UK AI Regulation 2026: What You Must Do

The most common misconception we meet in UK boardrooms is that AI is unregulated here because there is no UK AI Act.

There is no UK AI Act. There are also a great many binding obligations on how you use AI. Both are true, and the gap between them is where organisations get into trouble. The absence of a single statute gets read as an absence of duty, right up until a regulator asks a question that assumes one.

Here is the position as of September 2026, and what to do about it.

The short version

There is no UK AI Act. Duties arrive through existing regulators applying existing law: the ICO, the FCA, the MHRA and others.
Data protection is the main live regime. Since 5 February 2026 the UK GDPR’s automated decision rules sit in Articles 22A to 22D, which allow significant automated decisions with safeguards.
The EU AI Act still reaches UK organisations whose AI outputs are used in the EU. The high-risk deadlines moved to December 2027 and August 2028. The Article 5 prohibitions and the Article 50 transparency duties are already live.
Cyber security guidance is now the yardstick for AI agents. The NCSC’s interim guidance asks for sandboxing, monitoring and an emergency stop.
Five artefacts satisfy most regimes at once: an AI inventory, a usable policy, DPIAs done before processing, an AI-specific risk register and human oversight that is real.

The state of play

The UK has chosen not to pass a cross-economy AI law. The approach set out in the government’s pro-innovation white paper puts the obligation on existing regulators to apply existing law to AI within their remits.

Three things have moved in 2026 without changing that direction:

Sandboxes. The Regulating for Growth Bill, announced in the King’s Speech on 13 May, would put regulatory sandboxes on a statutory footing, including a large-scale AI Growth Lab for testing products under supervision. It is not a binding horizontal AI law of the EU type.
Frontier models. The government has said it will bring forward a Frontier AI Bill to put the AI Security Institute on a statutory footing. We had not seen one introduced by 29 September. After this summer’s evaluation incidents, a written statement on 7 September pointed to the NCSC’s August advice on agentic AI and said the NCSC is developing formal guidance and standards.
Who owns it. The Department for Science, Innovation and Technology was dissolved on 20 July. AI strategy, public sector AI adoption and the AI Security Institute now sit in the Cabinet Office. Guidance published before then still carries DSIT’s name.

This is often described as lighter touch than the EU. For a compliance team it is frequently harder, for one reason: there is no checklist that discharges your duty. Under a prescriptive regime you demonstrate compliance by satisfying enumerated requirements. Under a principles-based one you have to reason about your particular use, reach a defensible conclusion, and show your working.

What binds you now

Set aside “AI regulation” as a category and ask which existing regimes your use case touches. For most UK organisations the live ones are these.

Data protection (UK GDPR and the Data Protection Act). The most consequential and the most often overlooked. Training or prompting a model with personal data is processing. It needs a lawful basis, a purpose limitation position, and, for anything high risk, a DPIA completed before processing begins.

Automated decisions changed this year. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D on 5 February 2026. A solely automated decision with a legal or similarly significant effect is now allowed with safeguards: information about the decision, a chance to make representations, human intervention and a way to contest it. It stays restricted where special category data drives the decision. The test is whether there is meaningful human involvement, so a rubber stamp does not take you out of scope. The ICO has been updating its guidance to match, and it has been clear that AI does not get an exemption.

Sector regulation. Financial services firms face model risk management expectations and Consumer Duty obligations that reach any model influencing customer outcomes. Healthcare providers face information governance requirements, and a model that informs clinical decisions may be a medical device requiring MHRA involvement. These predate AI and apply to it without amendment.

Equality law. A model that produces materially different outcomes across protected characteristics creates discrimination exposure, whether or not anyone intended it and whether or not the mechanism can be explained.

Consumer and contract law. If a customer-facing assistant states something incorrect about your product, terms or obligations, that is your statement. “The model said it” is not a defence anyone has run successfully.

Employment law. AI in recruitment, monitoring or performance management sits on a well-developed body of law with a low tolerance for opaque process.

Cyber security expectations. Not law in themselves, but the yardstick assurance teams and regulators reach for. In August the NCSC published interim guidance on agentic AI covering sandboxing, monitoring, attributable activity and an emergency stop, and it says formal guidance will follow. At Lords committee stage in September, peers proposed amendments to the Cyber Security and Resilience Bill including an AI shutdown provision, though the government resisted bringing AI vendors into its scope. Our guide to NVIDIA’s Open Agent Safety Platform maps the NCSC guidance onto controls you can deploy.

Most of that predates AI. All of it applies now.

The EU AI Act still reaches you

UK organisations placing AI systems on the EU market, or whose AI outputs affect people in the EU, are in scope wherever they are established.

Regulation (EU) 2026/1744, the AI Omnibus, entered into force on 27 July 2026 and moved the main high-risk deadlines:

Obligation	Deadline
Prohibited practices (Article 5)	In force and enforceable
Transparency duties (Article 50): telling people they are dealing with AI, labelling synthetic content	Applied from 2 August 2026, with a grace period to 2 December 2026 for marking generative content already on the market
Annex III high-risk systems (recruitment, credit scoring, law enforcement, education, essential services)	2 December 2027
Annex I high-risk systems (AI embedded in regulated products)	2 August 2028

The deferral applies to the high-risk regime. It does not apply to the prohibitions, which are enforceable now and carry the heaviest penalties in the Act: up to €35 million or 7% of global annual turnover. The Omnibus added two more, on non-consensual intimate imagery and child sexual abuse material, from 2 December 2026.

