AI regulation in the UK: what applies in 2026

Written by Alex Vakhitov, founder of Comonad Limited. Last reviewed: 14 October 2026.

On this page

Is there a UK AI Act?

No. In its March 2023 white paper, "A pro-innovation approach to AI regulation", the government chose to regulate AI through existing regulators, with no new cross-sector law, and its 6 February 2024 response (opens in new tab) confirmed that approach.

The five principles regulators apply

Safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress. They are not law in themselves. Each regulator interprets them within its own remit, and DSIT has published guidance for regulators (opens in new tab) on doing so.

If your AI uses personal data, UK GDPR applies, and the Information Commissioner's Office is the regulator. The ICO's Guidance on AI and data protection (opens in new tab) covers lawful basis, fairness, transparency, accuracy, data minimisation and security in AI systems. Solely automated decisions with legal or similarly significant effects carry extra safeguards, and the Data (Use and Access) Act 2025 changed those rules from 5 February 2026. A data protection impact assessment is required where the processing is likely to result in a high risk to people.

Sector regulators

These are the regulators whose existing powers most often touch AI. Read the publications that match your sector.

UK regulators and where they touch AI
Regulator	Where it touches AI
ICO	Personal data in AI systems; automated decision-making; guidance on AI and data protection
FCA	AI used by financial services firms, under existing rules such as the Consumer Duty and the Senior Managers and Certification Regime
CMA	Competition and consumer protection in AI markets, including its work on AI foundation models
Ofcom	Online services and broadcasting. The Online Safety Act applies to in-scope services, including some that use generative AI, and to AI-generated content shared between users.
Ofgem	AI in the energy sector; its "Ethical AI use in the energy sector" guidance, updated May 2026
MHRA	AI as a medical device
DRCF	The Digital Regulation Cooperation Forum (opens in new tab), through which the ICO, CMA, FCA and Ofcom coordinate on digital regulation, including AI

Government guidance worth knowing

DSIT published its AI Risk Management Toolkit (opens in new tab) on 8 September 2026, for anyone designing, procuring or delivering an AI product. The NIST AI Risk Management Framework and ISO/IEC 42001 are voluntary. Teams use them to structure controls.

How the EU AI Act reaches UK firms

Separately from UK law, the EU AI Act applies to UK organisations whose AI is placed on the EU market, put into service there, or whose output is used in the EU. Its high-risk duties start on 2 December 2027 and 2 August 2028. See Does the EU AI Act apply to UK companies?.

What a UK organisation should do now

Keep an inventory of the AI you build, buy and use.
For each system that uses personal data, check the lawful basis and whether a DPIA is needed.
Identify the regulators whose rules apply to your sector and read their AI publications.
Mark any system whose AI or output reaches the EU, and check it against the EU AI Act.
Name an owner for each system and a review cycle.

How Comonad helps

Our AI governance consultancy turns these duties into one control set, with owners, tests and records, mapped to UK regulatory guidance and the EU AI Act where it applies.

Discuss your AI governance

Sources

Frequently asked questions

Is there an AI regulator in the UK?

No single one. The ICO, FCA, CMA, Ofcom, Ofgem and MHRA each apply existing law within their own remit. The ICO, CMA, FCA and Ofcom coordinate through the Digital Regulation Cooperation Forum.

Does UK GDPR apply to AI?

Yes, wherever personal data is processed. That includes training data, prompts, retrieved context and outputs that identify a person. The ICO's guidance on AI and data protection is the starting point. A data protection impact assessment is required where the processing is likely to result in a high risk to people.

Is the UK going to copy the EU AI Act?

There is no UK equivalent of the EU AI Act. The government's 6 February 2024 response kept regulation with existing regulators and did not adopt a new cross-sector law.