Skip to main content

    AI by country · Western Europe

    AI in the United Kingdom: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in United Kingdom know before starting with AI?

    The UK has no AI-specific law as of 29 October 2026. AI that uses personal data is governed by the UK GDPR and the Data Protection Act 2018, as changed by the Data (Use and Access) Act 2025, whose main data protection changes took effect on 5 February 2026. Sector regulators such as the FCA and the MHRA apply their existing rules to AI.

    At a glance

    United Kingdom at a glance

    Key facts about United Kingdom
    Data protection lawUK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025 (main changes in force since 5 February 2026)
    RegulatorInformation Commission, still known as the ICO (it replaced the Information Commissioner on 30 September 2026)
    AI policyAI Opportunities Action Plan (January 2025) and a principles-based approach run by sector regulators. No AI-specific law as of 29 October 2026
    Time zoneGMT, UTC+0 in winter; BST, UTC+1 in summer (India is 5.5 or 4.5 hours ahead)
    CurrencyGBP (pound sterling)
    Business languageEnglish

    Why now

    Why United Kingdom is worth watching

    Each point links to the document it comes from.

    • The government's AI Opportunities Action Plan, published on 13 January 2025, has 50 recommendations, including expanding public AI research compute at least 20 times by 2030.[6]

    • Most data protection changes in the Data (Use and Access) Act 2025 came into force on 5 February 2026, including a wider set of cases where solely automated decisions are allowed.[1]

    • Since June 2026 every organisation must offer a way to raise a data protection complaint and acknowledge it within 30 days.[3]

    • The ICO consulted from 31 March to 29 May 2026 on new guidance on automated decision-making and profiling; the final version had not been published when we checked.[4]

    • The FCA says it does not plan extra rules for AI and expects firms to apply the Consumer Duty and the Senior Managers and Certification Regime.[8]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    UK GDPR and Data Protection Act 2018

    In force2018These remain the core rules for any AI that touches personal data: you need a lawful basis, must be fair and transparent, and must run a data protection impact assessment for high-risk processing. The ICO's Guidance on AI and data protection explains how this applies to AI, but it dates from March 2023 and the ICO says it is under review because of the 2025 Act.[5]

    Data (Use and Access) Act 2025: automated decision-making

    In force2025From 5 February 2026, organisations can make solely automated decisions with legal or similarly significant effects in more situations than before. In return they must tell people about significant decisions, let them make representations and challenge the decision, and offer human intervention. The Act also adds a new lawful basis called recognised legitimate interests for listed purposes such as crime prevention and safeguarding.[10]

    Data (Use and Access) Act 2025: commencement, complaints and the regulator

    Phased2025The Act received Royal Assent on 19 June 2025 and came into force in stages. The complaints duty applied from June 2026, and the Information Commissioner was replaced by a new Information Commission on 30 September 2026. Fines under the electronic marketing rules (PECR) can now reach £17.5 million or 4% of global turnover.[1]

    Where AI fits first

    Where AI fits first

    Banking, insurance and investments

    Complaint triage, fraud alerts and drafting customer letters, with staff checking outputs before they reach customers.

    The FCA relies on the Consumer Duty and SM&CR rather than AI-specific rules, so a named senior manager should own each AI use.[8]

    Health and medical devices

    Triage support and image analysis, where the software may count as a medical device.

    The MHRA runs AI Airlock, a regulatory sandbox for AI medical devices. Phase 3 opened on 6 October 2026 and focuses on post-market surveillance.[9]

    Recruitment and HR

    Screening applications and scheduling interviews, with a person making the hiring decision.

    Rejecting a candidate by a solely automated decision is a significant decision, so the safeguards on notice, challenge and human review apply. The ICO's draft ADM guidance covers recruitment.[4]

    Retail and customer service

    Chatbots and product search for customers in the UK and the EU.

    A UK company that places an AI system on the EU market or whose AI output is used in the EU can fall under the EU AI Act, whose chatbot transparency duties apply from August 2026.[11]

    Your first steps

    Your first steps

    1. List every AI use that makes or shapes a decision about a person, and mark which ones are solely automated with a significant effect.
    2. For those decisions, set up the safeguards the 2025 Act requires: notice, a way to make representations and challenge, and human review.
    3. Run a data protection impact assessment before launching AI that profiles people or uses special category data.
    4. Check that your complaints process acknowledges data protection complaints within 30 days.
    5. If you are regulated by the FCA, name the senior manager accountable for each AI system and test outcomes against the Consumer Duty.
    6. If you sell into the EU, check whether the EU AI Act applies to your system and when.
    7. Watch the ICO site for the final automated decision-making guidance and the updated AI guidance.

    AI services for United Kingdom

    AI consulting and development for teams in United Kingdom

    We work remotely with companies in United Kingdom, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) works 9:30 to 18:30, which is 04:00 to 13:00 UTC. In UK winter (UTC+0) that gives about 4 hours of overlap, 09:00 to 13:00 UK time; in summer (UTC+1) about 5 hours, 09:00 to 14:00. If personal data will be accessed from India, check the UK rules on international transfers first.

