How is AI regulated in the UK?

The approach: regulate the use, not the technology

The white paper A pro-innovation approach to AI regulation, presented to Parliament on 29 March 2023, set out five principles (“safety, security and robustness”; “appropriate transparency and explainability”; “fairness”; “accountability and governance”; and “contestability and redress”) and said in terms that “we will not put these principles on a statutory footing initially”. Regulators were to apply them within the remits they already had.

The February 2024 government response kept that model while conceding that “some mandatory measures will ultimately be required across all jurisdictions”, and asked regulators to publish their strategic approach to AI by 30 April 2024. The Labour government elected in July 2024 did not change the architecture. Its response to the Commons Science, Innovation and Technology Committee on 10 January 2025 said: “In most cases, we believe that our existing expert regulators are best placed to apply rules to the use of AI in the contexts they know better than anyone else.” On 28 January 2026 the then Science and Business Secretaries wrote to every regulator asking each to publish, by May 2026, a plan for “how you will help enable safe AI-powered innovation”. On 4 June 2026 the DSIT minister in the Lords, Baroness Lloyd of Effra, restated the position: “most AI systems should be regulated at the point of use”.

Since 22 July 2026 the department that owned this policy no longer exists. The functions of the Department for Science, Innovation and Technology were redistributed; AI strategy moved to the Cabinet Office, and the Minister for Artificial Intelligence, Kanishka Narayan, sits jointly there and in the Department for Business, Innovation, Science and Trade. As of 23 September 2026 we found no gov.uk policy document from the Burnham government changing the regulatory approach. What exists is a speech. In his address to the UN General Assembly on 22 September 2026, published on gov.uk the next day, the Prime Minister said that “fundamental decisions on this technology are too important to be left to chance”, that he would “put AI at the heart of the UK’s G20 Presidency next year”, that the UK would “work towards agreeing a single set of global principles and standards”, and that the government would act “including bringing forward new laws if that is what is needed”. That is a statement of intent by a Prime Minister; it names no bill and no subject for one.

What is in force

The table lists the statutes and rules that actually govern AI-related activity in the UK today, with the body that enforces each. Every entry is law in force or regulation under existing statutory powers unless marked otherwise.

