Journey

Run a tech business

Ongoing compliance, operations, and growth guidance for established UK tech and software businesses

Technology & Digital Running a Business Updated 15 September 2026

10 milestones references 18 guides

Data protection and privacy compliance
UK GDPR compliance is fundamental for tech businesses. Review your data practices regularly, especially when launching new features or processing new data types.

Data protection for businesses

Understand your obligations for processing personal data, from lawful bases to data subject rights
ICO registration fees

Most tech businesses must pay an annual data protection fee to the ICO. The amount depends on your turnover and staff numbers.
Under the Data Protection (Charges and Information) Regulations 2018, most organisations that process personal data must pay an annual data protection fee to the Information Commissioner's Office (ICO).

Tier 1 fee (micro organisations)

£52 per year

Tier 1 threshold

Annual turnover up to £632,000 AND 10 or fewer staff

Tier 1 Direct Debit

£47 per year (£5 discount)

Tier 2 fee (SMEs)

£78 per year

Tier 2 threshold

Annual turnover up to £36 million AND 250 or fewer staff

Tier 2 Direct Debit

£73 per year (£5 discount)

Tier 3 fee (large organisations)

£3,763 per year

Tier 3 threshold

Annual turnover over £36 million OR over 250 staff

Tier 3 Direct Debit

£3,758 per year (£5 discount)

Effective from

17 February 2025

Charities

Pay Tier 1 fee only (£52), regardless of size or turnover

Penalty for non-payment

Up to 150% of the highest charge payable (DPA 2018 section 158(3)), plus the fee owed

Payment deadline after notice

28 days to pay or make representations

Renewal

Annual - ICO sends renewal reminder before expiry

Who must pay

You must register if your business:

Processes personal information about individuals (customers, employees, suppliers)

Uses CCTV (including smart doorbells or dashcams for business purposes)

Maintains marketing lists

Uses cookies on your website

Limited exemptions

Very few organisations are exempt. You may be exempt only if you:

Only process personal data for personal or household purposes (not business)

Are an MP, elected representative, or judge (specific exemptions)

Have no automated processing (no computers, no CCTV) - extremely rare

Most businesses are NOT exempt - if you have customer or employee data, you almost certainly need to pay.

Pay the data protection fee (opens in a new tab)

ICO fee self-assessment tool (opens in a new tab)
International data transfers

Requirements for transferring personal data outside the UK

Data breach response

Know the 72-hour reporting rule and how to respond to data breaches
GDPR penalty scale

ICO fines can reach 4% of annual turnover or GBP 17.5 million. Data protection failures can also trigger class action lawsuits from affected users.
The ICO can issue administrative fines under UK GDPR Article 83 and DPA 2018 Section 157. There are two tiers of maximum fines depending on the type of infringement.

Higher tier maximum

£17.5 million or 4% of annual worldwide turnover, whichever is HIGHER

Higher tier applies to

Breaches of data protection principles (Article 5), lawful basis requirements (Articles 6, 7, 9), data subject rights (Articles 12-22), unlawful international transfers (Articles 44-49)

Standard tier maximum

£8.7 million or 2% of annual worldwide turnover, whichever is HIGHER

Standard tier applies to

Failure to comply with controller/processor obligations, processing children's data incorrectly, certification failures, breach notification failures

Infringements attracting higher tier fines (£17.5m / 4%)

Breaching data protection principles (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability)

Processing without valid lawful basis

Failing to obtain valid consent where required

Processing special category data without a valid condition

Failing to respect data subject rights (access, rectification, erasure, portability, objection)

Unlawful transfers of personal data to third countries

Infringements attracting standard tier fines (£8.7m / 2%)

Failure to comply with controller or processor obligations under Chapter IV

Processing children's data incorrectly (Article 8)

Failure to notify data breaches to ICO within 72 hours

Failure to notify individuals of high-risk breaches

Failure to comply with certification requirements

Multiple infringements

For same or linked processing operations, total fine cannot exceed amount for gravest infringement

Unlinked operations

Separate fines for unlinked operations can exceed statutory maximum when summed

ICO approach

Fines should be effective, proportionate, and dissuasive in each individual case

Legislation reference

UK GDPR Article 83, DPA 2018 Sections 155-157

ICO fining guidance (opens in a new tab)

ICO enforcement actions (opens in a new tab)
Electronic marketing and cookie compliance

PECR works alongside UK GDPR to regulate cookies, email marketing, and electronic communications. Get this wrong and the ICO can fine you up to GBP 500,000.

