Region

United Kingdom

The UK has no AI-specific statute. The government's approach is principles-based: existing regulators apply five cross-cutting principles within their own areas. Data protection law, the Equality Act, consumer protection and online safety rules all reach AI use. The AI Security Institute (renamed from the AI Safety Institute in 2025) evaluates advanced AI.

For reference purposes only. Not legal advice.

Not settledUK automated decision-making reforms are being commenced in phases, and any AI bill and AI and copyright policy are not settled. Check the primary source for the current position.Source: UK: A pro-innovation approach to AI regulation · Checked 2 Oct 2026

Verify

Snapshot

AI-specific binding law?

Overall approach

Principles-based and regulator-led. Existing laws and sector regulators apply AI principles in their areas.

Main instruments

Pro-innovation approach white paper (2023)
UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
Equality Act 2010
Online Safety Act 2023

Main regulators

ICO, FCA, CMA, Ofcom, MHRA, EHRC. The AI Security Institute evaluates advanced AI.

Next key date

Watch: Regulating for Growth Bill and any AI bill

Last reviewed 2 Oct 2026.

How to read this page

In plain terms.

United Kingdom: AI-specific binding law is "No". Principles-based and regulator-led. Existing laws and sector regulators apply AI principles in their areas. This page lists 7 main instruments, names the regulators to watch, and ends with questions to put to counsel. Each record carries a certainty label and a review date; treat anything marked Verify or Unsettled as a prompt to check the primary source.

Instruments

What applies, and how firmly.

United Kingdom instruments
Instrument	Type	Status	Applies to	Key duties	Dates
"A pro-innovation approach to AI regulation" (white paper, 2023) and government response (2024)Primary source ↗ · Checked 2 Oct 2026 Verify Plain-language summary Sets out the five principles regulators are asked to apply. It does not itself create legal duties for organizations. SimplifiedUK automated decision-making reforms are being commenced in phases, and any AI bill and AI and copyright policy are not settled. Check the primary source for the current position.	Policy	Voluntary guidance	Regulators, and through them organizations using AI	Five principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress.
UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025Primary source ↗ · Checked 3 Oct 2026 Verify Plain-language summary The main legal route for AI that uses personal data. The reformed automated decision-making rules are reported to be in force since 5 Feb 2026; other provisions are still being commenced. Not settledThe 5 Feb 2026 commencement of most Part 5 provisions is reported by GOV.UK guidance and law-firm notes. Check the commencement regulations for the provisions that remain.	Law	In force, phased	Organizations processing personal data in the UK context	Lawful processing, data protection impact assessments; reformed automated decision-making rules permit significant automated decisions if safeguards are in place (information to the person, a chance to make representations, human intervention, and a way to contest).	Most data protection provisions in Part 5 in force from 5 Feb 2026; further provisions phased
Equality Act 2010Primary source ↗ · Checked 2 Oct 2026 Verify Plain-language summary Discrimination law applies to decisions made or supported by AI in the same way as other decisions. SimplifiedUK automated decision-making reforms are being commenced in phases, and any AI bill and AI and copyright policy are not settled. Check the primary source for the current position.	Law	In force	Employers, service providers and public bodies	Discrimination by AI-assisted decisions.
Consumer protection lawPrimary source ↗ · Checked 2 Oct 2026 Verify Plain-language summary Claims about what an AI product can do must be accurate, and unfair practices apply to AI-driven interactions too. SimplifiedUK automated decision-making reforms are being commenced in phases, and any AI bill and AI and copyright policy are not settled. Check the primary source for the current position.	Law	In force	Businesses dealing with consumers	Misleading AI claims and unfair practices.
Online Safety Act 2023Primary source ↗ · Checked 2 Oct 2026 Verify Plain-language summary Duties are being phased in. Check Ofcom's current codes for what applies to your service. SimplifiedUK automated decision-making reforms are being commenced in phases, and any AI bill and AI and copyright policy are not settled. Check the primary source for the current position.	Law	In force, phased	Services that host user content or search	Duties for services that host user content, including AI-generated content.
Regulating for Growth Bill (announced in the King's Speech, May 2026)Primary source ↗ · Checked 3 Oct 2026 Verify Plain-language summary Announced in the King's Speech on 13 May 2026. It would give cross-economy sandboxing powers, including for AI, and a growth duty for regulators. No standalone AI bill was announced. Not settledAnnouncement and content are reported by law-firm summaries. Progress through Parliament was not checked.	Proposed law	Proposed	Regulators and regulated businesses	Sandboxing powers, including for AI regulatory sandboxes; no standalone AI bill announced.
AI and copyrightPrimary source ↗ · Checked 2 Oct 2026 Verify Plain-language summary Policy on AI training and copyright is still developing. Not settledPolicy is not settled. Check for new consultations.	Policy	Proposed	AI developers and rights holders	Government report published March 2026; policy not settled.

Enforcement

Who enforces what.

ICO

Data protection, including AI that processes personal data.

FCA

Financial services.

CMA

Competition and consumers.

Ofcom

Online safety and communications.

MHRA

Medical devices.

EHRC

Equality and human rights.

AI Security Institute

Evaluates advanced AI. Not a regulator.

Penalty amounts are not stated here because they have not been verified from the primary source.

Actions

What to do now.

Identify the regulators for your sector. Open
Run data protection impact assessments for AI that uses personal data. Open
For significant automated decisions, provide information, human review and a way to contest. Open
Not settledReported in force since 5 Feb 2026. Check which related provisions are still to be commenced.
Check outcomes for discrimination under the Equality Act 2010. Open
Build the five UK principles into your policy. Open
Watch for an AI bill and AI regulatory sandboxes. Open
Not settledNo standalone AI bill has been announced. This may change.

Not settled

Watch this.

Whether a dedicated AI bill is consulted on. Private members' bills are not government policy. (as of 2 Oct 2026)
Commencement of the Data (Use and Access) Act 2025 automated decision-making provisions. (as of 2 Oct 2026)

Official answers

Ask officially.

ICO ↗: Guidance and contact routes on AI and data protection.
Your sector regulator ↗: FCA, CMA, Ofcom or MHRA, depending on your sector.

These bodies can give official guidance. ClearPath is for reference only.

Sources

Check the original text.

UK: A pro-innovation approach to AI regulation ↗ (GOV.UK)
ICO: artificial intelligence guidance ↗ (ICO)
Data (Use and Access) Act 2025 ↗ (legislation.gov.uk)
Equality Act 2010 ↗ (legislation.gov.uk)
Online Safety Act 2023 ↗ (legislation.gov.uk)
UK Parliament: bills ↗ (UK Parliament)
AI Security Institute ↗ (AI Security Institute)
UK sector regulators (FCA, CMA, Ofcom, MHRA, EHRC) ↗ (GOV.UK)

FAQ

Is there a UK AI Act?

Not as of the review date. The UK takes a principles-based approach led by existing regulators.

Reviewed 2 Oct 2026.

Was this page useful? Tell us what is missing or wrong ↗ · Report a correction