Does the UK have an AI Act like the EU?

No. As of October 2026 the UK has no single AI statute. The approach the government confirmed in February 2024 asks existing regulators to apply five principles within their own areas. The King's Speech of 13 May 2026 did not include an AI bill, although it announced a Regulating for Growth Bill with sandbox powers that could cover AI testing.

Which UK regulator is responsible for AI?

There is no single AI regulator. The ICO covers personal data, the CMA competition and consumer protection, the FCA financial services, Ofcom online safety, and sector regulators their own fields. The four main digital regulators coordinate through the Digital Regulation Cooperation Forum. The AI Security Institute researches advanced AI risks but does not regulate businesses.

Can a UK company make fully automated decisions about people using AI?

Since 5 February 2026, the Data (Use and Access) Act 2025 allows solely automated decisions with significant effects in more situations than before, but only with safeguards. People must be told about the decision, be able to make representations, obtain human intervention and contest it. Tighter limits apply when special category data is involved, so take advice before relying on this.

Is it legal to train AI on copyrighted material in the UK?

UK copyright law has not been changed for AI training. In its March 2026 report the government said a broad text and data mining exception with opt-out is no longer its preferred option, and that it will gather more evidence before any reform. Until then, use licensed content or a clear existing exception, and check your vendors' terms.

Does the EU AI Act apply to UK businesses?

It can. The EU AI Act reaches providers outside the EU when they place AI systems on the EU market, and providers or deployers outside the EU when the output of their AI system is used in the EU. A UK firm with EU customers should map which AI uses touch the EU and check which obligations apply.

How the UK Regulates AI in 2026: A Plain-English Guide

The UK still has no single AI law in October 2026. Instead, existing regulators such as the ICO, the CMA, the FCA and Ofcom apply the laws they already enforce to AI, guided by five non-statutory principles the government confirmed in 2024. For most businesses, data protection, consumer, equality and sector rules are the AI rules that apply today.

This guide is general information, not legal advice.

At a glance

No AI Act: the King's Speech on 13 May 2026 did not include an AI bill.
Five principles: safety, transparency, fairness, accountability and contestability, applied by each regulator in its own area.
Data law changed: new automated decision-making rules have applied since 5 February 2026.
Sandboxes proposed: the Regulating for Growth Bill announced in May 2026 includes cross-economy sandbox powers, with AI named.
Copyright: in March 2026 the government dropped a broad text and data mining exception with opt-out as its preferred option.
EU reach: the EU AI Act can still apply to UK firms whose AI reaches the EU.

The UK model: principles, not an AI Act

The framework comes from the 2023 white paper and the government response of 6 February 2024. Rather than one rulebook, existing regulators interpret five cross-sector principles within their own remits:

Principle	What it means in practice
Safety, security and robustness	AI works reliably and resists misuse
Appropriate transparency and explainability	People know AI is used and can understand outputs
Fairness	No unlawful discrimination or unfair outcomes
Accountability and governance	Named owners and real oversight
Contestability and redress	A route to challenge AI outcomes

The principles are not statutory. The 2024 response made a case for targeted binding requirements on the small number of developers of highly capable general-purpose AI, but said the government would legislate only once it was confident that was the right course. As of October 2026 that has not happened: the King's Speech of 13 May 2026 did not include an AI bill.

What it did include is a Regulating for Growth Bill. The government's briefing notes describe cross-economy sandboxing powers that would let existing rules be temporarily relaxed for controlled testing, naming AI among the technologies and saying the government is exploring cross-cutting AI sandboxes. Check its progress through Parliament before you plan around it.

The AI Security Institute, part of the Department for Science, Innovation and Technology, researches and tests the risks of advanced AI. It does not regulate ordinary businesses.

What each regulator expects

ICO: data protection is the main AI law today

Most business AI touches personal data, so the UK GDPR and the Data Protection Act 2018 are where obligations are clearest. The ICO's AI and biometrics strategy focuses on foundation model developers, automated decision-making in recruitment and public services, and facial recognition technology. It also plans a statutory code of practice on AI and automated decision-making, and the Code of Practice on Artificial Intelligence and Automated Decision-Making Regulations 2026, in force since 12 May 2026, now require the regulator to prepare it, including guidance on children's personal data.