Electronic marketing rules (PECR)

Understand consent requirements for email, SMS, and phone marketing

PECR enforcement penalties

Review your cookie consent mechanism regularly. Many cookie banners fail to meet legal requirements - genuine consent means making rejection as easy as acceptance.

From 5 February 2026, maximum penalties for PECR breaches have been aligned with UK GDPR levels under the Data (Use and Access) Act 2025.

Previous maximum fine

£500,000

New maximum fine (from 5 February 2026)

£17.5 million or 4% of global annual turnover, whichever is higher

Effective date

5 February 2026

Legal basis

Data (Use and Access) Act 2025

Applies to

Unlawful email/SMS marketing, telemarketing, cookies/tracking breaches

Regulator

Information Commissioner's Office (ICO)

Common PECR breaches

Unsolicited marketing, ignoring opt-outs, manipulative cookie consent

ICO enforcement (2022-2025)

49 PECR fines totalling £4.63 million

Average fine (pre-2025)

£94,490

Expected focus areas

Mass unsolicited communications, TPS/CTPS violations, deceptive consent flows

ICO PECR enforcement guidance (opens in a new tab)

Cookie consent best practice

Implement a compliant cookie consent banner that gives users a real choice. The ICO has issued significant fines for pre-ticked boxes and dark patterns that push users toward accepting cookies.
Official guidance (opens in a new tab)
Digital service regulations

If you operate a platform with user-generated content, search functionality, or cloud services, you may be subject to the Online Safety Act or NIS Regulations.

Online Safety Act compliance

Compliance requirements for platforms hosting user-generated content

Platform categorisation thresholds

The Online Safety Act categorises platforms by user numbers and functionality. Category 1 platforms face the strictest requirements.

The Online Safety Act 2023 categorises user-generated content (UGC) platforms by size and functionality, with different regulatory duties for each category. Ofcom determines platform categories based on UK user numbers and platform features.

Category 1 (Option A)

34 million UK users + content recommender system

Category 1 (Option B)

7 million UK users + recommender + sharing functionality

Category 2A (Search engines)

7 million UK users (non-vertical search engines)

Category 2B (Messaging)

3 million UK users + direct messaging functionality

Fee threshold (Qualifying Worldwide Revenue)

£250 million qualifying worldwide revenue

Fee exemption

UK revenue less than £10 million

Maximum penalty

10% of global turnover OR £18 million (whichever is greater)

What Platform Categories Mean

Category 1 platforms have the highest duties, including removal of legal but harmful content for adults, transparent complaints procedures, and enhanced protections for journalists and democratic content.

Category 2A (Search) platforms must prevent illegal content appearing in search results and implement child safety measures.

Category 2B (Messaging) services must take measures to prevent illegal content being shared via private messaging.

All UGC platforms (regardless of category) must conduct illegal content risk assessments and implement safety measures to remove illegal content.

Implementation timeline

Key compliance deadlines are staggered. Check which apply to your platform type.

Illegal content risk assessment deadline

16 March 2025

Illegal content safety measures enforceable

17 March 2025

Children's access assessment deadline

16 April 2025

Child safety duties enforceable

25 July 2025

Fee notification window

December 2025 to March 2026

The Online Safety Act 2023 imposes staged compliance obligations on user-generated content platforms. Platforms categorised by Ofcom must complete risk assessments and implement safety measures by specific deadlines, with enforcement powers taking effect from the dates shown.

Ofcom Online Safety guidance (opens in a new tab)

NIS Regulations

Network and information security requirements for digital service providers

NIS applicability

NIS Regulations apply to operators of essential services and relevant digital service providers including cloud, online marketplaces, and search engines.

The Network and Information Systems (NIS) Regulations 2018 apply to operators of essential services (OES) and relevant digital service providers (RDSP).

