Executive briefing: UK AI regulation
UK AI Regulation in 2026: What Is in Force, What Is Proposed and How It Differs From the EU
The UK has no AI-specific law. As at 28 September 2026, UK AI regulation works through existing law and existing regulators, such as data protection, equality, consumer and financial services rules, applied to AI where it is used. The government has promised binding rules for the most powerful AI models, but no AI bill has become law.
Correct as of 28 September 2026. Regulation and guidance change. If you are reading this later, check for updates before relying on it.
Read the full briefingIn brief
- The UK has no AI-specific legislation. AI is regulated where it is used, through existing law and existing regulators.
- What is in force now: UK GDPR and the Data Protection Act 2018, including the automated decision-making reforms in force since 5 February 2026, plus equality, consumer, online safety and sector rules.
- What is only proposed: binding rules for the most powerful models, a statutory AI Growth Lab sandbox, and changes on AI and copyright.
- UK businesses that sell into the EU, or whose AI output is used there, must also meet the EU AI Act.
- The practical answer is the same under both regimes: know where your AI is, who owns it and how it is controlled.
Why the board should care
No AI Act is not no rules
Data protection, equality, consumer and sector rules already apply to AI. Regulators enforce them through the powers they already have.
Two regimes for many UK firms
A UK business with EU customers can face the EU AI Act as well as UK law. Governing to one standard across both is cheaper than running two.
The rules are still moving
The government has promised targeted legislation and a statutory sandbox. A register of AI in use is what lets a board respond quickly when rules change.
Full briefing
Read the full briefing
Free for executives. Confirm your work email once and every AIPEX executive briefing opens for 12 months.
- The full written briefing
Next step
Know how your AI is governed before a regulator asks
The AI Readiness Assessment: Full Report (£999 + VAT) scores 30 areas across six domains, including governance and control, risk and data, with a prioritised roadmap and a 60-minute debrief with a senior partner. Prefer to talk first? A free 30-minute scoping call with a senior partner.
FAQ
Frequently asked questions
Is there a UK AI Act?
No. As at 28 September 2026 the UK has no AI-specific legislation. AI is regulated where it is used, through existing law such as UK GDPR, the Equality Act 2010 and sector rules, enforced by existing regulators including the ICO, FCA, CMA and Ofcom.
What is the status of the UK AI bill?
There is no government AI bill before Parliament. The government promised binding rules for the most powerful AI models in 2024 but has not introduced them. Lord Holmes's Private Members' Bill had a first reading on 4 March 2025, went no further in that session and is not law.
What is the UK AI regulation framework?
The 2023 white paper set five cross-sector principles for existing regulators to apply: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress. They are not on a statutory footing. Each regulator applies them within its own remit.
How does UK AI regulation differ from the EU?
The EU has a single AI law, the EU AI Act, with risk tiers, banned practices and fixed deadlines. The UK has no AI-specific law and relies on existing regulators applying existing rules. A UK business selling into the EU can be subject to both.
Does the EU AI Act apply to UK companies?
Yes, if they supply an AI system to the EU market or the output of their AI system is used in the EU. It follows the market, not the head office, much as GDPR does. UK law applies in addition, not instead.
Is there a UK equivalent of the EU AI Act?
No. The closest UK rules for most businesses are data protection law, including the automated decision-making reforms in force since 5 February 2026, and the ICO's guidance on AI. The UK has chosen sector regulators over a single AI regulator.
What should UK companies do about AI regulation now?
Build a register of AI in use, including AI inside vendor software, name an owner for each system, check decisions about people against the automated decision-making rules, confirm whether the EU AI Act applies, and report AI risk to the board each quarter.
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.
This briefing is general information on UK AI regulation, correct as at 28 September 2026. It is governance guidance, not legal advice. AIPEX is not a certification body and does not certify. For decisions about specific AI systems, take advice from a qualified lawyer.