UK-wide

AI regulation timeline and key dates

Quick reference for all key AI regulation dates and upcoming milestones. Covers the EU AI Act implementation timeline, UK regulatory developments, copyright consultations, and penalty commencement dates that affect businesses operating in or trading with the UK and EU.

Guide summary

Check if your business uses AI in the EU or UK. You must follow EU AI Act deadlines if you sell to EU customers. UK businesses must prepare for a future AI Bill and follow existing laws on data, safety, and discrimination. Penalties can be up to 10% of global turnover.

  • Stop prohibited AI practices in EU by 2 February 2025
  • Comply with GPAI model rules by 2 August 2025 if you serve EU
  • Meet high-risk AI system rules in EU by 2 August 2026
  • Prepare for UK AI Bill expected second half of 2026
  • Follow DUAA 2025 automated decision rules from 5 February 2026
  • Check Ofcom online safety duties for AI content from 17 March 2025
  • Watch for ICO code on AI and automated decisions in 2026
  • Penalties from ICO: up to £17.5m or 4% of global turnover
  • Ofcom can fine up to 10% of qualifying worldwide revenue
  • CMA can fine up to 10% of global turnover for breaches
On this page

Related guides in Compliance & Legal

AI Regulation Framework

The UK takes a principles-based, sector-specific approach to AI regulation. There is no single AI law. Instead, existing …

UK AI regulation: how it works

Comprehensive overview of UK AI regulation. The UK has no single AI law. Instead, existing sector regulators apply …

AI regulation in the UK and EU is moving on different timelines. If your business develops or deploys AI systems, you need to track dates across multiple jurisdictions and regulators. This guide provides a single reference point for the milestones that matter most.

Use this alongside the detailed guides on UK AI regulation and which regulator covers your AI system for full context on what each milestone requires.

EU AI Act milestones

The EU AI Act affects UK businesses in two main ways. First, if you sell AI products or services to EU customers, you must comply with the Act's requirements for your risk category. Second, the Act's classification system and conformity assessment procedures are likely to influence UK regulatory expectations over time, even without direct transposition.

Businesses that export AI systems to the EU should begin compliance work well ahead of each deadline. The high-risk AI system requirements, which take effect from August 2026, involve conformity assessments, technical documentation, and registration in the EU database — processes that take months to complete.

UK regulatory milestones

Key UK dates already in force

  • 5 February 2026: Data (Use and Access) Act 2025 data protection provisions commenced — new rules on automated decision-making and recognised legitimate interests
  • 17 March 2025: Online Safety Act 2023 illegal-content compliance duties took effect — platforms must conduct risk assessments and take proactive measures, including for AI-generated content
  • January 2025: Digital Markets, Competition and Consumers Act 2024 CMA powers commenced — Strategic Market Status designations can now be made for large AI-powered platforms

Upcoming UK milestones

  • 2026 (expected): AI Bill introduced to Parliament — expected to place the five AI principles on a statutory footing and strengthen regulator mandates
  • 2026 (expected): ICO statutory code on AI and automated decision-making — will provide binding guidance under DUAA 2025 powers
  • 2026 (expected): Product Regulation and Metrology Act 2025 secondary legislation — may bring AI-enabled products within scope of product safety regulation
  • 2026-2027 (expected): Government response on AI and copyright — will set rules on text and data mining, transparency obligations, and creator opt-out mechanisms

Penalties reference

Penalty regimes are already in force across all the regulators listed above. You do not need to wait for the AI Bill to face enforcement action. If your AI system breaches existing data protection, consumer protection, financial services, health and safety, or equality law, the relevant regulator can act now using its current powers.

The EU AI Act introduces its own penalty regime for non-compliance, with fines of up to 35 million euros or 7% of global annual turnover for prohibited AI practices. UK businesses selling into the EU market should factor these into their compliance planning.

Timeline resources