UK AI regulation: the pro-innovation approach and its five principles

What it is

The UK chose not to pass a single, horizontal AI law. Its approach is set out in the white paper “A pro-innovation approach to AI regulation”, published by the Department for Science, Innovation and Technology (DSIT) on 29 March 2023, and confirmed in the government’s consultation response of 6 February 2024.

The approach rests on five cross-sector principles. Existing regulators interpret and apply them within their own remits, using the powers they already have. The principles are not set in statute. The government said it would keep that under review, but as of October 2026 it has not introduced an AI bill. Private members’ bills proposing a central AI regulator have been introduced in the House of Lords, and none has government support.

There are five principles.

1. Safety, security and robustness
2. Appropriate transparency and explainability
3. Fairness
4. Accountability and governance
5. Contestability and redress

Alongside the principles, the government set up a central function inside DSIT to monitor AI risk across the economy and coordinate regulators. It also asked key regulators to publish their strategic approach to AI by 30 April 2024, and announced £10 million to build regulator capability. The AI Safety Institute, which evaluates advanced models, was renamed the AI Security Institute on 14 February 2025 to reflect its focus on security risks.

Who it applies to

The principles are addressed to regulators, not directly to businesses. In practice they reach any organisation whose AI falls within a regulator’s remit. That includes the ICO for personal data, the FCA for financial services, the CMA for competition and consumer protection, Ofcom for online safety and communications, and the MHRA for medical devices.

Location does not decide it. An organisation based outside the UK is in scope if it offers AI-enabled products or services to people in the UK, processes their personal data, or operates in a UK-regulated sector. The underlying laws carry the reach, so the question is always which UK law and which regulator apply to a given use.

What it requires

Because the principles work through existing law, the obligations are the ones those laws already impose, read with the principles in mind. For an organisation using or building AI, each principle translates into practices a regulator will expect to see.

Safety, security and robustness. AI systems should work reliably and securely across their lifecycle, with risks identified, assessed and managed. In practice that means risk assessment before deployment and after material change, security testing, and monitoring in production.

Appropriate transparency and explainability. People affected by AI, and the regulators overseeing it, should be able to get enough information about how a system works and how it reaches its outputs. The level depends on context and risk. For personal data this overlaps with the ICO’s guidance on explaining decisions made with AI.

Fairness. AI should not undermine people’s legal rights, discriminate unlawfully or create unfair market outcomes. The Equality Act 2010 applies to discriminatory outcomes whether or not an algorithm produced them, and data protection law requires fair processing.

Accountability and governance. Clear ownership of each AI system, defined roles and oversight across the supply chain. Regulators expect named accountable people, documented decisions and governance that covers third-party AI as well as systems built in-house.

Contestability and redress. People should be able to challenge a harmful AI outcome or decision and get redress. For significant automated decisions about individuals, UK GDPR Articles 22A to 22D now set this out as legal safeguards.

Regulators have published their strategic approaches to AI, and each one sets out how the principles map onto its existing rules. An organisation working in several sectors needs to read the relevant regulator’s approach alongside the principles.

Key dates

• 29 March 2023. White paper published, with consultation closing 21 June 2023.
• 6 February 2024. Government response confirms the non-statutory, regulator-led approach.
• 30 April 2024. Deadline for key regulators to publish their strategic approaches to AI.
• 14 February 2025. AI Safety Institute becomes the AI Security Institute.
• 19 June 2025. Data (Use and Access) Act 2025 receives Royal Assent, reforming automated decision-making rules.
• 5 February 2026. UK GDPR Articles 22A to 22D come into force.

There is no date for an AI bill.

How it relates to other frameworks

The five principles draw on the OECD AI Principles, and they cover much the same ground as most national AI ethics principles. Governance designed around one usually maps well onto the others.

The sharpest contrast is with the EU AI Act. The EU sets binding, risk-tiered obligations in one statute, including prohibitions and conformity assessment for high-risk systems. The UK leaves the detail to sector regulators and existing law. An organisation operating in both needs to meet the EU Act’s specific obligations and also be ready to show UK regulators how it addresses the five principles. The mapping between the two is real work, not an assumption.

Within the UK, the binding pieces sit in other instruments. UK GDPR Articles 22A to 22D govern significant automated decisions about individuals. The ICO’s guidance on AI and data protection explains how data protection law applies across the AI lifecycle. In the public sector, the Algorithmic Transparency Recording Standard and the AI Playbook for the UK Government add their own expectations.

Management system standards help put the principles into practice. ISO/IEC 42001 gives the structure for policy, roles, risk and impact assessment and continual improvement, and the NIST AI RMF gives detailed risk management practices. Neither is required by UK law.

Working with it in Aicura

UK framework content is available in Aicura on the Enterprise tier. An administrator enables it in Settings under Frameworks, alongside any other frameworks the organisation’s plan carries.

Once enabled, the risk and impact assessments Aicura runs for each AI system and agent in the register apply the UK framework as one of their sources. Risk items carry suggested controls, which land in Risks and Controls where owners track whether each control is applicable, implemented and tested. Governance policy reviews scan uploaded policies, such as an AI acceptable use policy or an AI risk assessment policy, against the frameworks mapped to that review, and the Policy review report shows where each policy stands against them.

The output is guidance for your own judgement. Aicura does not decide whether your AI meets UK law or a regulator’s expectations.