← Global AI Policy Radar · Methodology
Jurisdiction Baseline · AI × Policy

AI Regulation in the United Kingdom.

At a glance
AI-Specific Law
No single AI law or general licensing regime
Core Framework
Existing privacy, safety, consumer and equality rules apply
Targeted Measures
New laws address deepfakes, copyright and harmful AI tools
Active Enforcement
ICO, Ofcom and CMA investigate under existing powers

The UK does not have a single, comprehensive AI-specific law equivalent to the EU AI Act. AI is mainly regulated through existing data protection, online safety, consumer protection, equality and sector-specific laws, with targeted AI rules in some newer legislation. The ICO, Ofcom and CMA actively enforce these rules, but the UK has no single AI regulator or general AI licensing regime.

In force today6 instruments
Data (Use and Access) Act 2025 partially in forceAI-specific
This is not a general AI Act, but it contains targeted AI provisions, including duties concerning AI and copyright reporting and amendments affecting automated decision-making under UK data protection law. It also created offences concerning the creation or request of non-consensual intimate-image deepfakes, with provisions brought into force in stages. ([gov.uk](https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement?utm_source=openai))
Read the full text ↗ · 2025
AI / automated decisionsDisclosureSafety & security
UK General Data Protection Regulation and Data Protection Act 2018 in force
These rules bind AI systems that process personal data, covering lawful basis, transparency, purpose limitation, minimisation, accuracy, security, individual rights, impact assessments and safeguards for significant automated decisions. The ICO treats AI deployment as an ordinary data-protection compliance issue with heightened risks, not as a separate exempt category. ([ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/?q=recruitment&utm_source=openai))
Read the full text ↗ · 2018
Data processingDisclosureAI / automated decisions
Unlock the full baseline

Get the remaining 4 instruments and the founder FAQ. Free: subscribe once and every briefing on this device unlocks.

Already subscribed? Unlock →

Online Safety Act 2023 in force
The Act applies to in-scope user-to-user services, search services and some chatbot or answer-engine services. Providers must conduct illegal-content and child-safety risk assessments, operate proportionate systems and processes, keep records and comply with Ofcom codes; AI-generated material shared by users is generally treated as user-generated content. ([ofcom.org.uk](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/illegal-content-duties-under-the-online-safety-act?utm_source=openai))
Read the full text ↗ · 2023
Content moderationSafety & securityMinors
Digital Markets, Competition and Consumers Act 2024 in force
For consumer-facing AI products, the Act prohibits misleading actions and omissions, aggressive practices, hidden mandatory fees and fake reviews, and gives the CMA direct enforcement powers. AI-generated recommendations, claims about model capability, pricing, subscriptions and autonomous purchasing behaviour must therefore be accurate, fair and professionally diligent. ([legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2024/13/notes/division/2/index.htm?utm_source=openai))
Read the full text ↗ · 2024
Consumer protectionDisclosure
Equality Act 2010 in force
AI used in recruitment, employment, housing, education, financial services or other protected activities must not cause unlawful discrimination. Liability can arise from biased training data, proxy variables, automated ranking, profiling or a failure to provide reasonable adjustments, even where a vendor supplied the system.
Read the full text ↗ · 2010
AI / automated decisionsMinors
Crime and Policing Act 2026 partially in forceAI-specific
The Act creates targeted offences for making, adapting, supplying or offering tools that generate child sexual abuse material or non-consensual intimate images, including relevant AI models and services. It also gives ministers powers intended to bring currently unregulated AI chatbots into parts of the Online Safety Act framework, subject to commencement and secondary legislation. ([legislation.gov.uk](https://www.legislation.gov.uk/ukpga/2026/20/notes/division/11/index.htm?utm_source=openai))
Read the full text ↗ · 2026
Safety & securityContent moderationMinors
Also worth noting
  • ICO statutory code of practice on AI and automated decision-making, expected to clarify compliance expectations beyond existing non-statutory guidance. ([assets.publishing.service.gov.uk](https://assets.publishing.service.gov.uk/media/68f64a9df5d433238a14c7f8/Annex_B_Update_Against_the_Regulation_Action_Plan_FINAL.pdf?utm_source=openai))
  • Secondary legislation under the Crime and Policing Act 2026 to extend Online Safety Act duties to currently unregulated AI chatbots and services. ([gov.uk](https://www.gov.uk/government/publications/crime-and-policing-act-2026-factsheets/crime-and-policing-act-overarching-factsheet?utm_source=openai))
  • MHRA work on a dedicated regulatory framework for AI in healthcare, expected to affect medical-device and clinical AI deployments. ([gov.uk](https://www.gov.uk/government/groups/national-commission-into-the-regulation-of-ai-in-healthcare?utm_source=openai))
Pending and recent legislation4 measures
UK 4170 Automated Online Software (Access and Transparency) Bill
Advancing · 2026-10-16
The Bill would require operators of specified automated online software to register and comply with duties concerning the software’s functions, including its access to online material published by others. It also provides for related measures governing transparency and accountabi
UK 4085 Autonomous Maritime Vessels (Regulation) Bill
Advancing · 2026-03-02
The Bill would establish a regulatory framework for autonomous surface and submersible maritime vessels, including related connected provisions. It addresses the operation and oversight of vessels capable of navigating without direct human control.
UK 3942 Artificial Intelligence (Regulation) Bill [HL]
Introduced · 2025-03-04
A bill proposing a general statutory framework for regulating artificial intelligence in the United Kingdom, along with related provisions. The supplied description does not specify the bill’s detailed obligations or covered AI systems.
UK 3760 Public Authority Algorithmic and Automated Decision-Making Systems Bill [HL]
Advancing · 2025-02-07
The Bill would regulate public-sector use of algorithmic and automated decision-making systems, requiring public authorities to conduct impact assessments and meet transparency standards.