Law or rule	What it does for AI	Who enforces it	Status, 23 September 2026
UK GDPR and Data Protection Act 2018	Lawfulness, fairness and transparency of any AI that processes personal data; impact assessments; rights over automated decisions	Information Commissioner’s Office (ICO)	In force
Data (Use and Access) Act 2025 (Royal Assent 19 June 2025)	Rewrote the automated-decision rules (new UK GDPR Articles 22A–22D): a decision is not “solely automated” if there is “meaningful human involvement”; significant solely-automated decisions are restricted only where special-category data is used; safeguards must let people get information, make representations, obtain human intervention and contest the decision	ICO	Section 80 in force from 5 February 2026
Statutory AI and automated decision-making code of practice (SI 2026/425)	Requires the ICO to prepare a code of practice on “developing and using artificial intelligence, and automated decision-making”	ICO	Duty in force from 12 May 2026; the code itself not yet issued
Online Safety Act 2023 (Royal Assent 26 October 2023)	Generative-AI chatbots and AI-generated content are within scope where they form part of a user-to-user or search service; Ofcom has said a chatbot “that meets the Online Safety Act’s definitions… is covered by the rules”	Ofcom	In force; Ofcom said on 3 February 2026 it was “currently unable to investigate” a standalone chatbot service under the Act as then drafted
Crime and Policing Act 2026 (Royal Assent 29 April 2026)	Offence covering “purported intimate image generators”, i.e. nudification tools (s.99): in force. Also enacted but not yet in force: offences for making, adapting, possessing or supplying “a thing”, including “a program… and a service”, for creating child sexual abuse images (ss.72–76), which legislation.gov.uk marks “not in force at Royal Assent” as of 23 September 2026; and a power for ministers to amend the Online Safety Act by regulations to cover AI services (s.248), under which no regulations had been made on legislation.gov.uk as of 23 September 2026	Police and CPS; Ofcom	s.99 in force from 29 June 2026; ss.72–76 enacted, commencement awaited; s.248 power enacted, unused
Data (Use and Access) Act 2025, s.138	Offence of creating, or requesting the creation of, a “purported intimate image” of an adult, that is, sexually explicit deepfakes	Police and CPS	In force from 6 February 2026
Equality Act 2010	Discrimination by an AI system is discrimination; public bodies’ equality duty applies to their use of AI	Equality and Human Rights Commission; courts and tribunals	In force
Consumer Rights Act 2015; Digital Markets, Competition and Consumers Act 2024	“UK consumer law applies whether decisions are made by people or by AI” (CMA, 9 March 2026); the digital-markets regime lets the CMA impose conduct requirements on firms with “strategic market status”	Competition and Markets Authority (CMA)	Digital-markets regime in force from 1 January 2025; Google (search, October 2025; mobile platform, October 2025) and Apple (mobile platform, October 2025) designated
Medical Devices Regulations 2002	AI used for a medical purpose is a medical device and must be registered and certified	Medicines and Healthcare products Regulatory Agency (MHRA)	In force; the MHRA runs an “AI Airlock” sandbox for AI as a medical device
Financial services rules; Bank of England supervisory statement SS1/23	Model-risk principles that are “technology-agnostic… but deliberately included factors relevant to the use of AI models”; the FCA says it does “not plan to introduce extra regulations for AI” and relies on the Consumer Duty and senior-managers regime	FCA; Prudential Regulation Authority	In force
Product Regulation and Metrology Act 2025 (Royal Assent July 2025)	Enabling powers for product-safety regulations that can cover software and AI components	Office for Product Safety and Standards	Act in force; no AI-specific regulations made under it found as of 23 September 2026
Copyright, Designs and Patents Act 1988, s.29A	Text-and-data-mining exception limited to “research for a non-commercial purpose”; no commercial exception for AI training	Courts; Intellectual Property Office	In force, unchanged; see “What is proposed”

Two points about that table. First, none of these laws was written for AI; each applies because AI is a way of doing something the law already covers: processing personal data, publishing content, making a product, making a decision about a person. Second, the rows that were written with AI in mind (the 2025 automated-decision rewrite and the 2026 criminal offences) are narrow: they deal with specific harms, not with AI systems as a class. And an Act receiving Royal Assent is not the same as its sections being in force: the Crime and Policing Act 2026’s child-abuse-image-generator offences are on the statute book but, as of 23 September 2026, awaiting a commencement order.

Who regulates what

Every major regulator has now published how it applies its existing powers to AI. The table gives each one’s own formulation.

Regulator	AI remit, in its own words	Date
Information Commissioner’s Office	“set clear expectations for responsible AI through a statutory code of practice for organisations developing or deploying AI and automated decision-making”; “secure public confidence in generative AI foundation models”; “fair and proportionate use of facial recognition technology”	AI and biometrics strategy, 25 June 2025; 2026 plan includes “dedicated guidance on agentic AI”
Ofcom	“enabling safe and secure AI adoption across the sectors we regulate”: online safety (chatbots, deepfakes), broadcasting, telecoms	Strategic approach to AI, 4 June 2026
Competition and Markets Authority	AI products “are therefore potentially relevant to all of the CMA’s current functions”; “businesses must not mislead, manipulate or exert undue pressure on consumers, regardless of whether those outcomes are driven by human decisions, algorithms, or interface design”	Strategic update, 29 April 2024; Agentic AI and consumers, 9 March 2026
Financial Conduct Authority	“We do not plan to introduce extra regulations for AI.”	AI approach page, 13 February 2026
Bank of England / PRA	SS1/23 model-risk principles apply; will “build on this further in 2026”	Letter to Treasury Committee, 1 April 2026
MHRA	AI as a medical device; “AI Airlock” sandbox, phase 2 completed May 2026	Policy paper 30 April 2024; collection updated 9 June 2026
Equality and Human Rights Commission	“The use of AI has the potential to result in breaches of the Equality Act 2010 and the Human Rights Act 1998 in many ways.”	30 April 2024
Ofqual	Will “enable safe AI-driven innovation” while managing “risks to qualifications and assessments”	16 July 2026
Care Quality Commission	“We do not assess or approve specific technologies but have a role in ensuring that technology including AI contributes to safe, effective and equitable care”	21 May 2026
Health and Safety Executive	The Health and Safety at Work Act “is applicable regardless of the technology being used and so includes the use of AI in the workplace”	12 June 2026