The older prohibitions cover social scoring, manipulative or exploitative techniques, and biometric categorisation using sensitive attributes, among others. Most organisations are not doing these things. The ones that are usually do not know it. The risk sits in vendor tooling adopted without review, particularly in HR, workforce analytics and customer profiling.

If you have not checked your third-party AI tooling against Article 5, that is the highest-value hour of compliance work available to you right now. Our guide to the EU AI Act for UK organisations covers scope and timing in detail.

What to put in place

The same small set of artefacts satisfies most of these regimes at once. You do not need a separate programme per regulator.

1. An AI inventory

You cannot govern what you have not counted. Almost every organisation we assess underestimates its own AI use by a wide margin, because AI arrives embedded in tools that were bought as something else.

For each system, record what it does, what data reaches it, who the supplier is, where processing happens, who owns it internally, and what failure looks like. Include agents that can take actions, not only tools that answer. Include the tools people are using without approval. You will find them, and they usually have the worst terms.

2. An AI policy people can follow

Most AI policies fail because they are written as prohibitions, so they are ignored. A workable policy tells staff which data classifications may go into which tier of tool, and gives a route to get something approved. If the practical effect of your policy is that the compliant path is impossible, the risk has not been reduced. It has moved somewhere you cannot see.

3. DPIAs done before, not after

For any AI processing personal data at meaningful scale or with meaningful consequences, the DPIA is a legal requirement and the single most useful document you will produce. Done properly at design time, it also answers most of what a procurement panel, an auditor or an information governance board will later ask.

4. A risk register with AI-specific entries

Generic technology risk entries do not capture what goes wrong with AI: unreliable output stated with confidence, drift as the world changes under a fixed model, prompt injection through untrusted content, and over-reliance by users who have stopped checking. Each needs an owner, a control and a review date.

5. Human accountability that is real

“There is a human in the loop” is the most over-claimed control in AI governance. A person who approves 200 outputs an hour is not a control. If you rely on human review, the review has to be resourced, given realistic time, and evidenced. Otherwise stop claiming it. Under the new automated decision rules, review that does not change outcomes may not count as meaningful human involvement at all.

What happened to DSIT’s AI Management Essentials

DSIT consulted on AI Management Essentials (AIME) in November 2024. It was a self-assessment tool aimed at SMEs but applicable to any organisation developing, providing or using AI. In February 2026 the government said it would not publish AIME as a finished tool, and so would not make it a requirement of public sector procurement. It said it would develop guidance on foundational AI governance instead, with a focus on SMEs. We had not found that guidance published by 29 September.

That does not make the questions go away. If you sell into the public sector, expect procurement panels to ask about AI governance anyway. The Algorithmic Transparency Recording Standard (ATRS) remains mandatory for central government departments and for arm’s-length bodies that deliver public services or deal directly with the public. Our article on AIME covers what the draft asked and how to use it as a self-check.

ISO/IEC 42001

For organisations that need to demonstrate governance to customers as well as regulators, ISO/IEC 42001, the AI management system standard, is becoming the recognised answer. ISO 27001 became the default response to security questionnaires in the same way.

It is worth pursuing if AI governance questions are appearing in your sales cycle or your tenders. It is not worth pursuing because it exists. The underlying artefacts matter more than the certificate, and they are the same ones listed above.

In short

You are not waiting for a UK AI Act to tell you what to do. The obligations are already live, they arrive through regulators you already deal with, and the evidence they will ask for is broadly the same in each case.

Organisations that build that evidence as they go find it costs very little. Organisations that reconstruct it eighteen months later, under time pressure, find it costs a great deal. Some of them find that the answer is that the system should not have been built the way it was.

Frequently asked questions

Is there a UK AI Act?

No. The UK has no cross-economy AI statute. The government has said it will bring forward a Frontier AI Bill for the most capable models. The Regulating for Growth Bill would create AI sandboxes. Neither is a general AI law.

Is AI regulated in the UK?

Yes, through existing law applied by existing regulators: UK GDPR and the ICO, sector regulators such as the FCA and MHRA, and equality, consumer, contract and employment law. There is no single AI regulator.

Does the EU AI Act apply to UK companies?

Yes, if you place an AI system on the EU market, put one into service there, or your AI’s output is used in the EU. Where you are established does not matter.

Do I need a DPIA to use AI on personal data?

Usually. UK GDPR requires a DPIA before processing that is likely to result in a high risk to people. ICO guidance treats new technology such as AI as a factor that often tips a use case over that line.

Which UK regulator is responsible for AI?

It depends on the use. The ICO covers personal data, the FCA financial services and the MHRA medical devices. The AI Security Institute tests frontier models but is a research body, not a regulator, and the NCSC issues cyber security guidance.

Sources

General information about the UK regulatory landscape as at September 2026, not legal advice. The position is moving. For advice on your specific obligations, consult a qualified solicitor.

If you need the artefacts above built, that is our AI governance and compliance service.

UK AI regulation in 2026: what you have to do