Journey

AI compliance quick check

Rapid AI compliance self-assessment: identify AI systems, map to regulators, flag critical obligations, confirm key safeguards in place.

Running a Business Updated 15 September 2026

6 milestones references 6 guides

AI compliance quick check

Use this quick check to assess whether your business meets its AI compliance obligations. Work through each section to identify gaps and prioritise action.

Do you use AI?

AI includes machine learning models, automated decision-making, chatbots, recommendation engines, predictive analytics, and large language models. If you procure AI-powered software or services, you are an AI deployer with compliance obligations.

The five cross-cutting AI principles

The UK framework is built on five principles that all regulators must apply: safety, transparency, fairness, accountability, and contestability. These apply regardless of sector.

The UK government's AI regulatory framework is based on five cross-cutting principles that existing sector regulators must apply within their remits. These principles were established in the March 2023 White Paper and confirmed in the February 2024 consultation response.

The principles are not currently on a statutory footing. Regulators are expected to apply them but are not legally required to do so. The government has announced that a comprehensive AI Bill (expected second half of 2026) may place these principles on a statutory basis.

Principle 1

Safety, security and robustness — AI systems should function in a robust, secure and safe way throughout their lifecycle

Principle 2

Appropriate transparency and explainability — people should be able to access information about AI systems that affect them

Principle 3

Fairness — AI systems should not undermine legal rights, discriminate unfairly, or create unfair market outcomes

Principle 4

Accountability and governance — governance measures should ensure effective oversight with clear lines of accountability

Principle 5

Contestability and redress — people should be able to contest AI outcomes where rights have been violated or harm has occurred

Statutory basis

Non-statutory (regulators expected to apply, not legally required)

White Paper published

29 March 2023

Consultation response

6 February 2024

DSIT regulator support funding

10 million GBP to boost regulator AI capabilities

UK AI regulation overview

How the UK's pro-innovation, principles-based AI framework works and what it means for your business.
Does your AI process personal data?

If your AI system processes personal data in any form (names, images, behavioural data, employee records), UK GDPR and the Data Protection Act 2018 apply. A Data Protection Impact Assessment is likely required.

DPIA requirements for AI

The ICO expects a DPIA before deploying AI that processes personal data, profiles individuals, or makes automated decisions with legal or significant effects.

A Data Protection Impact Assessment (DPIA) is mandatory for AI systems that process personal data in ways likely to result in high risk to individuals' rights and freedoms. The ICO provides AI-specific DPIA guidance.

When mandatory

AI processing involving profiling, large-scale processing of special category data, systematic monitoring of public areas, or automated decision-making with legal/significant effects

AI-specific considerations

Algorithmic fairness, training data quality and representativeness, model accuracy and error rates, explainability, automated decision safeguards, data minimisation in training

ICO risk toolkit

AI and data protection risk toolkit provides structured assessment framework for AI-specific DPIAs

Timing

Must be conducted before AI processing begins — not retrospectively

Consultation

Must consult the ICO if DPIA indicates high risk that cannot be mitigated

Review

DPIAs must be kept under review — reassess when AI system changes significantly (new training data, model updates, expanded use)
Which regulators apply to your AI use?

Identify which regulators have jurisdiction over your AI systems. Most businesses will fall under the ICO. Regulated sectors (financial services, healthcare, telecoms) face additional requirements from their sector regulator.

Regulator remits for AI

The ICO covers data protection in AI. The FCA regulates AI in financial services. Ofcom covers AI in online content. The CMA addresses AI competition issues. The EHRC handles AI discrimination.

The UK does not have a single AI regulator. Instead, existing sector regulators apply the five AI principles within their remits. The key regulators with AI jurisdiction are listed below.

ICO (Information Commissioner's Office)

AI and data protection — lawful basis, DPIAs, automated decision-making, transparency. Developing statutory AI code of practice. Max fine: 17.5 million GBP or 4% of global turnover

FCA (Financial Conduct Authority)

AI in financial services — Consumer Duty, SM&CR senior manager accountability, operational resilience, model risk management. Max fine: unlimited

CMA (Competition and Markets Authority)

AI and competition — foundation models review, Strategic Market Status regime for AI platforms, merger investigations for AI deals. Max fine: 10% of global turnover (digital markets)

Ofcom (Office of Communications)

AI and online safety — AI-generated content duties, algorithmic recommendation transparency, AI chatbot regulation under Online Safety Act. Max fine: 10% of qualifying worldwide revenue

MHRA (Medicines and Healthcare products Regulatory Agency)

AI medical devices — AI as Medical Device (AIaMD) and Software as Medical Device (SaMD) registration and post-market surveillance. Max fine: unlimited (criminal offence)

EHRC (Equality and Human Rights Commission)

AI and equality — algorithmic discrimination under Equality Act 2010, AI bias in recruitment, Public Sector Equality Duty for AI

HSE (Health and Safety Executive)

AI workplace safety — risk assessments for AI systems, Market Surveillance Authority for AI products under PRMA 2025. Max fine: unlimited

DSIT (Department for Science, Innovation and Technology)

Central AI policy coordination, AI Opportunities Action Plan, AI and copyright report obligation

AI Security Institute

Frontier AI model safety evaluations (voluntary), security risk research, Inspect testing platform. Directorate of DSIT

DRCF coordination

ICO + CMA + Ofcom + FCA coordinate on cross-cutting AI issues via the Digital Regulation Cooperation Forum

Which AI regulator applies to you

Map your AI use to the relevant UK regulators and understand their specific requirements.
Are transparency requirements met?

