AI Regulation in the United Kingdom
The United Kingdom has no standalone AI Act. Its 2023 White Paper set five principles for existing regulators to apply in their own sectors: safety, transparency, fairness, accountability, and contestability. The ICO covers data protection, the FCA covers financial services, and the CMA covers competition and consumer protection.
Data law is where most binding change has come. The Data (Use and Access) Act 2025 replaced Article 22 UK GDPR with new rules on automated decision-making from 5 February 2026. Regulations in force since 12 May 2026 require the ICO to write a statutory code on AI and automated decisions. On 30 September 2026 the ICO became the Information Commission, though it is still known as the ICO.
The AI Safety Institute was renamed the AI Security Institute in February 2025 and focuses on testing frontier models. The government published its AI Opportunities Action Plan on 13 January 2025. In May 2026 it announced a Regulating for Growth Bill, which would create sandboxing powers and an AI Growth Lab.
Key themes
- 1.Regulator-led approach with no standalone AI Act
- 2.New automated decision-making rules in UK GDPR since February 2026
- 3.A statutory ICO code on AI and automated decisions in preparation
- 4.AI Security Institute testing of frontier models
Regulatory frameworks and guidance(8)
UK AI Growth Lab: Call for Evidence (closed January 2026)
The UK Department for Science, Innovation and Technology (DSIT) issued a call for evidence on the proposed UK AI Growth Lab on 21 October 2025, which closed in early January 2026. The government then announced the Regulating for Growth Bill on 13 May 2026 to create sandboxing powers. The sandbox would let firms test AI under relaxed or modified rules. Options include central government administration across sectors or individual sandboxes managed by lead regulators. The aim is reduced compliance barriers with continued oversight.
UK AI Opportunities Action Plan
The UK published its AI Opportunities Action Plan in January 2025. It sets the Labour government’s adoption and infrastructure agenda for public bodies, developers, and AI enterprises. Commitments include AI Growth Zones, expanded computing infrastructure, and a National Data Library giving developers access to public data.
UK AI Regulation Framework
The UK AI Regulation Framework assigns primary oversight to existing sector regulators using shared principles. Following January 2025’s AI Opportunities Action Plan, the approach is moving toward a more structured legislative basis.
AI Risk Management Toolkit
The UK Government published this toolkit to help organizations understand, assess, and manage risk throughout the full lifecycle of AI projects. It applies to teams involved in designing, procuring, or delivering AI products and services, including public and private sector buyers. The toolkit provides structured guidance for embedding risk management into project approval checks, procurement checklists, and delivery-stage governance.
UK-Canada Memorandum of Understanding on AI Compute
The UK and Canada signed a Memorandum of Understanding on compute in Ottawa on 31 January 2024. It sets out joint intent to collaborate, including exploring how to give researchers and industry secure, affordable access to computing capacity. It creates no binding commitments or private-sector duties.
UK DSIT Call for Evidence on Data Regulation in the Age of AI and Other Data-Intensive Technologies
DSIT ran a call for evidence on adapting UK data law to AI and other data-intensive technologies, including AI agents, from 15 July to 9 September 2026. It is now closed and awaiting the government's response.
UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425)
UK regulations in force since 12 May 2026 require the Information Commissioner to prepare a statutory code. It covers personal data in developing and using AI, and in automated decision-making. Once the code is in force, the ICO and courts must take it into account.
ICO Guidance on AI and Data Protection
The UK Information Commissioner's Office (ICO) secured commitments from ten major AI developers to strengthen data protection practices covering transparency, individuals' rights, lawful grounds for processing personal data, and safeguards for AI training and deployment. The ten companies named are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Alongside this, the ICO opened a six-week call for evidence on agentic AI, which refers to AI systems that act autonomously on behalf of users, completing tasks with little or no human input at each step.