Britain has no AI Act, which is usually where coverage of UK AI regulation starts and stops. Four existing regimes already impose duties on AI systems, one of them tightened in February 2026 while everyone was watching Parliament, and the political centre of gravity moved in July.
Andy Burnham became Prime Minister on 20 July 2026. The following day his government abolished the Department for Science, Innovation and Technology, moved AI policy and the AI Security Institute into the Cabinet Office, and appointed Kanishka Narayan as Minister of State for Artificial Intelligence, jointly in the Cabinet Office and the renamed Department for Business, Innovation, Science and Trade, attending Cabinet. AI has a seat at the Cabinet table for the first time.
So the UK AI regulation vacancy now has an occupant who could fill it. What binds today is everything below.
| Regime | Instrument | In force | Who enforces |
| Data protection | UK GDPR Articles 22A to 22C | 5 Feb 2026 | ICO |
| Equality | Equality Act 2010 | 2010 | EHRC, tribunals |
| Online safety | Online Safety Act 2023 | Phased from 2023 | Ofcom |
| Sector rules | FSMA, medical devices, others | Various | FCA, MHRA, others |
| An AI Act | None exists | Not applicable | Nobody |
Regime one: data protection, where the rule loosened rather than tightened
The binding part of UK AI regulation arrived inside data protection law, and it went the opposite way to Brussels.
Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. Royal Assent came on 19 June 2025, but section 80 was not commenced then. SI 2026/82 brought it into force on 5 February 2026, with a saving that leaves the old regime governing decisions taken before that date.
Old Article 22 prohibited significant solely automated decisions subject to narrow exceptions. The replacement permits them and attaches a safeguards duty instead. The ICO’s own summary of the changes puts it plainly: the section “removes these restrictions” and allows solely automated decisions “in a wider range of situations as long as it has appropriate safeguards in place”.
Article 22A carries the two definitions UK AI regulation rests on. A decision is based solely on automated processing “if there is no meaningful human involvement in the taking of the decision”, and is significant if it produces a legal effect or a “similarly significant effect”. Paragraph 2 requires consideration of “the extent to which the decision is reached by means of profiling”.
Article 22B keeps the prohibition where it matters most. A significant decision based entirely or partly on Article 9(1) special category data may not be taken solely automatically, unless the data subject gave explicit consent or the decision is necessary for a contract or required by law with Article 9(2)(g) satisfied. A separate bar applies where processing relies on recognised legitimate interests, a new lawful basis the same Act created, which lets a controller process without a balancing test for listed purposes. Convenience on the lawful basis costs you the automated decision.
Article 22C is the UK AI regulation duty to build against. Safeguards must be in place and must include measures that provide information about the decision, enable representations, enable human intervention on the part of the controller, and enable the data subject to contest it.
UK AI regulation runs a stricter parallel track for law enforcement processing. New sections 50A to 50D of the Data Protection Act 2018 use an adverse legal effect threshold rather than a neutral one.
Two undefined terms decide almost every scoping call
Article 22D lets the Secretary of State define by regulations when there is or is not meaningful human involvement, and what counts as a similarly significant effect, subject to the affirmative procedure and a bar on amending Article 22C.
No Article 22D regulations have been made. Both terms sit undefined, so every scoping decision rests on a controller’s own reading. Record why a reviewer counted as meaningfully involved, what they saw, what authority they held and how profiling featured. A conclusion with no reasoning behind it will not survive the moment those regulations arrive.
A statutory ICO code is coming, with no deadline
SI 2026/425, in force 12 May 2026, requires the Commissioner to “prepare an appropriate code of practice” on “developing and using artificial intelligence” and “automated decision-making”, which “must include guidance as to good practice in the processing of children’s personal data”.
The duty is live and the code does not exist. The regulations set no statutory deadline. Once written it becomes a statutory code under sections 124A and 124B of the Data Protection Act 2018, which the Commissioner must have regard to in enforcement. UK AI regulation acquires a rulebook that way, without an AI Act.