Can you explain to affected individuals how your AI system works, what data it uses, and how decisions are reached? Under UK GDPR Article 22, individuals have the right not to be subject to purely automated decisions with significant effects.

Transparency obligations

Businesses must inform people when AI is used in decisions affecting them, explain the logic involved, and provide meaningful information about the significance and consequences.

Multiple UK regulatory frameworks require transparency about AI systems. The specific obligations depend on the context of AI use and which regulator has jurisdiction.

UK GDPR (ICO)

Articles 13-14 require 'meaningful information about the logic involved' in automated decisions and their significance and envisaged consequences

FCA Consumer Duty

Firms must be able to explain AI-driven decisions to consumers and demonstrate good outcomes

Ofcom (OSA 2023)

Platforms must be transparent about algorithmic recommendation systems used to prioritise content

ICO guidance

ICO 'Explaining decisions made with AI' guidance covers six explanation types: rationale, responsibility, data, fairness, safety/performance, impact

Privacy notices

Must describe AI use, logic involved in automated decisions, significance and consequences for the individual

ROPA

Records of Processing Activities must document automated decision-making processes

AI transparency and explainability

How to meet transparency obligations, explain AI decisions, and handle subject access requests involving AI.
Is human oversight in place?

Confirm that a human can review, override, or intervene in AI-driven decisions, particularly those affecting individuals' rights, employment, credit, or access to services.

Human oversight requirements

The contestability principle requires meaningful human review of AI decisions. Rubber-stamping automated outputs does not constitute adequate oversight.

Several UK regulatory frameworks require human oversight of AI decisions and mechanisms for individuals to challenge AI-driven outcomes.

DUAA 2025 safeguards

From 5 February 2026: right to obtain human intervention in significant automated decisions, right to express point of view, right to contest the decision

FCA SM&CR

A named senior manager must be accountable for AI decisions — personal liability for outcomes

EU AI Act (if applicable)

High-risk AI systems must be designed to allow effective human oversight as a core design requirement

EHRC contestability

Individuals can challenge AI-driven discrimination through Employment Tribunals and civil courts

FCA complaints

Consumers can escalate AI-driven financial decisions to the Financial Ombudsman Service

Implementation

Organisations should establish clear escalation routes, train staff to review AI decisions, and document human oversight processes
Have you tested for bias?

AI systems can produce discriminatory outcomes even without discriminatory intent. The Equality Act 2010 applies to AI-driven decisions in employment, services, and public functions. Test your AI outputs for bias across protected characteristics.

Bias and fairness testing

Regulators expect documented evidence of bias testing before deployment and ongoing monitoring. This includes testing across protected characteristics such as age, race, sex, and disability.

There is no UK statutory requirement for AI bias testing specifically. However, the Equality Act 2010 requires non-discriminatory outcomes, and ICO DPIA guidance includes fairness assessment. Several frameworks recommend structured bias testing.

Legal obligation

Equality Act 2010 prohibits discriminatory outcomes — businesses bear the burden of proving AI does not discriminate

ICO DPIA

ICO AI and data protection risk toolkit includes fairness assessment as part of AI-specific DPIA

GOV.UK recommendation

Responsible AI in Recruitment guide (March 2024) recommends Algorithmic Impact Assessments (AIAs) for AI recruitment tools

Public sector

Equality Impact Assessments (EIAs) required for public bodies deploying AI under Public Sector Equality Duty

EHRC guidance

EHRC guidance on AI bias focused on recruitment tools, facial recognition, and algorithmic decision-making

FCA expectation

FCA Consumer Duty requires firms to monitor for AI-driven unfair outcomes in pricing, underwriting, and service delivery

Next steps

If you answered 'no' or 'unsure' to any check above, use the full assessment and checklist guides to close your compliance gaps.

AI compliance assessment

Structured assessment to evaluate your AI governance maturity and identify priority actions.

AI compliance checklist

Comprehensive checklist covering data protection, transparency, fairness, oversight, and record keeping for AI systems.

Take note

Document everything: Regulators expect evidence of your AI compliance efforts. Maintain records of DPIAs, bias testing results, transparency notices, and human oversight procedures. The ICO and sector regulators can request these at any time.

AI governance framework

How to build an AI governance framework covering risk assessment, accountability, and ongoing monitoring.

AI compliance quick check

AI compliance quick check

Do you use AI?

UK AI regulation overview

Does your AI process personal data?

Which regulators apply to your AI use?

Which AI regulator applies to you

Are transparency requirements met?

AI transparency and explainability

Is human oversight in place?

Have you tested for bias?

Next steps

AI compliance assessment

AI compliance checklist

AI governance framework

Related journeys

Start using AI responsibly in your business

Using AI in recruitment safely

Responding to an AI regulatory investigation

Prepare for EU AI Act compliance