Live from the Global AI Policy Radar.

Founder FAQAI law, regulators, what applies, what is next, penalties
Is there an AI-specific law in force here?

No. The UK does not have one comprehensive AI-specific law equivalent to the EU AI Act, a single AI regulator, or a general AI licensing regime. It does have targeted AI provisions in newer legislation, including the Data (Use and Access) Act 2025 and the Crime and Policing Act 2026, some of which are only partially in force.

Who are the key regulators for AI?

The key regulators are the Information Commissioner’s Office, Ofcom and the Competition and Markets Authority. They use their existing powers to investigate and take action in areas including data protection, online safety, consumer protection and competition. There is no single UK AI regulator.

Which rules apply to AI systems today?

The UK GDPR and Data Protection Act 2018 apply where AI processes personal data, including rules on lawful basis, transparency, security, individual rights and significant automated decisions. The Online Safety Act 2023 applies to in-scope online services, while the Digital Markets, Competition and Consumers Act 2024 and Equality Act 2010 apply to consumer-facing products and uses that may mislead, disadvantage or discriminate. Targeted provisions in the Data (Use and Access) Act 2025 and Crime and Policing Act 2026 also apply as they come into force.

What is coming next, and when?

The Data (Use and Access) Act 2025 and Crime and Policing Act 2026 are being brought into force in stages, including targeted provisions on AI and copyright reporting, automated decision-making, deepfakes and harmful AI tools. The Crime and Policing Act 2026 also gives ministers powers intended to bring currently unregulated AI chatbots into parts of the Online Safety Act framework. The timing of those chatbot changes depends on commencement and secondary legislation.

What are the enforcement and penalty risks?

Enforcement is active, with the ICO, Ofcom and CMA investigating and taking action under their existing powers. Risks include action for unlawful personal-data processing, online-safety failures, misleading or unfair consumer practices, and discrimination. The newer legislation also creates criminal offences relating to non-consensual intimate-image deepfakes and tools that generate child sexual abuse material or such images.

Not legal advice. For educational purposes only. AI-researched against official sources (2026-08-06), links verified.

Need a company-specific assessment? Explore Nomos →