# How does the UK regulate AI?

AI is covered by laws your firm may already follow, and the UK rules on automated decisions changed in 2026.

The Assurance Desk. Published 2 October 2026. Last checked 7 October 2026.

**The short answer.** The UK has no AI Act. Existing regulators apply five government principles to AI, each within its own remit and in line with existing laws. For most businesses, the main rules are UK data protection rules, and the main regulator is the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO) ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response) and [legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

## UK AI regulation: how does it work?

The UK regulates AI through the laws and regulators it already has. The government set five principles, and each regulator applies them within its own remit ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response), checked 2 October 2026). The rules that apply to you depend on what your AI does. If it uses personal data, UK GDPR and the UK's Data Protection Act 2018 apply, and the ICO is the regulator ([legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

The approach comes from the government's response on AI regulation. It asked a number of regulators to publish their own approach to AI by 30 April 2024 ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response), checked 2 October 2026).

**Which UK law or body covers which AI question**

| The question | The law or body | In short |
| --- | --- | --- |
| Who regulates AI? | Existing regulators, such as Ofcom, the CMA, the FCA and the ICO | Each applies five principles within its own remit |
| What if AI uses personal data? | UK GDPR and the Data Protection Act 2018, regulated by the ICO | Data protection law applies, whoever built the tool |
| Can a computer make decisions about people? | UK GDPR, as changed by section 80 of the Data (Use and Access) Act 2025 | Yes, with safeguards, under rules in force since 5 February 2026. Special category data stays restricted |
| What does good practice look like? | The ICO's code of practice on AI and automated decisions | UK regulations require the ICO to write it. The duty began on 12 May 2026 |
| Can AI help with hiring? | The ICO's work on automated decisions in recruitment | Tell candidates, offer a human review, and test for bias |

Source: GOV.UK, A pro-innovation approach to AI regulation: government response, https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response (checked 2 October 2026); legislation.gov.uk, Data (Use and Access) Act 2025, section 80, https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 2 October 2026); legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, https://www.legislation.gov.uk/uksi/2026/425/made (checked 2 October 2026); ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection, https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/ (checked 2 October 2026); legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, https://www.legislation.gov.uk/uksi/2026/82/made (checked 2 October 2026); ICO, Automated decisions can streamline the hiring process, with the right safeguards in place, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/ (checked 2 October 2026)

> "The revised principles included safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress."
> UK Government, AI regulation policy
> GOV.UK, A pro-innovation approach to AI regulation: government response, https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response (checked 2 October 2026)

## Is there a UK AI Act?

No, the UK has no AI Act. AI is covered by the laws and regulators that already exist ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response), checked 2 October 2026). On 2 October 2026 we searched legislation.gov.uk, where the UK publishes its laws, for UK Public General Acts with "artificial intelligence" in the title, and found none ([legislation.gov.uk: UK Public General Acts with "artificial intelligence" in the title](https://www.legislation.gov.uk/ukpga?title=artificial%20intelligence), checked 2 October 2026).

That was a choice. In its response on AI regulation, the government said it would not rush to legislate. It said working without new law let it adapt, and that it would keep this under review ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response), checked 2 October 2026).

It also said general-purpose AI systems do not fit neatly within the remit of any one regulator. It set out the case for targeted, binding rules in the future on developers of highly capable general-purpose AI models ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response), checked 2 October 2026).

The newer plans are about adoption. On 8 June 2026 the Science Secretary, Liz Kendall, said the government is setting up AI sandboxes, so companies can test AI products safely. She said it will legislate for an AI Growth Lab, covering the whole economy, in its Regulating for Growth Bill ([GOV.UK, Liz Kendall's speech at AI Adoption Summit](https://www.gov.uk/government/speeches/liz-kendalls-speech-at-ai-adoption-summit), checked 2 October 2026).

The EU AI Act is a separate matter. It is an EU law, and it can still reach a UK firm that sells AI into the EU. [Our guide to the EU AI Act](/guides/eu-ai-act-uk-business) explains who it covers and when.

**UK AI regulation: the key dates**

- 15 March 2023, UK: The ICO updates its Guidance on AI and data protection
- 30 April 2024, UK: Regulators asked to publish their approach to AI by this date
- 5 February 2026, UK: New UK GDPR rules on automated decisions start
- 31 March 2026, UK: The ICO consults on draft guidance on automated decisions
- 16 April 2026, UK: UK regulations made that require the ICO to write a code of practice on AI
- 12 May 2026, UK: Those regulations come into force
- 8 June 2026, UK: The government announces AI sandboxes and an AI Growth Lab

Source: GOV.UK, A pro-innovation approach to AI regulation: government response, https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response (checked 2 October 2026); legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, https://www.legislation.gov.uk/uksi/2026/425/made (checked 2 October 2026); ICO, Guidance on AI and data protection, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (checked 2 October 2026); GOV.UK, Liz Kendall's speech at AI Adoption Summit, https://www.gov.uk/government/speeches/liz-kendalls-speech-at-ai-adoption-summit (checked 2 October 2026); legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, https://www.legislation.gov.uk/uksi/2026/82/made (checked 2 October 2026); ICO, Automated decisions can streamline the hiring process, with the right safeguards in place, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/ (checked 2 October 2026)