Four of these (the ICO, Ofcom, the CMA and the FCA) coordinate through the Digital Regulation Cooperation Forum. Its AI and Digital Hub, a government-funded advice service for firms whose questions crossed regulatory lines, ran as a one-year pilot from April 2024 and is closed.

One body that is not on the list is the AI Security Institute. It tests frontier models and advises government, but it “is not a regulator”, has no statutory powers, and depends on companies’ voluntary cooperation.

Enforcement that is actually happening

Regulation is only real where it is used. Three current cases show the existing laws being applied to AI.

• Grok. On 12 January 2026 Ofcom opened an Online Safety Act investigation into X Internet Unlimited Company over sexualised imagery generated by Grok on X; on 3 February 2026 the ICO opened a separate UK GDPR investigation into X and X.AI, saying the reports “raise deeply troubling questions about how people’s personal data has been used to generate intimate or sexualised images without their knowledge or consent”. These are applications of existing data-protection and online-safety law to AI-generated content, not the use of any AI-specific statute. Ofcom’s own statement of 3 February 2026 also exposed the gap the Crime and Policing Act’s s.248 was written to close: it was “currently unable to investigate the creation of illegal images by the standalone Grok service”.
• Clearview AI. The Upper Tribunal ruled on 8 October 2025 that the ICO had jurisdiction over the US facial-recognition company; Clearview has been given permission to appeal to the Court of Appeal. No 2026 judgment had been located as of 23 September 2026.
• Google and Apple. The CMA designated Google’s general search and search advertising, and Google’s and Apple’s mobile platforms, with strategic market status in October 2025 and has been imposing conduct requirements since: for Google search, a publisher requirement (3 June 2026) giving publishers controls over how their content is used, including in AI-powered search features, and fair-ranking and data-portability requirements (17 June 2026). A further consultation on a “user choice” requirement opened on 23 September 2026. This is competition law applied to AI features in existing products, under the Digital Markets, Competition and Consumers Act 2024, not an AI statute.

What is proposed, and what has lapsed

This is the part of the picture that changes most often, so each item carries its category.

A frontier-AI bill (announced proposal, not delivered). The King’s Speech of 17 July 2024 said the government would “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. In January 2025 ministers said they would “shortly publish a consultation” on “binding regulations on the companies developing the most powerful AI models” and put the AI Security Institute “on a statutory footing”. No consultation was published. In December 2025 the then Science Secretary, Liz Kendall, said she was “thinking about it more in terms of specific areas where we may need to act rather than a big all-encompassing bill”. The King’s Speech of 13 May 2026 contained no AI bill.

A Regulating for Growth Bill (government commitment to legislate; no bill yet located). The King’s Speech of 13 May 2026 said legislation “will be introduced” through a Regulating for Growth Bill, which the briefing notes describe as creating “sandbox powers” so that businesses can “test cutting-edge new products and technologies safely”, including “cross-cutting AI sandboxes”; the government had consulted on an “AI Growth Lab” earlier in 2026. That is a commitment by the government to introduce a bill. As of 23 September 2026 a search of bills.parliament.uk for the 2026–27 session did not find a bill of that name; if one is introduced, its sandbox powers become law only when the bill is passed and commenced, and nothing in it is in force now.

Copyright and AI (consultation closed; no legislation). A consultation that ran from December 2024 to February 2025 and drew about 11,500 responses had proposed a text-and-data-mining exception with an opt-out for rights-holders. The government’s statutory report of March 2026, required by the Data (Use and Access) Act, abandoned that: “a broad copyright exception with opt-out is no longer the government’s preferred way forward”, and “we will not introduce reforms to copyright law until we are confident that they will meet our objectives”. Section 29A stands as it was.