Small business exemption

Organisations with fewer than 50 employees AND turnover/balance sheet below €10 million are exempt from RDSP obligations

OES sectors

Energy, transport, water, health, digital infrastructure

RDSP services

Online marketplaces, online search engines, cloud computing

Group assessment

If part of larger group, assess group numbers not subsidiary alone

Incident notification

Within 72 hours of discovery

Regulator

Sector-specific Competent Authorities (e.g., Ofgem for energy, ICO for digital services)

NCSC role

UK's single point of contact (SPOC) and computer security incident response team (CSIRT)

Security framework

NCSC Cyber Assessment Framework (CAF) - 14 core principles

OES obligations

Manage risks, prevent incidents, notify Competent Authority of incidents

RDSP obligations

Appropriate security measures, incident notification, comply with CA requests

Penalty maximum

£17 million for most serious breaches

NIS Regulations guidance (opens in a new tab)

Cross-border platform operators

Online Safety Act applies to user-to-user services and search services accessible in the UK, regardless of where your company is based. If you have UK users, you are likely in scope.
Official guidance (opens in a new tab)
E-commerce and consumer rights
Selling software, SaaS, or digital products online triggers specific legal requirements around pre-contract information, cancellation rights, and consumer remedies.

E-commerce regulations for online selling

Legal requirements for selling online including pre-contract information and delivery rules
Consumer rights for digital content

Digital content consumers have different refund rights than physical goods. Ensure your terms and checkout flow handle this correctly.
What is digital content?

Digital content means data produced and supplied in digital form, including:

Software and applications

Music, video, and e-books

Games and in-game content

SaaS and cloud services

Digital downloads

Rights for digital content

Digital content must be:

Satisfactory quality: Meets standard a reasonable person would consider satisfactory (free from bugs, fit for common purposes)

Fit for particular purpose: Suitable for any specific purpose the consumer made known

As described: Matches any description, demonstration, or sample

Consumer remedies

If digital content doesn't meet these standards:

Repair or replacement first: Unlike goods, digital content has no 30-day short-term rejection right - repair/replacement is the first remedy

If repair/replacement fails: Right to price reduction or refund

No 30-day rejection: Digital content remedies differ from physical goods - be aware of this distinction

Compensation for damage

If faulty digital content damages a consumer's device or other digital content, you may be liable for repair or compensation.

Pre-contract information requirements

Before purchase, you must provide:

Main characteristics of the digital content

Functionality and compatibility requirements

Whether ongoing updates will be provided

Total price including taxes

Step 1

Test software thoroughly before release to ensure satisfactory quality

Step 2

Clearly describe functionality, features, and system requirements

Step 3

Provide prominent information about compatibility and device requirements

Step 4

Implement quality assurance processes to identify bugs before release

Step 5

Create clear terms of service explaining update policies and support duration

Step 6

Establish customer support channels for reporting issues

Step 7

Develop procedures for handling refund requests within legal timeframes

Step 8

Include warranty information and consumer rights in purchase confirmation

Step 9

For subscription services, clearly state trial periods and cancellation terms

Step 10

Document all testing and quality control measures

Consumer Rights Act guidance (opens in a new tab)
Distance selling requirements

Understand the 14-day cooling-off period and cancellation rules for digital products

Cooling-off period

Consumers can cancel within 14 days unless they gave explicit consent to immediate digital content download and acknowledged losing cancellation rights.

Cooling-off period

14 days from delivery

Extended period

12 months if cancellation rights not provided

Refund deadline

14 days from receiving returned goods

Return shipping

Customer pays unless seller offers free returns

Restocking fees

ILLEGAL - cannot charge

Deduction for use

Only if customer handled goods beyond checking

Digital content

Cancellation lost if download begins with consent
Managing contractors and IR35
Tech businesses often rely on contractors and freelancers. Getting IR35 wrong can result in significant tax liabilities and penalties.

IR35 off-payroll working rules

Understand off-payroll working rules and who determines employment status

Small company exemption thresholds

Small companies are exempt from making IR35 determinations - the contractor remains responsible. Check if you meet the thresholds.

Annual turnover

Not more than £15 million

Balance sheet total

Not more than £7.5 million

Average employees

Not more than 50

Criteria to meet

2 of 3 thresholds

Assessment period

Previous financial year

Accounting periods from

1 April 2025

IR35 exemption earliest from

6 April 2027 (requires 2 consecutive qualifying years)

Two-year qualification requirement

Company must meet 2 of 3 criteria for both 2025/26 and 2026/27 financial years before IR35 exemption applies

Previous turnover threshold

£10.2 million (before April 2025)

Previous balance sheet threshold

£5.1 million (before April 2025)

Who determines status

Medium and large businesses must determine contractor status and can be liable for tax if determinations are incorrect. Keep detailed records of your reasoning.