## What does the ICO expect when you use AI?

The ICO, the UK's data protection regulator, must write a code of practice on using personal data to develop and use AI, under UK regulations made in 2026. UK data protection law follows what you do with personal data, not who built the tool, so it covers a firm that only uses ChatGPT or Copilot ([legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

Those regulations were made on 16 April 2026, came into force on 12 May 2026, and cover the whole UK ([legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

The code must give guidance on good practice in using personal data to develop and use AI, and in automated decision-making. It must cover children's personal data too ([legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

The ICO also publishes Guidance on AI and data protection. It explains fairness, bias, discrimination and transparency in AI, and what to consider in a data protection impact assessment (DPIA) ([ICO, Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/), checked 2 October 2026).

That guidance was updated on 15 March 2023. The ICO says it is under review because of the UK's Data (Use and Access) Act, and may change ([ICO, Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/), checked 2 October 2026).

Daniel Solove, a law professor and the CEO of privacy training firm TeachPrivacy, argues that improving privacy law can help regulate AI. His comment below is a policy view, not a description of the current UK rules ([Daniel Solove on LinkedIn](https://www.linkedin.com/posts/danielsolove_we-can-make-great-progress-on-regulating-activity-7512259972756500480-bRIi), checked 7 October 2026).

> "We can make great progress on regulating AI by fixing the shortcomings of existing privacy laws."
> Daniel Solove, LinkedIn post excerpt
> Daniel Solove, LinkedIn post on AI and privacy law, 3 October 2026, https://www.linkedin.com/posts/danielsolove_we-can-make-great-progress-on-regulating-activity-7512259972756500480-bRIi (checked 7 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/danielsolove_we-can-make-great-progress-on-regulating-activity-7512259972756500480-bRIi)

## Automated decision-making under UK GDPR

UK GDPR has its own rules for decisions about people made by computer. Section 80 of the UK's Data (Use and Access) Act 2025 replaced Article 22 with new Articles 22A to 22D. They came into force on 5 February 2026 ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/made), checked 2 October 2026).

The rules cover a significant decision based solely on automated processing. A decision is solely automated if there is no meaningful human involvement in taking it. It is significant if it has a legal effect on the person, or a similarly significant effect ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 2 October 2026).

When you judge whether a person is meaningfully involved, you must consider how far the decision is reached by profiling ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 2 October 2026).

The change widened what is allowed. Before, these decisions were allowed only for a contract, where UK law permitted them with safeguards, or with the person's consent. Now they are allowed in a wider range of situations, as long as safeguards are in place ([ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/), checked 2 October 2026).

An organisation can rely on any lawful basis for them, apart from the new recognised legitimate interests basis ([ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/), checked 2 October 2026).

Special category data, the more sensitive kinds of personal data, stays restricted. A significant decision based on it may not be solely automated unless a condition in the law is met. One condition is that the decision rests entirely on data the person gave explicit consent for ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/), checked 2 October 2026).

Where a significant decision is solely automated, the organisation must have safeguards in place. It must tell the person about the decision. It must let them put their side, ask for a person to step in, and contest it. The ICO says these safeguards are very similar to the ones under the old law ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/), checked 2 October 2026).

**Is it a solely automated significant decision?**

- **No meaningful human involvement**
  - Software decides, and no person weighs the decision before it takes effect
- **A significant effect**
  - It has a legal effect on the person, or a similarly significant effect

Both conditions must apply. The rules in Articles 22A to 22D apply, and so do the safeguards.

Source: legislation.gov.uk, Data (Use and Access) Act 2025, section 80, https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 2 October 2026)

## Can you use AI to make hiring decisions?

Yes, a UK firm can use AI to make hiring decisions if it has the right safeguards, such as telling candidates, offering a human review and testing for bias. The ICO says the UK's Data (Use and Access) Act 2025 made automated decisions more straightforward, including decisions taken with no person involved ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).

On 31 March 2026 the ICO called on businesses to review how they use automated decisions in recruitment. Over the year before, it engaged with more than 30 employers on this ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).

It also wrote to 16 organisations likely to be using automated decisions on candidates. They committed to act on its recommendations ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).

In 2024 the ICO audited providers and developers of AI recruitment tools, and made almost 300 recommendations. Automated decisions in recruitment are one of the main areas its AI and biometrics strategy looks at closely ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).

On 31 March 2026 the ICO also launched a consultation on draft guidance on how all organisations can use automated decision-making ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).

That consultation has closed. The ICO plans to publish the final guidance in winter 2026 ([ICO, Our plans for new and updated guidance: technology](https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance/technology/), checked 2 October 2026).

**What the ICO asks of firms using automated decisions in hiring**

- Tell candidates if automated decisions are used, and explain how they work.
- Tell candidates how to challenge a decision and ask for a human review.
- Test regularly for biased outputs, and take steps to reduce them.
- When buying a tool, ask the developer about its own bias testing.
- Consider monthly bias reviews.

