Data on Information pertaining to its Artificial Intelligence (AI) Strategy and AI systems: FOI release

Information requested

To ask the Scottish Parliament and/or government for the following data:

1. Any recorded data on Information pertaining to its 'Artificial Intelligence (AI) Strategy', including road-maps, timelines, milestones and responsible Scottish or UK ministers.

2. Any recorded data on AI systems and service suppliers that have been actively sought, are currently engaged with, and/or may be engaged with in the future (i.e. Booked Appointments). The list should include:

• a.) The company name.
• b.) The responsible individual for that company.
• c.) AI systems and/or Services offered to the government.
• d.) The total agreed or provisional Costs for those services.
• e.) The total agreed amount of public expenditure to fund, or part fund, any AI systems, services or strategies.
• f.) The agreed length of the contract and renewal dates.
• g.) The country where the company headquarters is registered.

3. A list of specific AI systems and/or services that are currently implemented and which public systems and services are currently integrated with AI systems and services.

4. The risk assessment pertaining to the 'Artificial Intelligence (AI) Strategy' or 'AI' in general.

5. Recorded discussions, in any medium, surrounding AI and GDPR, including any data pertaining to GDPR checklist for data controllers such as the Scottish or UK Parliaments or Governments.

Response

Firstly, please note that the Scottish Government is not responsible for responding to Freedom of Information requests on behalf of the Scottish Parliament, so this response only covers the core Scottish Government departments. If you wish to raise a similar question with the Parliament, or our Executive Agency counterparts, you can find contact details here:

• Requesting information | Scottish Parliament Website
• Executive agencies - National public bodies: directory - gov.scot

1. Any recorded data on information pertaining to its 'Artificial Intelligence (AI) Strategy', including road-maps, timelines, milestones and responsible Scottish or UK ministers.

I have interpreted Question 1 as a request seeking information pertaining to the current AI Strategy, which was published in 2021.

A search for relevant items under this question returned thousands of documents which would require review, and consideration as to whether 1) these are actually in scope of your request, and 2) any redactions to in-scope documents are required. I consider that the cost of locating, retrieving and providing these documents, including staff time to check what is in scope and prepare information for release, would significantly exceed the upper cost limit of £600.

We do endeavour to provide information whenever possible. However in this instance an exemption under section 12(1) of the Freedom of Information (Scotland) Act applies to the information requested. Under section 12(1), public authorities are not required to comply with a request for information if the authority estimates that the cost of complying would exceed the upper cost limit, which is currently set at £600 by regulations made under section 12.

You may, however, wish to consider reducing the scope of your request in order that the costs can be brought below £600. If you choose to make a new, narrower request, I suggest that you could restrict your request by relating it to specific elements of the strategy, or a specific timeframe. I also suggest that you may find it helpful to look at the Scottish Information Commissioner's 'Tips for requesting information under FOI and the EIRs', on his website at: http://www.itspublicknowledge.info/YourRights/Tipsforrequesters.aspx.

You may wish to know that the State of AI Report is an annual commitment outlined in Action 1.8 from the AI Strategy. The report gives an account of the progress made on the delivery of the Strategy's actions. You can find the State of AI reports below:

State of AI Report 2021-22
State of AI Report 2022-23
State of AI Report 2023-24
Scottish AI Alliance Impact Report 2024-25

I have also provided a link to the impact assessments related to Scotland’s AI Strategy: Supporting documents - Artificial intelligence strategy: trustworthy, ethical and inclusive - gov.scot

2. Any recorded data on AI systems and service suppliers that have been actively sought, are currently engaged with, and/or may be engaged with in the future (i.e Booked Appointments). The list should include:

a.) The company name.
b.) The responsible individual for that company.
c.) AI systems and/or Services offered to the government.
d.) The total agreed or provisional Costs for those services.
e.) The total agreed amount of public expenditure to fund, or part fund, any AI systems, services or strategies.
f.) The agreed length of the contract and renewal dates.
g.) The country where the company headquarters is registered.

While our aim is to provide information whenever possible, in this instance the costs of locating, retrieving and providing the information requested would exceed the upper cost limit of £600. The reason for this is that to locate and retrieve that information we would need to conduct a search of all of the records of the Scottish Government. It may help if I explain that we file our information according to the subject matter, not by reference to the names of organisations with whom we have corresponded. Under section 12(1) of FOISA, public authorities are not required to comply with a request for information if the authority estimates that the cost of complying would exceed the upper cost limit, which is currently set at £600 by Regulations made under section 12.