Small private sector clients

Contractor (through PSC) determines own status

Medium/large private sector clients

Client must determine status and issue Status Determination Statement (SDS)

Public sector clients

Client always determines status and operates PAYE if inside IR35

Status Determination Statement

Written statement with reasons, required from medium/large clients

Disagreement process

Client must respond to status disagreements within 45 days
Employment status tests

Key factors include personal service, mutuality of obligation, and control. Use HMRC's CEST tool but understand its limitations.
Key tests for determining IR35 status:

Control: Does the client control how, when, and where work is done?

Substitution: Can the contractor send a substitute to do the work?

Mutuality of obligation: Is there obligation to offer work and accept it?

Financial risk: Does the contractor bear financial risk?

Equipment provision: Does the contractor provide own tools/equipment?

Part of organisation: Is the contractor integrated into the client's business?

HMRC status tool

Check Employment Status for Tax (CEST)

Inside IR35

Taxed as employee - PAYE and NI deducted

Outside IR35

Taxed as self-employed business
IR35 compliance documentation

Document your reasoning for each contractor engagement. If HMRC challenges a determination, you need evidence showing you took reasonable care. Consider obtaining professional advice for borderline cases.
Official guidance (opens in a new tab)
Protecting your intellectual property
Your code, designs, and branding are valuable assets. Understanding IP protection helps you defend your work and avoid infringing others' rights.

Software intellectual property

Copyright, patents, and trade secrets for software and technology
Software copyright protection

Copyright protects your source code automatically - no registration needed. But ensure contractor agreements assign IP to your company.
Software automatically receives copyright protection in the UK as soon as you create it. No registration is required and there is no cost.

Your source code is protected as a "literary work" under UK copyright law, giving you exclusive rights to control copying, distribution, and adaptation of your software.

Protection type

Automatic (no registration required)

Classification

Literary work

Cost

£0 (free automatic protection)

Duration (human author)

Life + 70 years from end of calendar year of death

Duration (computer-generated)

50 years from creation

Database rights

Automatic + 15 years from creation

Registration required

None

International protection

Extends internationally through treaties

What copyright protects

Copyright protection applies to:

Source code (in any programming language)

Object code and compiled binaries

Database structures and content

Software documentation

User interfaces (as artistic works)

Copyright does not protect ideas, methods, or algorithms themselves – only the specific expression of them in your code.

Copyright for employees vs contractors

If your employees write code as part of their employment, your company automatically owns the copyright (unless your employment contract states otherwise).

If you hire contractors or freelancers to write code, the contractor owns the copyright by default – must have a written agreement assigning copyright to your company.

Copyright protection guidance (opens in a new tab)
Software patent eligibility

Software patents are possible but must demonstrate a technical contribution beyond the program itself. Patent applications are expensive - consider whether they are justified.
Software can be patented in the UK, but only if it makes a "technical contribution" beyond being a computer program "as such". The UK Intellectual Property Office applies the four-step Aerotel test to determine whether your software invention is patentable.

Pure business methods, mathematical algorithms, and programs that only manipulate data without external technical effect cannot be patented, regardless of how clever or commercially valuable they are.

Basic legal position

Computer programs 'as such' are excluded from patentability

Key requirement

Must demonstrate technical contribution beyond excluded matter

Test applied

Four-step Aerotel test

Assessment principle

Substance not form – what the invention actually achieves matters

Patentable example

✅ Driverless car control software (technical process outside computer)

Patentable example

✅ Image processing algorithms (solve technical problem)

Patentable example

✅ X-ray machine control systems (external technical effect)

Non-patentable example

❌ Chess playing app (non-technical purpose)

Non-patentable example

❌ Trading system business logic (pure business method)

Non-patentable example

❌ Text analysis algorithms (data manipulation without external effect)

Four-step Aerotel test

The UK IPO examines software patent applications using this structured approach:

Properly construe the claims – Determine what monopoly you're actually seeking, focusing on substance not form

Identify the actual contribution – What have you truly added to human knowledge? Compare against prior art

Ask whether contribution falls solely within excluded matter – Does it relate exclusively to mathematical methods, business methods, computer programs as such, mental acts, or aesthetic creations? If yes, it cannot be patented

Check whether contribution is technical – Does it possess technical character going beyond excluded subject matter?

Five AT&T signposts for technical contribution

Your software is more likely to be patentable if it demonstrates one or more of these technical characteristics:

1. External technical process

Does your program solve a technical problem outside the computer? Examples: controlling physical machinery, processing sensor data, optimizing drill bit design.