Separately, the ICO consulted on draft guidance about automated decision-making including profiling between 31 March and 29 May 2026. Consultation closed without final guidance being published.
Regime two: equality law, which predates all of it and does the discrimination work
UK AI regulation has no equivalent of Colorado’s algorithmic discrimination duty, because the Equality Act 2010 already covers it. Direct and indirect discrimination apply to a decision whether a human or a model made it, and indirect discrimination runs on outcome rather than intent, which makes British exposure materially different from the Texas position.
The Equality and Human Rights Commission set out its approach to regulating AI in April 2024, describing a focused and strategic posture given resource constraints. The Commission has taken no formal AI enforcement action. Its activity concentrates on the Public Sector Equality Duty, a compliance monitoring exercise with local authorities, engagement with police on facial recognition, and support for litigation challenging discriminatory use.
Employment tribunals, not the EHRC, are where most UK AI regulation discrimination claims will land, and the ICO has already mapped the practice. On 31 March 2026 it reported engaging over 30 employers on automated decision-making in recruitment and writing to 16 organisations likely using it, all of which committed to improvement. Its three findings were insufficient transparency with candidates, inconsistent human involvement, and weak adoption of bias monitoring. Its stated expectation includes proactive bias monitoring with monthly reviews, transparency with jobseekers, and explaining the route to human review.
Two regulators, one practice, and the evidence a tribunal would want is the evidence Article 22C already requires.
Regime three: online safety, with a hole the regulator has admitted
Nothing AI-specific reaches UK AI regulation from the Online Safety Act 2023, which catches AI only where a service meets its definitions. Ofcom has drawn that line publicly, twice.
A chatbot sits in scope where users can share its output with other users, where users create chatbots others use, where the tool searches more than one website or database, or where it can generate pornographic material. Anything users share is user-generated content and is regulated identically whether a human or a model made it.
Then the admission that redraws the UK AI regulation map. In a statement of 3 February 2026, Ofcom said that chatbot content generated “in a one-to-one interaction between a user and a chatbot that does not involve searching the internet or sharing with other users, is not regulated”, adding that “any changes to these powers would be a matter for Government and Parliament”.
A pure companion or assistant chatbot that keeps conversations private, searches nothing and generates no pornography sits outside British online safety law entirely, and the regulator has disclaimed the power to close the gap.
Where the Act does bite, Ofcom is using it. An investigation into X over Grok-generated intimate imagery opened on 12 January 2026, and an investigation into an AI companion chatbot service over age assurance opened on 15 January 2026, one of 94 investigations since the duties commenced.
Regime four: sector rules, where the sandboxes grant nothing
Thirteen regulators published strategic approaches to AI in 2024, and several run programmes worth knowing about. None of them changes a legal obligation.
The FCA runs an AI Lab, with AI Live Testing on a second cohort of eight firms from April 2026 and an evaluation report due in the first quarter of 2027, plus a Supercharged Sandbox whose first cohort held 22 firms. The MHRA runs AI Airlock for AI as a medical device, with a phase two report published on 27 July 2026 and £3.6 million of funding across three years. The CMA closed its foundation models review without making a market investigation reference.
Read the small print on each UK AI regulation sandbox. AI Airlock reports “do not constitute formal guidance” and the sandbox alters no legal requirement. No primary source states that FCA AI Live Testing creates a safe harbour, so treat it as supervisory engagement rather than legal protection. There is no AI-specific FCA rule at all: AI use is caught by the Consumer Duty, SYSC governance and outsourcing requirements, and the Senior Managers and Certification Regime.
The vacancy, and the things repeatedly reported as filling it
Five claims circulate about UK AI regulation that do not survive a check against the register.
No cross-cutting AI statute exists and no bill for one is before Parliament. The Parliament bills register holds three AI bills, none live. Lord Holmes’s Artificial Intelligence (Regulation) Bill reached first reading in March 2025 and went no further. The register shows a last update of 30 April 2026, and the bill fell when the session ended with the King’s Speech. No reintroduction has followed, although the Lords debated AI regulation again on 4 June 2026.
