will not share your personal information with any third parties for the purposes of direct marketing.

We, the Controllers, use data processors who are third parties to provide elements of services for us. Each Controller has put in place contracts with any data processors used.

This means that those data processors cannot do anything with your personal 
information unless the Controllers have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

In some circumstances individual Controllers may be legally obliged to share information (e.g. under a court order). Information will only be shared when a Controller is satisfied that there is a lawful basis on which to share the information and decision-making will be documented.

Each Controller is a public authority for the purposes of the Freedom of Information Act 2000. In light of this, any of the Controllers may receive information requests under Section 1 of the Freedom of Information Act 2000. Requests will be considered by each Controller on a case-by-case basis and your personal information will only be disclosed where the relevant Controller is legally required to do so.

As the DRCF is not a legal entity and each Controller is independently subject to the Freedom of Information Act 2000, please submit your request to the Controller you believe is most likely to hold the information.

9) Sharing personal information overseas

When it is necessary for a Controller to transfer your personal information outside of the UK this will only be done in accordance with the UK GDPR.

10) Your data protection rights

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

11) Request to exercise your data subject rights

If you wish to exercise the above rights and/or manage your information, please contact AIHubDRCF@ico.org.uk. For the purposes of the DRCF AI and Digital Hub, the ICO is responsible for managing the inbox. Any emails received to this inbox will be handled by the ICO in the first instance. The ICO will share your email with each Controller for the purpose of responding to your request.

If your request relates only to the personal data held by the DRCF AI and Digital Hub, you may receive a response from AIHubDRCF@ico.org.uk. If your request is broader in scope, you may receive a response from all four Controllers. 

12) Request a service adjustment

As each Controller is a public authority and a provider of services to the public, we have a legal duty to comply with the Equality Act 2010.

This means that we must make service adjustments for anyone with a disability who contacts us in any capacity, to eliminate any barriers to accessing our services. Our lawful basis for processing this information is article 6(1)(c) of the UK GDPR as we have a legal obligation to provide this. Our processing of special category data, such as health information you give us, will be based on article 9(2)(a), which means we need your consent.

We will create a record of your adjustment requirements. This will consist of your name, contact details and type of adjustment required, along with a brief description of why it is required. Relevant staff can access this to ensure they are communicating with you in the required way. This information will be securely stored and retained in accordance with the DRCF AI and Digital Hub Retention Schedule (see Section 7).

Please note that as your consent will be required to process your special category data, you have a right to withdraw your consent at any time.

To request a service adjustment, please contact AIHubDRCF@ico.org.uk.

13) Your right to complain

If you have any queries or concerns when it comes to the processing of your personal information, please contact AIHubDRCF@ico.org.uk.

If you remain dissatisfied you can make a complaint about the way your personal 
information has been processed, to the ICO as the UK supervisory authority.

Complaints will be handed in the same way as a complaint about any other organisation.

14) Changes to this Privacy Notice

We keep the Privacy Notice under regular review to make sure it is up to date and 
accurate.

We will record any updates on this page as soon as practicably possible.