Guide

AI compliance checklist

Quick verification checklist covering all major AI compliance obligations. Use this checklist to confirm your business meets its data protection, equality, transparency, oversight, and record-keeping obligations when using AI systems.

Last updated: 20 February 2026

UK-wide

Use this checklist to verify that your business meets its AI compliance obligations. It covers the key requirements from data protection law, equality law, health and safety law, and the UK's AI regulatory principles.

Work through each section and resolve any gaps before moving on. If you identify areas where you are not compliant, refer to the detailed guidance linked at the end of this checklist.

Data protection

Equality and fairness

Transparency and explainability

Risk and safety

Governance and record-keeping

The UK's five AI regulatory principles

Your compliance arrangements should align with the five principles that guide all UK regulators in their approach to AI.

Enforcement and penalties

Multiple regulators can take enforcement action if your AI systems breach their requirements. The penalties vary by regulator and the severity of the breach.

⚠️ Act on compliance gaps immediately

If you identified gaps in any section, address them as a priority. AI compliance failures can trigger enforcement action from multiple regulators simultaneously. The ICO, EHRC, FCA, HSE, and CMA all have powers to investigate and sanction businesses that fail to manage AI responsibly. Do not wait for a complaint or investigation to act — regulators expect proactive compliance.

Related guidance

• Assess your AI compliance obligations for a step-by-step assessment of which obligations apply to your business
• Set up an AI governance framework for detailed guidance on accountability, transparency, fairness, and record-keeping
• AI transparency and explainability obligations for practical approaches to explaining AI decisions

---

Related guides in Compliance & Legal

AI Regulation Framework

The UK takes a principles-based, sector-specific approach to AI regulation. There is no single AI law. Instead, existing regulators — including the ICO, FCA, MHRA, CMA, Ofcom, and EHRC — apply five cross-cutting principles within their own domains. The AI Security Institute (formerly AI Safety Institute) provides guidance on frontier models. A comprehensive government AI Bill is expected in the second half of 2026.

Read guide

Assess your AI compliance obligations

Step-by-step guide to assessing what AI compliance obligations apply to your business. Covers inventorying AI systems, identifying personal data processing, mapping to regulators, conducting DPIAs, checking equality impacts, and documenting governance arrangements.

Read guide

Set up an AI governance framework

How to establish accountability structures, risk processes, and oversight for AI systems in your business. Covers accountability and roles, transparency, fairness and bias testing, record-keeping, and applying the UK's five AI regulatory principles.

Read guide

UK AI regulation: how it works

Comprehensive overview of UK AI regulation. The UK has no single AI law. Instead, existing sector regulators apply five cross-cutting principles to AI systems within their remit. This guide explains how the framework works, which regulators are involved, and what is coming next.

Read guide

Which regulator covers your AI system

Decision-tree reference guide mapping AI use cases to the UK regulators responsible for oversight. Covers the ICO, FCA, Ofcom, CMA, MHRA, HSE, and EHRC, with scenario-based guidance on which regulators apply to your AI system and the penalties each can impose.

Read guide