There is no UK AI Act, and that's deliberate
The UK chose not to copy the EU's single statute. Instead it runs a principles-based, regulator-led approach, set out in the government's 2023 white paper: existing regulators such as the ICO, FCA, CMA and Ofcom apply a common set of AI principles through the powers they already hold. For a small business this means there is no AI licence to obtain and no registration to file, but it emphatically does not mean AI use is unregulated. Data protection, equality, consumer and advertising law all reach AI already, and regulators have been applying them.
Government has continued to signal targeted legislation for the most powerful frontier models, but at the time of writing there is still no general AI statute covering everyday business use. Plan on the current framework and review it annually rather than waiting for a big bang that may not come.
The five principles regulators apply
- Safety, security and robustness: AI should work reliably and be protected from misuse.
- Appropriate transparency and explainability: people should be able to know when AI is being used and broadly how decisions are made.
- Fairness: AI must not produce discriminatory or unjust outcomes.
- Accountability and governance: someone identifiable in your business is responsible for AI use.
- Contestability and redress: people affected by an AI decision can challenge it.
These principles aren't directly enforceable as a checklist, but they shape how regulators interpret their existing powers. If your AI use would embarrass you against any of the five, assume a regulator would see it the same way.
Need a hand with this?
Our team delivers AI & Machine Learning for UK businesses — with a free initial consultation, transparent fixed quotes and no lock-in contracts. Tell us what you're working on →
The ICO is the regulator you'll actually meet
The moment personal data enters a prompt, a training set or an output, UK GDPR applies, and the ICO has published detailed guidance on AI and data protection. In practice that means a lawful basis for the processing, a data protection impact assessment before high-risk uses (the ICO expects a DPIA for most AI involving personal data), honest disclosure in your privacy notice, and data minimisation: paste the redacted extract, not the whole client file.
On automated decisions, the ground shifted recently. The Data (Use and Access) Act 2025 relaxed the old near-prohibition on significant decisions made solely by machines, but safeguards remain: you must tell people, give them a way to contest the decision, and provide meaningful human review, with stricter rules where special category data such as health information is involved. If AI helps decide who gets hired, credit or a service, build those safeguards in from day one.
Sector rules that bite sooner than you'd think
- Advertising: the ASA applies the CAP Code to AI-generated ads exactly as to any other ad. Undisclosed synthetic testimonials or fabricated endorsements are misleading advertising, full stop.
- Consumer law: under the Digital Markets, Competition and Consumers Act, fake reviews have been banned since April 2025, and that includes AI-written ones. The CMA can now fine businesses directly.
- Employment: the Equality Act 2010 applies to AI shortlisting and assessment. If a tool discriminates, the tribunal claim lands on you, not the vendor.
- Financial services: the FCA's Consumer Duty covers AI-driven recommendations and decisions affecting retail customers.
Five things your business must actually do
- 1. Keep an AI register: a simple spreadsheet of every AI tool in use, what data goes into it, and who owns it. This is the backbone of everything else.
- 2. Run a lightweight DPIA wherever personal data is involved. The ICO's template turns this into a half-day exercise, and it's your best evidence of good faith if anything goes wrong.
- 3. Keep a human meaningfully in the loop for significant decisions about people (hiring, credit, dismissal), and record that the review happened.
- 4. Update your privacy notice and write a one-page staff AI policy: approved tools, banned inputs (client confidential data into personal accounts tops the list), and when AI use must be disclosed.
- 5. Check your contracts: use business-tier AI accounts with a data processing agreement and a no-training commitment, and keep the vendor's security documentation on file.
Key Takeaway
The UK has no single AI law in 2026; existing regulators enforce existing law against AI use. Your practical duties boil down to five: keep an AI register, run a DPIA when personal data is involved, keep human review over significant decisions about people, publish an honest privacy notice plus a staff AI policy, and use business-tier AI accounts with proper contracts. Watch the ASA and CMA on AI-generated marketing, and remember fake reviews, including AI-written ones, are now directly finable.
If you also sell into the EU
The UK's light-touch approach stops at the border. The EU AI Act applies to UK firms whose AI systems or outputs are used in the EU, with its own risk tiers, transparency duties and, from August 2026, high-risk obligations. If you straddle both markets, don't run two compliance projects: build your register and safeguards once, to the stricter standard, and both regimes are largely covered.
None of this requires a compliance department. A register, a DPIA template, a staff policy and sensible vendor contracts will put you ahead of most UK small businesses. If you'd like help setting that up alongside the AI tools themselves, our team can do both.