How does the UK regulate AI?

UK AI regulation: how does it work?

The UK regulates AI through the laws and regulators it already has. The government set five principles, and each regulator applies them within its own remit. The rules that apply to you depend on what your AI does. If it uses personal data, UK GDPR and the UK's Data Protection Act 2018 apply, and the ICO is the regulator.

The approach comes from the government's response on AI regulation. It asked a number of regulators to publish their own approach to AI by 30 April 2024.

Is there a UK AI Act?

No, the UK has no AI Act. AI is covered by the laws and regulators that already exist. On 2 October 2026 we searched legislation.gov.uk, where the UK publishes its laws, for UK Public General Acts with "artificial intelligence" in the title, and found none.

That was a choice. In its response on AI regulation, the government said it would not rush to legislate. It said working without new law let it adapt, and that it would keep this under review.

It also said general-purpose AI systems do not fit neatly within the remit of any one regulator. It set out the case for targeted, binding rules in the future on developers of highly capable general-purpose AI models.

The newer plans are about adoption. On 8 June 2026 the Science Secretary, Liz Kendall, said the government is setting up AI sandboxes, so companies can test AI products safely. She said it will legislate for an AI Growth Lab, covering the whole economy, in its Regulating for Growth Bill.

The EU AI Act is a separate matter. It is an EU law, and it can still reach a UK firm that sells AI into the EU. Our guide to the EU AI Act explains who it covers and when.

What does the ICO expect when you use AI?

The ICO, the UK's data protection regulator, must write a code of practice on using personal data to develop and use AI, under UK regulations made in 2026. UK data protection law follows what you do with personal data, not who built the tool, so it covers a firm that only uses ChatGPT or Copilot.

Those regulations were made on 16 April 2026, came into force on 12 May 2026, and cover the whole UK.

The code must give guidance on good practice in using personal data to develop and use AI, and in automated decision-making. It must cover children's personal data too.

The ICO also publishes Guidance on AI and data protection. It explains fairness, bias, discrimination and transparency in AI, and what to consider in a data protection impact assessment (DPIA).

That guidance was updated on 15 March 2023. The ICO says it is under review because of the UK's Data (Use and Access) Act, and may change.

Daniel Solove, a law professor and the CEO of privacy training firm TeachPrivacy, argues that improving privacy law can help regulate AI. His comment below is a policy view, not a description of the current UK rules.

Automated decision-making under UK GDPR

UK GDPR has its own rules for decisions about people made by computer. Section 80 of the UK's Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D. They came into force on 5 February 2026.

The rules cover a significant decision based solely on automated processing. A decision is solely automated if there is no meaningful human involvement in taking it. It is significant if it has a legal effect on the person, or a similarly significant effect.

When you judge whether a person is meaningfully involved, you must consider how far the decision is reached by profiling.

The change widened what is allowed. Before, these decisions were allowed only for a contract, where UK law permitted them with safeguards, or with the person's consent. Now they are allowed in a wider range of situations, as long as safeguards are in place.

An organisation can rely on any lawful basis for them, apart from the new recognised legitimate interests basis.

Special category data, the more sensitive kinds of personal data, stays restricted. A significant decision based on it may not be solely automated unless a condition in the law is met. One condition is that the decision rests entirely on data the person gave explicit consent for.

Where a significant decision is solely automated, the organisation must have safeguards in place. It must tell the person about the decision. It must let them put their side, ask for a person to step in, and contest it. The ICO says these safeguards are very similar to the ones under the old law.

Can you use AI to make hiring decisions?

Yes, a UK firm can use AI to make hiring decisions if it has the right safeguards, such as telling candidates, offering a human review and testing for bias. The ICO says the UK's Data (Use and Access) Act 2025 made automated decisions more straightforward, including decisions taken with no person involved.

On 31 March 2026 the ICO called on businesses to review how they use automated decisions in recruitment. Over the year before, it engaged with more than 30 employers on this.

It also wrote to 16 organisations likely to be using automated decisions on candidates. They committed to act on its recommendations.

In 2024 the ICO audited providers and developers of AI recruitment tools, and made almost 300 recommendations. Automated decisions in recruitment are one of the main areas its AI and biometrics strategy looks at closely.

On 31 March 2026 the ICO also launched a consultation on draft guidance on how all organisations can use automated decision-making.

That consultation has closed. The ICO plans to publish the final guidance in winter 2026.

What do AI engines cite on AI rules in the UK?

When The Assurance Desk asked six AI engines 15 questions about AI governance in the UK on 18 September 2026, their 90 answers cited 798 links from 361 websites, and 21 were official. No answer linked to legislation.gov.uk, where the text of UK law is published.

We asked each question once, from the UK with web search on, of OpenAI GPT-4o, Microsoft Copilot, Google Gemini 2.5 Flash, Google AI Mode, Google AI Overviews and Perplexity. They were questions a buyer might type, about providers, certification, AI policies and software.

Official means an address ending .gov.uk, .gov or europa.eu, or the ICO's ico.org.uk. The 21 official links appeared in 14 answers: five linked to the ICO's site and five to GOV.UK. This was one run on one day, and AI answers change.

For what the rules ask of you, start with UK law on legislation.gov.uk and with the ICO.

What to do

1. List where your firm uses AI on personal data, including tools staff use at work, such as ChatGPT or Copilot.
2. For each use, check whether any decision about a person has no meaningful human involvement and a legal or similarly significant effect.
3. Where both are true, put the safeguards in place. Tell the person, and let them put their side, ask for a person to step in and contest the decision.
4. If you use AI in hiring, test regularly for biased outputs. Ask the developer of any tool you buy about its own bias testing.
5. Read the ICO's Guidance on AI and data protection, and note that it is under review.
6. If you sell AI into the EU, read our guide to the EU AI Act as well.

Common questions

Is a UK AI law coming?

The government said it would not rush to legislate, and would keep its approach under review. It set out a case for binding rules in the future on developers of highly capable general-purpose AI models. In June 2026 it said it will legislate for an AI Growth Lab in its Regulating for Growth Bill.

What changed with the UK's Data (Use and Access) Act 2025?

One change that matters for AI is to the UK GDPR rules on automated decisions. Since 5 February 2026, organisations can make significant decisions about people by computer alone in more situations. They need safeguards in place. The restriction on special category data stays.

We only use ChatGPT or Copilot. Do UK rules apply to us?

They can. UK data protection law applies when a tool uses personal data, whoever built it. The ICO's code of practice must cover using AI, not only developing it. If a tool makes a significant decision about someone with no meaningful human involvement, you must put the safeguards in place.

Who regulates AI in the UK?

There is no single AI regulator. Each regulator applies the government's five principles within its own remit. Where AI uses personal data, the regulator is the ICO.

Where next

• Exposed to the EU AI Act
• What does the EU AI Act ask of a UK business?
• Does your UK business need an AI policy, and what goes in it?

This is an independent editorial guide, not legal advice.