2. Architecture-level effect

Does your program improve computer operation regardless of what data or applications are running? Examples: operating system improvements, memory management, processor optimization.

3. New computer operation

Does your program make the computer operate in a fundamentally new way, beyond merely running a new program?

4. Efficiency enhancement

Does your program make the computer function more efficiently overall, not just for specific applications?

5. Technical problem solution

Does your invention solve (not circumvent) a genuine technical problem, either internal or external to the computer?

Non-technical contributions (cannot be patented)

Pure business methods implemented on a computer (e.g., trading systems, accounting methods)

Improved algorithms for mathematical operations (e.g., faster square root calculation)

Data manipulation without external effect (e.g., text analysis, document storage formats)

Generic "makes computer work better" claims without demonstrated technical improvement

User interface designs based purely on aesthetic or usability preferences

The mere presence of a computer does not make an invention technical. The contribution must go beyond implementing a known process on standard computer hardware.

Manual of Patent Practice - Section 1: Patentability (opens in a new tab)

Guidelines for examining AI patent applications (opens in a new tab)
Protect your intellectual property

Comprehensive guide to trademarks, patents, and design rights
Trademark registration

Register your brand name and logo as trademarks. At GBP 170 for 10 years, this is affordable essential protection.
A trademark protects your brand identity - including business names, logos, slogans, sounds, and colours. Registration gives you exclusive rights to use your trademark for the goods and services you register it for, and the right to take legal action against anyone who uses it without permission.

Application fee (1 class) — from 1 April 2026

£205 (was £170 before 1 April 2026)

Each additional class — from 1 April 2026

+£60 per class (was +£50 before 1 April 2026)

Examination period

Approximately 2 months

Opposition period

2 months after publication

Total registration time

3 to 4 months if no objections

Protection duration

10 years from filing date

Renewal fee (1 class) — from 1 April 2026

£245 every 10 years (was £200 before 1 April 2026)

Renewal fee additional classes — from 1 April 2026

+£60 per class (was +£50 before 1 April 2026)

Important considerations
Use it or lose it: You must use your trademark within 5 years of registration or it can be cancelled for non-use.
UK protection only: UK registration only protects your mark in the UK. For EU protection, apply for an EU trademark. For international protection, consider the Madrid Protocol system.
Professional advice: Consider using a trademark attorney for complex applications, especially if your mark is similar to existing marks or covers multiple classes.
Objections are common: Around 60% of applications receive at least one objection from the examiner. Most can be resolved by amending the application or providing arguments.

Register a trademark (opens in a new tab)
Software licensing compliance

Ensure you comply with open source and third-party software licences

Open source licence review

Review third-party licence terms before incorporating open source code. Some licences (GPL, AGPL) have copyleft provisions that could affect your entire codebase. Consider using tools to audit your dependencies.
Cybersecurity requirements
Beyond being good practice, cybersecurity is increasingly a legal and commercial requirement. Cyber Essentials is mandatory for many government contracts.

Cyber security requirements

Legal requirements and best practices for protecting your business and customer data

Cyber Essentials certification

Two certification levels: basic (self-assessment from around GBP 300) and Plus (external testing from around GBP 1,500). Valid for 12 months.

Cyber Essentials is a government-backed, industry-supported scheme to help organisations protect against common online threats. The scheme helps protect against almost all cyber threats and is administered by the National Cyber Security Centre (NCSC).

Over 215,000 certificates have been awarded, with 49,248 issued in the past 12 months. Organisations implementing the controls see a 92% reduction in insurance claims.

Certificate validity

12 months (annual renewal required)

Basic level process

Self-assessment questionnaire reviewed by Certification Body (1-3 business days)

Plus level process

First obtain basic certification, then technical audit with authenticated vulnerability scanning

Plus includes

Authenticated vulnerability scanning, configuration checks, validation of all five controls

Current question set

Danzell, effective 27 April 2026

Previous question set

Willow, effective 28 April 2025 and now superseded

Accreditation body

IASME (sole accreditation body since April 2020)

Number of Certification Bodies

Over 350 across UK and Crown Dependencies

Government contract requirement

Mandatory for suppliers bidding on certain public sector contracts involving personal data or ICT services
Five technical controls

Cyber Essentials focuses on five technical controls that prevent most common attacks.
Cyber Essentials certification addresses five core technical controls that help protect against almost all cyber threats:

Firewalls and Internet Gateways: Establish boundaries between your organisation and the internet. Properly configured firewalls on all internet connections with default deny policy for incoming connections.