The Regulating for Growth Bill has not been introduced. Announced in the King’s Speech with “cross-cutting AI sandboxes” named explicitly, it returns zero results on the bills register under its own name, under “growth” and under “sandbox”. The statutory powers that would permit lawful disapplication of regulation for AI trials do not exist.
The AI Growth Lab has no government response. The call for evidence closed on 7 January 2026 with no published outcome, and its legal vehicle is the unintroduced bill above. An advisory forerunner operates in legal services and states that participation “does not provide regulatory approval, endorsement or exemptions from legal obligations”.
The five cross-sectoral principles are not law. The 2023 white paper said government would “not put these principles on a statutory footing initially”, anticipating a due regard duty on regulators when parliamentary time allowed. No such duty has ever been enacted.
UK copyright law as it applies to AI training is unchanged. Sections 135 to 137 of the Data (Use and Access) Act created duties on the Secretary of State, not on developers, and they were discharged by the report and impact assessment of 18 March 2026, which abandoned the broad exception with opt-out, declined to legislate, and committed to input transparency as best practice.
On the institution most often misdescribed: the AI Security Institute, renamed from the AI Safety Institute in February 2025 and now in the Cabinet Office, is a research organisation inside government. No enabling statute for it appears on the statute book, and it claims no licensing, information-gathering or enforcement power. On that basis it should be read as having none, and its model evaluations proceed by voluntary agreement with developers.
What is actually likely to change, and when
Three live processes will move UK AI regulation before any AI Act does.
The ICO code, whenever it lands. No deadline, statutory force on arrival, and children’s data expressly in scope.
Article 22D regulations, whenever made. Defining meaningful human involvement would settle the largest open question in British automated decision-making overnight.
A second round of data protection reform. A call for evidence on data regulation in the age of AI was published on 15 July 2026 and closed on 9 September 2026, four days before this update. The questions asked were whether data protection law “remains suitable” for AI or whether targeted reform or a wider overhaul is needed, covering lawful basis, data quality and fairness, accountability across supply chains, transparency and automated decision-making.
Reading those three together with a Cabinet-level AI minister, the likeliest shape of the next move is more data protection reform and a statutory code rather than a standalone AI Act.
Penalties come from the regimes that already existed
No AI-specific penalty exists anywhere in UK AI regulation.
Breach of the Article 22C safeguards is enforced through the UK GDPR fining structure, where the higher maximum is £17.5 million or 4 percent of total worldwide annual turnover, whichever is higher, and the standard maximum is £8.7 million or 2 percent. Article 22C sits within the Articles 12 to 22 range attracting the higher tier, though that is a reading of Article 83(5)(b) as amended rather than a published ICO statement, so confirm it before relying on the figure.
Online Safety Act penalties reach £18 million or 10 percent of qualifying worldwide revenue, whichever is greater, with daily-rate penalties, business disruption measures and criminal liability for senior managers on certain information failures.
Equality Act awards are uncapped in discrimination claims, which in practice makes a badly evidenced hiring model a larger exposure for most employers than any data protection fine.
The FCA sets penalties under its DEPP 6.5A framework rather than a statutory ceiling: disgorgement, a seriousness percentage of relevant revenue from 0 to 20 percent, aggravating and mitigating factors, deterrence and a settlement discount.
Adoption broadened threefold and barely deepened
Scale behind UK AI regulation is measured in Artificial intelligence in UK businesses, published by the Office for National Statistics on 20 July 2026, which reports that self-reported AI use among businesses with ten or more employees rose from around 12 percent to around 35 percent since late 2023. Firms with 250 or more employees reach 49 percent, against 28 percent below ten employees. Information and communication leads at 58 percent; construction trails at 13 percent.
Depth is where the useful figure sits. Average AI technologies per adopting business moved only from about 1.4 to 1.6. Adoption widened roughly threefold and deepened almost not at all, so most British organisations are governing one or two systems rather than a portfolio.
What a British programme has to be able to produce
Fewer artefacts are asked for by UK AI regulation than by Brussels, and harder questions about two of them.
