AI Regulation in the UK

The UK does not (yet) have a single "AI law". Instead, existing laws - especially data protection - apply to how you use AI, and each regulator applies them in its own sector. If you sell into the EU, the EU AI Act may also apply to you.

UK GDPR and data protection

If AI handles personal data - customer emails, CVs, call recordings, names in a spreadsheet - UK GDPR applies just as it does to any other system. In practice that means:

• Know your lawful basis for using the data, and keep to the purpose you collected it for.
• Update your privacy notice to say you use AI tools and which providers process data for you.
• Have a data processing agreement with the AI provider - business plans and APIs include one; consumer accounts generally don't.
• Minimise data - send only what the AI needs (see Sensitive Data and AI).
• Do a DPIA (Data Protection Impact Assessment) for higher-risk uses, such as AI involved in recruitment, credit or health.

The Data (Use and Access) Act 2025

This Act updated UK data protection law and is being brought into force in stages. Changes relevant to AI include:

• Automated decision-making - rules on decisions made entirely by computer have been relaxed for most personal data, but you must still tell people, let them challenge the decision and get a human to review it. Stricter rules remain for special category data (health, ethnicity, religion and so on).
• Cookies - some low-risk cookies, such as certain website analytics, may no longer need consent in future, but you must still give clear information and an easy way to opt out. Check current ICO guidance before relying on this.

The EU AI Act - if you trade with the EU

The EU AI Act applies to businesses outside the EU when their AI systems or AI output are used in the EU. It sorts AI uses by risk:

• Banned (since February 2025) - for example manipulative AI, social scoring and emotion recognition in the workplace.
• High-risk - for example AI used in recruitment, credit decisions, education and access to essential services. These carry heavy obligations. Deadlines for these rules have been under review in the EU, so check the latest position.
• Transparency duties (applying from August 2026) - telling people when they are talking to an AI such as a chatbot or voice agent, and labelling AI-generated or manipulated content such as deepfakes.
• Minimal risk - most everyday business uses (drafting emails, summarising documents) have no special obligations.

Even if you only trade in the UK, following the transparency rules is simply good practice - customers appreciate honesty.

Other laws that apply to AI

• Equality Act 2010 - if AI helps screen job applicants or make decisions about customers, you are responsible for making sure it doesn't discriminate. Test it, and keep a person in the decision.
• Consumer law - the Digital Markets, Competition and Consumers Act 2024 bans fake reviews, including AI-written ones. AI-generated marketing claims must still be true.
• Copyright - the law on AI and copyright is still being settled in the UK. Check AI-generated text and images before publishing, avoid imitating identifiable people, artists or brands, and use the business versions of AI tools, which usually come with better terms on output ownership.
• Sector rules - regulated businesses (financial services, legal, healthcare) should check their regulator's guidance on AI (for example the FCA, SRA or CQC).

A practical checklist

1. List the AI tools your business uses - including ones staff use on their own.
2. Move business use onto business plans or APIs, not personal accounts.
3. Write a short staff AI usage policy: approved tools, what must never be pasted in, checking AI output before it is used.
4. Update your privacy notice and check you have data processing agreements in place.
5. Tell customers when they are dealing with AI.
6. Keep a person responsible for important decisions.
7. Review it every six months - this area is moving fast.