UK AI regulation: how it works without an AI Act
Unlike the EU, the UK has not passed one broad AI law. Its approach has been to rely on existing regulators and existing laws, guided by a set of cross-sector principles. That is lighter on paper, but it does not mean AI is unregulated.
The principles-based approach
The government's 2023 white paper set out five principles for regulators to apply in their own areas:
- Safety, security and robustness
- Appropriate transparency and explainability
- Fairness
- Accountability and governance
- Contestability and redress
Regulators such as the ICO (data protection), the CMA (competition), the FCA (financial services), Ofcom (online safety and communications) and the MHRA (medical devices) apply these within their own remits.
Laws that already apply to AI in the UK
- UK GDPR and the Data Protection Act 2018: apply whenever AI processes personal data, including rules on automated decision-making. The Data (Use and Access) Act 2025 updated parts of this area, so check the current text.
- Equality Act 2010: discrimination by an AI system can still be unlawful discrimination.
- Consumer and competition law: misleading claims about AI are still misleading claims.
- Sector rules: financial services, healthcare and other regulated sectors have their own expectations for AI.
Is a UK AI law coming?
The government has said several times that it may legislate, particularly for the most powerful AI models. Timing and scope have shifted, so check the latest government announcements rather than relying on older articles.
If you sell into the EU
UK companies are outside the EU, but the EU AI Act can still apply when your AI system is placed on the EU market or its output is used there. Many UK firms end up following the stricter EU standard for their whole product, because maintaining two sets of practices is costly.
Practical steps
- Identify which regulators oversee your sector and read their AI guidance.
- Run a data protection impact assessment for AI that handles personal data.
- Keep records of how your AI was built, tested and monitored.
- Check whether any EU customers bring you into the EU AI Act.
Official sources: GOV.UK AI regulation pages and the ICO guidance on AI and data protection.
This article is general information, not legal advice. Rules change often, so check official sources before you rely on it.