Frameworks · United Kingdom
AI governance frameworks and AI regulation in the UK
The UK governs AI without an AI Act. Existing regulators apply five cross-sector principles within their own powers, UK GDPR sets binding rules for significant automated decisions, and central government follows the AI Playbook and the Algorithmic Transparency Recording Standard. These are the instruments that apply to UK organisations, with the international standards most of them build on.
Who regulates AI here
- Information Commissioner's Office (ICO)Regulates UK GDPR and the Data Protection Act 2018, including the Articles 22A to 22D rules on automated decisions and the coming statutory code on AI.
- Financial Conduct Authority (FCA)Supervises how financial services firms use AI with customers under the Consumer Duty and the Senior Managers and Certification Regime.
- Prudential Regulation Authority (PRA)Sets model risk management expectations for banks and building societies in SS1/23, which reach AI and machine learning models.
- Competition and Markets Authority (CMA)Applies competition and consumer protection law to AI markets and to how businesses use AI with consumers.
- Department for Science, Innovation and Technology (DSIT)Owns the UK's principles-based approach to AI regulation and the standards for AI use in government.
- AI Security InstituteThe government body inside DSIT that evaluates the security risks of advanced AI models.
United Kingdom
The UK regulates AI through existing regulators applying shared principles, with specific rules for automated decisions under UK data protection law.
International
Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.
Questions
Does the UK have an AI Act?
No. As of October 2026 the government has not introduced an AI bill. AI is regulated through existing law, including UK GDPR, the Equality Act 2010, consumer and competition law and sector rules, applied by the regulators that already enforce them.
What changed for automated decisions in UK GDPR?
The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D, in force since 5 February 2026. Significant decisions based solely on automated processing are now allowed for most personal data if the controller provides safeguards, including information about the decision, a way to make representations, human intervention and a way to contest. Tighter limits remain for special category data.
Does the EU AI Act apply to UK companies?
It can. The EU AI Act reaches providers outside the EU whose AI systems are placed on the EU market, and providers and deployers outside the EU whose AI output is used in the EU. A UK firm selling AI into the EU, or serving EU customers with it, should check its role under the Act.
Is the AI Playbook mandatory?
The AI Playbook for the UK Government sets ten principles for AI use in government and is guidance rather than law. The Algorithmic Transparency Recording Standard is mandatory for central government departments, which must publish records of in-scope algorithmic tools.
Start with the AI you run.
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.