UK firms face AI obligations without a dedicated law

The UK has no AI Act or government AI bill as of October 2026, but businesses remain subject to existing legal obligations. Data protection and equality law cover AI-driven decisions, financial regulators’ expectations reach suppliers through regulated customers, and the EU AI Act can apply when systems enter the EU market or their output is used there. The UK approach relies on existing regulators rather than a dedicated statutory framework.

Since 5 February 2026, UK GDPR Articles 22A to 22D require safeguards for significant decisions made solely through automated processing. People must receive information and be able to make representations, obtain human intervention and contest decisions. Tighter restrictions apply to special category data. The FCA does not plan additional AI-specific regulations, relying instead on frameworks including the Consumer Duty and senior management accountability. PRA model-risk expectations can require bank suppliers to provide documentation, validation evidence and change notifications.

EU obligations depend on a firm’s role and its system’s risk classification, with Annex III high-risk requirements applying from 2 December 2027. Businesses should inventory AI features, map customer exposure, test discriminatory outcomes and assign governance ownership. Model documentation and evidence of safeguards can support multiple customer reviews. The government’s AI Cyber Security Code of Practice and ISO/IEC 42001:2023 offer voluntary reference points, not legal requirements.