Private members’ bills (lapsed or pending). Lord Holmes of Richmond’s Artificial Intelligence (Regulation) Bill received a first reading in the Lords on 4 March 2025 and went no further before the session ended. An Artificial Superintelligence Bill, a Private Member’s Bill from Alex Sobel MP, was introduced in the Commons under the Ten Minute Rule on 8 September 2026, has completed its first reading and is listed on bills.parliament.uk with second reading scheduled for 13 November 2026; press reports quote a government response that it does “not consider the measures proposed in the bill to be the right approach”. It is not a government bill and is not law. Private members’ bills rarely become law without government support.

Parliamentary pressure (finding, not law). The Joint Committee on Human Rights, reporting on 14 September 2026, pressed for an AI bill and a statutory regulator. Committee reports oblige a government response; they do not change the law.

How this differs from the EU AI Act

The European Union’s Regulation (EU) 2024/1689, the AI Act, is a single horizontal law that classifies AI systems by risk, bans some uses outright, imposes obligations on providers of “high-risk” systems and of general-purpose models, and is enforced by national authorities and an EU AI Office. It entered into force on 1 August 2024; its prohibitions applied from 2 February 2025 and its general-purpose-model obligations from 2 August 2025. On 8 July 2026 the EU adopted Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, in force from 27 July 2026, which amends the AI Act and postpones its main high-risk obligations: to 2 December 2027 for the systems listed in Annex III and to 2 August 2028 for those in Annex I, with transparency obligations for existing systems applying from 2 December 2026.

The United Kingdom has none of that structure: no risk tiers, no prohibited-practice list, no registration of high-risk systems, no AI Office. The practical consequences for a UK reader are three.

1. A UK company selling into the EU is caught by the EU Act in the same way as any non-EU provider, because the Act applies to systems placed on the EU market or whose output is used there. UK law adds nothing on top.
2. Inside Great Britain the EU Act does not apply. Nothing in UK law imports it.
3. Northern Ireland is a special case, and still unsettled. Under the Windsor Framework, EU law listed in its Annex 2 applies in Northern Ireland. The UK government’s explanatory memorandum of 30 January 2026 states that only Articles 103–107 and 109 of the AI Act (the ones amending existing EU product laws already in Annex 2) apply automatically, and that beyond those “the EU AI Act does not apply under the Windsor Framework”. The EU has proposed applying the Act more widely in Northern Ireland; a written answer of 30 April 2025 said that “would only apply following an agreement at a Withdrawal Agreement Joint Committee”, and the January 2026 memorandum says the UK “is assessing” the request. No Joint Committee decision had been located as of 23 September 2026.

Devolution matters less than one might expect: the fields these laws sit in (data protection, telecommunications, consumer protection, competition, intellectual property, product safety) are reserved to Westminster, and the 2026 King’s Speech says the Regulating for Growth Bill “will extend and apply to the whole of the UK”. No official document was found stating in one sentence that “AI regulation is reserved”; the reservation follows from the component subjects.

Reading the UK position correctly

A reader who arrives from coverage of the EU Act, or from the US administration’s renaming of AI as “Super Intelligence”, should hold three things apart. The UK has no horizontal AI statute, and as of 23 September 2026 the government had introduced no bill to create one; the only AI bill before Parliament is a Private Member’s Artificial Superintelligence Bill, introduced under the Ten Minute Rule on 8 September 2026 and awaiting second reading, and the Regulating for Growth Bill the government has promised had not yet been located. That is not the same as having no AI regulation: the ICO’s automated-decision rules, Ofcom’s chatbot powers, the CMA’s designations and the 2026 criminal offences are enforceable now. And the absence of a statute is a choice the government has restated in every year since 2023, most recently in June 2026, which means it can be reversed by a bill at any time, and this page will change when a government bill is introduced.