UK-wide

UK AI regulation: how it works

Comprehensive overview of UK AI regulation. The UK has no single AI law. Instead, existing sector regulators apply five cross-cutting principles to AI systems within their remit. This guide explains how the framework works, which regulators are involved, and what is coming next.

Guide summary

Identify which UK regulators oversee your AI system based on what it does and which sector it operates in. Apply the five cross-cutting principles: safety, transparency, fairness, accountability, and contestability. No single AI register or risk classification exists yet, but a new AI Bill expected in 2026 may make the principles a legal duty for regulators.

  • Check which sector regulators apply to your AI system
  • Follow the 5 principles: safety, transparency, fairness, accountability, contestability
  • Know that ICO fines for data protection breaches can reach £17.5 million or 4% of turnover
  • FCA can impose unlimited fines for AI in financial services
  • CMA can fine up to 10% of global turnover for AI competition breaches
  • Ofcom can fine up to 10% of qualifying worldwide revenue for AI on online platforms
  • MHRA regulates AI medical devices; fines can be unlimited if criminal
  • DRCF coordinates across ICO, CMA, Ofcom and FCA on overlapping AI issues
  • An AI Bill is expected in 2026 to put the 5 principles into law
On this page

Related guides in Compliance & Legal

AI Regulation Framework

The UK takes a principles-based, sector-specific approach to AI regulation. There is no single AI law. Instead, existing …

Set up an AI governance framework

How to establish accountability structures, risk processes, and oversight for AI systems in your business. Covers accountability and …

The UK does not have a single AI law. Unlike the EU, which passed the AI Act as a comprehensive horizontal regulation, the UK has chosen a principles-based, sector-specific approach. Existing regulators — the ICO, FCA, Ofcom, CMA, MHRA, HSE, and others — apply their existing powers to AI systems within their domains.

This means there is no single regulator you register with and no universal risk classification system. Instead, the regulatory requirements that apply to your AI system depend on what it does, who it affects, and which sector it operates in.

The government set out this approach in its 2023 white paper A pro-innovation approach to AI regulation and reinforced it in the 2024 response to consultation. The AI Bill announced in the July 2025 King's Speech is expected to place the five principles on a statutory footing, but the sector-specific model remains the foundation.

The five AI principles

These five principles are currently non-statutory. Regulators are expected to interpret and apply them within their existing frameworks, adapting them to the specific risks and contexts of their sectors. The ICO, for example, maps the principles to UK GDPR requirements for automated decision-making. The FCA applies them through its existing rules on algorithmic trading and consumer outcomes.

The government has indicated that the forthcoming AI Bill will place a duty on regulators to have regard to these principles, giving them a firmer legal basis without creating a rigid compliance regime.

Which regulators cover AI

The sector-based model means that multiple regulators may apply simultaneously to a single AI system. An AI-powered recruitment tool, for instance, falls under ICO oversight for data protection, EHRC scrutiny for discrimination, and potentially Ofcom regulation if it operates on an online platform.

Businesses developing or deploying AI should identify all the regulators whose remit covers their use case. The Digital Regulation Cooperation Forum (DRCF) coordinates between regulators to reduce duplication and provide joined-up guidance.

Key institutions

The AI Security Institute focuses primarily on frontier AI models — the most powerful systems developed by major AI laboratories. Most businesses deploying AI will not interact directly with the Institute unless they are developing or fine-tuning foundation models. The DRCF, by contrast, produces practical guidance relevant to any business using AI within a regulated sector.

What is coming next

The legislative landscape is evolving rapidly. Key developments to monitor include:

  • AI Bill: Expected to place the five principles on a statutory footing and give regulators clearer mandates
  • ICO AI code of practice: The ICO is developing a statutory code under the Data (Use and Access) Act 2025 covering AI and automated decision-making
  • Copyright and AI: The government is considering how to balance AI training needs with creators' rights, following its 2024 consultation
  • International alignment: The UK is participating in the Hiroshima AI Process and the Council of Europe AI Convention, which may influence domestic regulation

Businesses should not wait for legislation to act. The regulators already have enforcement powers that apply to AI systems, and they are actively using them. Building compliance into your AI processes now will reduce the cost of adapting when statutory requirements arrive.

Official guidance and resources