Guide
Assess your AI compliance obligations
Step-by-step guide to assessing what AI compliance obligations apply to your business. Covers inventorying AI systems, identifying personal data processing, mapping to regulators, conducting DPIAs, checking equality impacts, and documenting governance arrangements.
If your business uses artificial intelligence — whether a chatbot handling customer enquiries, an algorithm screening job applicants, or a machine learning model assessing credit risk — you already have compliance obligations. There is no single AI Act in the UK. Instead, existing regulators apply their own rules to AI within their domains.
This means the obligations that apply to you depend on what your AI does, who it affects, and what data it processes. A recruitment AI triggers employment and equality law. A customer-facing AI processing personal data triggers data protection law. An AI controlling safety-critical equipment triggers health and safety law.
This guide walks you through a structured assessment so you can identify which obligations apply, which regulators oversee your use of AI, and what steps you need to take to comply.
The UK's approach to AI regulation
The UK government has adopted a pro-innovation, sector-specific approach to AI regulation. Rather than creating a single AI regulator or a comprehensive AI Act, the government has asked existing regulators to apply five cross-cutting principles to AI within their remits.
This means the ICO regulates AI that processes personal data, the Equality and Human Rights Commission (EHRC) oversees AI that affects equality, and the Health and Safety Executive (HSE) covers AI in safety-critical environments. Understanding which regulators have jurisdiction over your AI systems is the first step in assessing your obligations.
How to assess your AI compliance obligations
Work through these six steps to build a clear picture of what your business must do. Each step builds on the previous one, so complete them in order.
ICO data protection requirements for AI
If your AI processes personal data, the ICO expects you to meet specific requirements beyond standard UK GDPR compliance. These address the particular risks that AI poses to individuals' rights and freedoms.
DPIA requirements for AI systems
A Data Protection Impact Assessment is mandatory for most AI systems that process personal data. The assessment must be conducted before the processing begins and reviewed whenever the processing changes significantly.
Equality and discrimination obligations
The Equality Act 2010 applies to AI in the same way it applies to human decision-making. If your AI produces outcomes that disproportionately disadvantage people with protected characteristics, you may be liable for indirect discrimination even if the algorithm was not designed to discriminate.