The Data (Use and Access) Act 2025 replaced the old Article 22 with new rules in force since 5 February 2026. Solely automated decisions with legal or similarly significant effects are now permitted more widely, but people must be told about them, be able to make representations, obtain human intervention and contest the decision. Using special category data in such decisions is limited to narrow conditions, such as explicit consent. The ICO consulted on updated automated decision-making guidance from March to May 2026, and that guidance is still in draft.

Two practical points follow. Since 19 June 2026, every organisation needs a process for handling data protection complaints. And since 30 September 2026 the regulator has formally been the Information Commission, which still operates under the ICO name.

CMA: competition and consumer law

The CMA has examined AI foundation models since 2023 and set out principles for the market in its April 2024 update paper. For an ordinary business, the practical point is simpler: consumer law applies to AI. Claims about what your AI product does must be accurate, and using AI to mislead customers is treated like any other misleading practice.

FCA: existing rules apply

The FCA's AI approach page, updated on 2 October 2026, says it does not plan to introduce extra regulations for AI and will rely on existing frameworks. In practice the Consumer Duty and the Senior Managers and Certification Regime decide what good looks like: a named senior manager owns the risk, and customer outcomes are monitored.

Ofcom: online safety

Ofcom's November 2024 open letter on generative AI and chatbots explains that the Online Safety Act can cover generative AI. That includes chatbots whose output users can share with others, services that let users create chatbots for others, AI tools that search more than one website or database, and tools that can generate pornographic material.

Working together

The ICO, CMA, FCA and Ofcom coordinate through the Digital Regulation Cooperation Forum, which ran a 12-month AI and Digital Hub pilot from April 2024 for innovators with questions that cross regulators. The pilot has closed, but its case studies are still published. Other sector bodies apply the same principles in their own fields, and the Equality Act 2010 applies to decisions made with AI just as it does to any other decision.

The Data (Use and Access) Act required the government to report on copyright and AI. Its report and impact assessment, published on 18 March 2026, says a broad copyright exception with opt-out is no longer the government's preferred way forward. It plans to gather more evidence, to work with industry on best practice for input transparency and for labelling AI-generated content, and it proposes removing the specific protection for computer-generated works while AI-assisted works stay protected. It will not change copyright law until it is confident the reforms meet its objectives.

For a business, the message is steady: training or fine-tuning on content you do not own still needs a licence or a clear existing exception, and your AI vendors' terms on training data and output deserve a careful read.

The EU AI Act still reaches many UK firms

Leaving the EU did not take the EU AI Act off UK agendas. It can apply to UK organisations that place AI systems on the EU market, or whose AI output is used in the EU. If you have EU customers, read our guide to the EU AI Act's AI literacy duty for UK firms.

What a UK business should do now

List your AI uses. Include features switched on inside software you already have, such as Copilot in Microsoft 365, not only tools you bought as AI.
Find the personal data. For each use involving personal data, decide the lawful basis and whether you need a data protection impact assessment. Our UK GDPR and Microsoft 365 Copilot checklist shows how for one common tool.
Map significant decisions. Anything affecting hiring, credit, pricing or access to a service needs a human route to challenge it.
Name owners. Accountability is a principle every regulator applies, so give each AI use one named owner.
Write a short AI use policy. Cover approved tools, data that must never go into them, and how outputs are checked. See what to include in an AI use policy.
Train people. Regulators expect staff who use AI to understand its limits. Build that understanding across teams, not only in IT.
Watch three things: the ICO's code of practice on AI and automated decision-making, the Regulating for Growth Bill, and copyright reform.

How CertTulen Academy can help

Leaders shaping an AI programme can take Drive AI Transformation in Your Organization (AB-731), which covers AI strategy, governance principles, responsible AI and adoption planning. For wider teams, AI Fluency: Framework and Foundations builds the habits regulators keep asking for: knowing when to use AI, describing tasks clearly, checking outputs and staying accountable for the result. Both run live and online with an instructor. Contact us to arrange a private cohort or a batch that suits your time zone.