Hold a register of significant decisions, recording for each whether it produces a legal or similarly significant effect, whether special category data is involved, and which lawful basis applies, since recognised legitimate interests bars solely automated significant decisions outright.
Hold the reasoning on meaningful human involvement per system: what the reviewer sees, what authority they hold, what share of the outcome comes from profiling, and why that adds up to meaningful involvement. With Article 22D unexercised, that reasoning is the defence.
Hold evidence that the four Article 22C safeguards operate, with logs of information given, representations made, interventions obtained and decisions contested.
Hold bias monitoring results on any system touching recruitment or promotion, at the cadence the ICO has asked for, because the same evidence answers the Equality Act question and the Article 22C question.
How this compares with other regimes sits in the global regulation tracker, and the far heavier European position in what the EU AI Act asks and when. Which record answers which obligation is worked out in the records that prove conformity.
Where the British records live
Two features of UK AI regulation make this a records problem. The controlling terms are undefined, so reasoning has to be preserved rather than conclusions. And a statutory code is coming with no deadline, so whatever is built now will be judged against a standard that does not yet exist.
Govern365 holds each system once in the AI System Registry with its decision type, lawful basis, special category flag and the recorded reasoning on meaningful human involvement, which is what Article 22C scoping actually turns on. The Audit Evidence Manager attaches the information notice, representation records, intervention logs, contest outcomes and bias monitoring results to the obligation each satisfies, with dates and approvers, so one bias report answers both the ICO and a tribunal. Governance Workflows carry the human intervention route itself, so an intervention leaves a record rather than an email thread. Continuous Monitoring keeps that evidence current as models change and as the ICO code lands. All of it sits in one platform at govern365.ai, and the route from intake to an approved, evidenced system is shown on where these approvals are tracked.
Frequently asked questions
Does the UK have an AI Act?
No. UK AI regulation has no cross-cutting AI statute and no bill for one before Parliament. Lord Holmes’s Artificial Intelligence (Regulation) Bill reached first reading in March 2025 and fell when the session ended in May 2026. Since 21 July 2026 AI policy has sat in the Cabinet Office under a Minister of State for Artificial Intelligence attending Cabinet.
What is the binding AI rule in the UK?
UK AI regulation binds through Articles 22A to 22C of the UK GDPR, inserted by section 80 of the Data (Use and Access) Act 2025 and in force since 5 February 2026. The new articles permit significant solely automated decisions subject to a safeguards duty and retain the prohibition for special category data.
Did UK law on automated decisions get stricter or looser?
Looser. UK AI regulation previously prohibited, under the old Article 22, significant solely automated decisions with narrow exceptions. The ICO describes the change as removing those restrictions and allowing such decisions in a wider range of situations where appropriate safeguards are in place.
What counts as meaningful human involvement?
No statutory definition exists in UK AI regulation. Article 22A says a decision is solely automated where there is no meaningful human involvement and requires consideration of how far the decision is reached by profiling. Article 22D lets the Secretary of State define the term by regulations, and none have been made.
Is AI hiring discrimination regulated in the UK?
Yes. UK AI regulation handles it through the Equality Act 2010 rather than any AI statute. Indirect discrimination runs on outcome rather than intent, so a model that disadvantages a protected group is exposed regardless of design intent. The ICO wrote to 16 organisations using automated decision-making in recruitment in March 2026 and expects proactive bias monitoring with monthly reviews.
Are AI chatbots regulated under the Online Safety Act?
Only some. UK AI regulation puts a chatbot in scope where users can share its output, where users create chatbots for others, where it searches more than one website or database, or where it can generate pornographic material. Ofcom stated on 3 February 2026 that one-to-one chatbot interaction meeting none of those conditions is not regulated.
What fines apply to AI failures in the UK?
No AI-specific penalty exists in UK AI regulation. Breach of the Article 22C safeguards is enforced under the UK GDPR, where the higher maximum is £17.5 million or 4 percent of worldwide annual turnover. Online Safety Act penalties reach £18 million or 10 percent of qualifying worldwide revenue. Equality Act discrimination awards are uncapped.