    Questions

    Common questions about AI in United Kingdom

    Does the UK have an AI law?

    Not as of 29 October 2026. The government follows five non-statutory principles applied by existing regulators, set out in its February 2024 response, and has said it will legislate when it is confident that is right.

    Can we let an AI system make decisions about customers on its own?

    More often than before. Since 5 February 2026 the Data (Use and Access) Act allows solely automated significant decisions in more cases, but you must tell people, let them challenge the decision and offer human review.

    Who regulates data protection now?

    The Information Commission, which took over from the Information Commissioner on 30 September 2026 under the 2025 Act. It is still known as the ICO.

    Does the EU AI Act affect a UK business?

    It can, if you place an AI system on the EU market or its output is used in the EU. Its rules for high-risk uses listed in Annex III now apply from 2 December 2027, after the EU's Digital Omnibus on AI changed the dates.

    Can UK personal data still flow to the EU?

    Yes. The European Commission lists the UK as having adequacy decisions under the GDPR, which it renewed in December 2025.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Department for Science, Innovation and Technology (GOV.UK), 2026-10-12. Data (Use and Access) Act 2025: plans for commencement(gov.uk)
      Full title and what we used it for

      Data (Use and Access) Act 2025: plans for commencement. Primary. Used for Royal Assent on 19 June 2025, stage 3 commencement on 5 February 2026 and the transfer of the ICO's functions to the Information Commission from 30 September 2026.

    2. [2] Information Commissioner's Office, 2026-02-05. Statement on the commencement of the Data (Use and Access) Act (DUAA)(ico.org.uk)
      Full title and what we used it for

      Statement on the commencement of the Data (Use and Access) Act (DUAA). Primary. Used for most remaining data protection provisions coming into force on 5 February 2026, the complaints date and PECR fines of up to £17.5 million or 4% of global turnover.

    3. [3] Information Commissioner's Office, 2026-06-23. New data protection complaints law now in force(ico.org.uk)
      Full title and what we used it for

      New data protection complaints law now in force. Primary. Used for the complaints duty, including acknowledging complaints within 30 days.

    4. [4] Information Commissioner's Office, 2026-03-31. ICO consultation on the draft guidance about automated decision-making,…(ico.org.uk)
      Full title and what we used it for

      ICO consultation on the draft guidance about automated decision-making, including profiling. Primary. Used for the consultation dates (31 March to 29 May 2026) and that final guidance was still to come. The link to recruitment comes from law-firm commentary (Covington, Inside Privacy) and is interpretation.

    5. [5] Information Commissioner's Office, 2023-03-15. Guidance on AI and data protection(ico.org.uk)
      Full title and what we used it for

      Guidance on AI and data protection. Primary. Used for the topics covered (DPIA, fairness, lawfulness, accuracy, rights) and the note that the guidance is under review because of the 2025 Act.

    6. [6] Department for Science, Innovation and Technology (GOV.UK), 2025-01-13. AI Opportunities Action Plan(gov.uk)
      Full title and what we used it for

      AI Opportunities Action Plan. Primary. Used for the publication date, the 50 recommendations and the compute target.

    7. [7] Department for Science, Innovation and Technology (GOV.UK), 2024-02-06. A pro-innovation approach to AI regulation: government response(gov.uk)
      Full title and what we used it for

      A pro-innovation approach to AI regulation: government response. Primary. Used for the five non-statutory principles applied by regulators and the statement that the government will legislate when confident it is right. Press coverage (IAPP) reports that the May 2026 King's Speech did not include an AI bill.

    8. [8] Financial Conduct Authority, 2026-10-02. AI and the FCA: our approach(fca.org.uk)
      Full title and what we used it for

      AI and the FCA: our approach. Primary. Used for the FCA's statement that it does not plan extra rules for AI and relies on the Consumer Duty and SM&CR.

    9. [9] Medicines and Healthcare products Regulatory Agency (GOV.UK), 2026-10-06. AI Airlock: the regulatory sandbox for AI as a Medical Device(gov.uk)
      Full title and what we used it for

      AI Airlock: the regulatory sandbox for AI as a Medical Device. Primary. Used for the sandbox's purpose and the launch of Phase 3 on 6 October 2026.

    10. [10] Department for Science, Innovation and Technology (GOV.UK), 2025-06-27. Data (Use and Access) Act 2025: data protection and privacy changes(gov.uk)
      Full title and what we used it for

      Data (Use and Access) Act 2025: data protection and privacy changes. Primary. Used for the description of the new automated decision-making safeguards and recognised legitimate interests.

    11. [11] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the EU AI Act timeline as changed by the AI Omnibus, which entered into force on 27 July 2026: transparency rules from August 2026 and Annex III high-risk rules from 2 December 2027.

    12. [12] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used for the UK's EU adequacy decisions being renewed in December 2025.

    This is general information, not legal advice. UK data law changed several times in 2026 and ICO guidance is still being updated. Check with a qualified UK solicitor before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in United Kingdom?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score