You may, however, wish to consider reducing the scope of your request in order that the costs can be brought below £600. For example, you could restrict your request to a specific business area of the Scottish Government, or a specific timeframe, as this would allow us to limit the searches that would require to be conducted.

For your information, the Scottish Government has made use of subscriptions to AI services, delivered by commercial suppliers, since June 2023. I refer you to our previously published responses:

https://www.gov.scot/publications/foi-202500477145/
https://www.gov.scot/publications/foi-202500472238/
https://www.gov.scot/publications/foi-202500462622/

3. A list of specific AI systems and/or services that are currently implemented and which public systems and services are currently integrated with AI systems and services.

The Scottish Government is committed to ensuring AI is used responsibly, ethically, and effectively to improve outcomes for the people of Scotland. We have introduced the AI Register https://scottishairegister.com/ which is being developed to share information regarding the use of AI by the public sector in Scotland. The Register requires that the Scottish Government and other public sector organisations in Scotland record all AI use which is not being centrally delivered, or which is under development and may not yet be fully live and in use.

Scottish Ministers have mandated use of the Register and work is ongoing to expand its use across Scotland, with technical governance support from the Scottish Government. The Register provides transparency on AI use in the public sector and allows public feedback. This is part of Scotland’s Open Government Action Plan and complements the UK-wide Algorithmic Transparency Recording Standard (ATRS), which became mandatory in January 2025. Beyond the AI Register, there is no other central register of AI systems or services, or services that are integrated with AI systems and services.

4. The risk assessment pertaining to the 'Artificial Intelligence (AI) Strategy' or 'AI' in general.

I have interpreted Question 4 as a request seeking a generic AI risk assessment. I should explain that risk management for AI use within the Scottish Government is structured around transparency, governance, and ethical principles rather than a single risk register pertaining to AI use. As there is no single risk assessment report pertaining to the 'Artificial Intelligence (AI) Strategy' or 'AI' in general, this is a formal notice under section 17(1) of FOISA that the Scottish Government does not have the information you have requested, in this instance.

You may be interested to know that the Scottish Government is in the process of designing an AI specific governance tool, which will record centrally, the work currently being done at a local level, to record and mitigate AI risk. This makes up part of the administration of the Scottish AI Register and is currently under development. You can read details of how this will work here: AI system risk management.

Risk management is essential to delivering the Scottish Government’s objectives and the priorities set out in the Programme for Government. We therefore expect business areas to manage risk appropriately, as part of the corporate risk management processes that operate in the Scottish Government.

5. Recorded discussions, in any medium, surrounding AI and GDPR, including any data pertaining to GDPR checklist for data controllers such as the Scottish or UK Parliaments or Governments.

I sought clarification from you regarding this question, on 4 December 2025. In your reply to my email, on 5 December 2025, you stated that you were referring specifically to the UK GDPR Data Controller Checklist from the ICO, an online tool developed by the ICO to support data controllers in decision-making. Please note that in Scotland, we are subject to OSIC (Office of the Scottish Information Commissioner) and not ICO, as we act under FOI(S)A.

As it stands, your question remains very broad-ranging in scope. We do endeavour to provide information whenever possible. However in this instance an exemption under section 12(1) of the Freedom of Information (Scotland) Act applies to the information requested. This is because locating and retrieving this information would require a search of all the records of the Scottish Government. Under section 12(1) of FOISA, public authorities are not required to comply with a request for information if the authority estimates that the cost of complying would exceed the upper cost limit, which is currently set at £600 by Regulations made under section 12. I consider that the cost of locating, retrieving and providing these documents, including staff time to check what is in scope and prepare information for release, would significantly exceed the upper cost limit of £600. You may wish to consider reducing the scope of your request in order that the costs can be brought below £600.

You may be interested to know that the Scottish AI Playbook https://www.scottishaiplaybook.com/ published in 2025, provides guidance to help organisations use AI in a responsible and ethical way. This includes a data 5 protection audit framework designed to help organisations (large businesses and organisations in the public, private and third sectors) assess their compliance with key requirements under data protection law.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.