Source: ICO, Automated decisions can streamline the hiring process, with the right safeguards in place, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/ (checked 2 October 2026)

## What do AI engines cite on AI rules in the UK?

When The Assurance Desk asked six AI engines 15 questions about AI governance in the UK on 18 September 2026, their 90 answers cited 798 links from 361 websites, and 21 were official. No answer linked to legislation.gov.uk, where the text of UK law is published ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 2 October 2026).

We asked each question once, from the UK with web search on, of OpenAI GPT-4o, Microsoft Copilot, Google Gemini 2.5 Flash, Google AI Mode, Google AI Overviews and Perplexity. They were questions a buyer might type, about providers, certification, AI policies and software ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 2 October 2026).

Official means an address ending .gov.uk, .gov or europa.eu, or the ICO's ico.org.uk. The 21 official links appeared in 14 answers: five linked to the ICO's site and five to GOV.UK. This was one run on one day, and AI answers change ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 2 October 2026).

For what the rules ask of you, start with UK law on legislation.gov.uk and with the ICO.

## What to do

1. List where your firm uses AI on personal data, including tools staff use at work, such as ChatGPT or Copilot.
2. For each use, check whether any decision about a person has no meaningful human involvement and a legal or similarly significant effect ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 2 October 2026).
3. Where both are true, put the safeguards in place. Tell the person, and let them put their side, ask for a person to step in and contest the decision ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 2 October 2026).
4. If you use AI in hiring, test regularly for biased outputs. Ask the developer of any tool you buy about its own bias testing ([ICO, Automated decisions can streamline the hiring process, with the right safeguards in place](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/), checked 2 October 2026).
5. Read the ICO's Guidance on AI and data protection, and note that it is under review ([ICO, Guidance on AI and data protection](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/), checked 2 October 2026).
6. If you sell AI into the EU, read [our guide to the EU AI Act](/guides/eu-ai-act-uk-business) as well.

## Common questions

### Is a UK AI law coming?

The government said it would not rush to legislate, and would keep its approach under review. It set out a case for binding rules in the future on developers of highly capable general-purpose AI models. In June 2026 it said it will legislate for an AI Growth Lab in its Regulating for Growth Bill ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response) and [GOV.UK, Liz Kendall's speech at AI Adoption Summit](https://www.gov.uk/government/speeches/liz-kendalls-speech-at-ai-adoption-summit), checked 2 October 2026).

### What changed with the UK's Data (Use and Access) Act 2025?

One change that matters for AI is to the UK GDPR rules on automated decisions. Since 5 February 2026, organisations can make significant decisions about people by computer alone in more situations. They need safeguards in place. The restriction on special category data stays ([ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/) and [legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/made), checked 2 October 2026).

### We only use ChatGPT or Copilot. Do UK rules apply to us?

They can. UK data protection law applies when a tool uses personal data, whoever built it. The ICO's code of practice must cover using AI, not only developing it. If a tool makes a significant decision about someone with no meaningful human involvement, you must put the safeguards in place ([legislation.gov.uk, Data (Use and Access) Act 2025, section 80](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

### Who regulates AI in the UK?

There is no single AI regulator. Each regulator applies the government's five principles within its own remit. Where AI uses personal data, the regulator is the ICO ([GOV.UK, A pro-innovation approach to AI regulation: government response](https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response) and [legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/425/made), checked 2 October 2026).

## Where next

- [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md)
- [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md)
- [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md)

## Sources

- GOV.UK, A pro-innovation approach to AI regulation: government response: https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response (checked 2 October 2026)
- legislation.gov.uk, The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026: https://www.legislation.gov.uk/uksi/2026/425/made (checked 2 October 2026)
- legislation.gov.uk, Data (Use and Access) Act 2025, section 80: https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 2 October 2026)
- ICO, The Data (Use and Access) Act 2025: summary of the changes to data protection: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/ (checked 2 October 2026)
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026: https://www.legislation.gov.uk/uksi/2026/82/made (checked 2 October 2026)
- ICO, Automated decisions can streamline the hiring process, with the right safeguards in place: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/ (checked 2 October 2026)
- GOV.UK, Liz Kendall's speech at AI Adoption Summit: https://www.gov.uk/government/speeches/liz-kendalls-speech-at-ai-adoption-summit (checked 2 October 2026)
- ICO, Guidance on AI and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (checked 2 October 2026)
- legislation.gov.uk: UK Public General Acts with "artificial intelligence" in the title: https://www.legislation.gov.uk/ukpga?title=artificial%20intelligence (checked 2 October 2026)
- ICO, Our plans for new and updated guidance: technology: https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance/technology/ (checked 2 October 2026)
- The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file): https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json (checked 2 October 2026)
- Daniel Solove on LinkedIn, 3 October 2026: https://www.linkedin.com/posts/danielsolove_we-can-make-great-progress-on-regulating-activity-7512259972756500480-bRIi (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.