Secure Configuration: Remove unnecessary accounts and software, disable insecure defaults, lock unattended devices. Change default passwords, implement automatic screen locking (maximum 10 minutes).

Access Control: Manage user accounts, enforce unique credentials, use multi-factor authentication (MFA) for cloud services. MFA mandatory for administrator accounts, remote access, and cloud services handling sensitive data.

Malware Protection: Protect devices from malware using anti-malware software. Automatic updates enabled, regular scans configured, email scanning for attachments and links.

Security Update Management: Apply security updates within 14 days of release for critical patches. Automatic updates enabled where possible, documented approach for legacy systems.

Control 1: Firewalls and Internet Gateways

Default deny policy, only necessary services exposed, regular review of firewall rules

Control 2: Secure Configuration

Disable unnecessary accounts/software/services, change default passwords, auto-lock after 10 minutes maximum

Control 3: Access Control

Unique user accounts, strong passwords, MFA for admin/remote/cloud, least privilege principle

Control 4: Malware Protection

Anti-malware on all devices, automatic updates, regular scans, email scanning

Control 5: Security Update Management

Apply critical patches within 14 days, automatic updates enabled, documented approach for unsupported software

MFA mandatory for

Administrator accounts, remote access, cloud services handling sensitive data

Screen lock maximum timeout

10 minutes

Security update timeline

Within 14 days for high-risk vulnerabilities
Cyber Essentials certification

Get certified to demonstrate security standards and win government contracts

Cyber incident reporting

Know who to report incidents to. Report data breaches to ICO within 72 hours if they pose a risk to individuals.

Different cyber incidents require reporting to different authorities. All UK organisations should know their reporting obligations and have key contacts readily available.

Cyber crime reporting (England, Wales, NI)

Report Fraud (formerly Action Fraud) - reportfraud.police.uk or 0300 123 2040

Cyber crime reporting (Scotland)

Police Scotland via 101 (Scotland has not signed up to Report Fraud process)

Report Fraud phone hours

Monday-Friday 8am-8pm (24/7 for organisations under live attack)

Report Fraud from abroad

+44 300 123 2040

Data breach reporting (all UK)

ICO at ico.org.uk/for-organisations/report-a-breach (within 72 hours if risk to individuals)

ICO helpline

0303 123 1113 (Monday-Friday 9am-5pm)

Phishing email reporting

NCSC Suspicious Email Reporting Service (SERS) - forward to report@phishing.gov.uk

NCSC Cyber Incident Response (CIR) Scheme

Industry assurance scheme - all UK organisations should use CIR Assured Service Provider when dealing with cyber incidents

NHS organisations (NIS OES in England)

Report to NHS England within 72 hours for incidents with adverse effect on security or significant impact on service continuity

Financial services firms

Report to FCA/PRA as per firm's notification procedures

Operators of Essential Services

Report to sector regulator within 72 hours

Digital service providers

Report to ICO within 72 hours if substantial impact

Under active cyber attack (need help)

NCSC at ncsc.gov.uk and CIR provider immediately

What Report Fraud cannot do

Not investigative body, cannot guarantee police investigation or advise on report contents

Why report even if not investigated

Builds intelligence picture, identifies patterns, informs national policing priorities

Government contract requirements

Cyber Essentials Plus is increasingly required for government contracts handling sensitive data. Consider certification as a competitive advantage even if not yet required.
Official guidance (opens in a new tab)
AI regulation and emerging technology

The UK takes a pro-innovation, sector-specific approach to AI regulation. However, existing laws (GDPR, Equality Act, consumer protection) apply to AI systems.

AI regulation framework

Current UK approach to AI regulation and the five principles framework

UK AI five principles

UK regulators apply these five principles proportionately across sectors. No single AI-specific law, but existing laws apply.

The UK government's AI regulatory framework is based on five cross-cutting principles that existing sector regulators must apply within their remits. These principles were established in the March 2023 White Paper and confirmed in the February 2024 consultation response.

The principles are not currently on a statutory footing. Regulators are expected to apply them but are not legally required to do so. The government has announced that a comprehensive AI Bill (expected second half of 2026) may place these principles on a statutory basis.

Principle 1

Safety, security and robustness — AI systems should function in a robust, secure and safe way throughout their lifecycle

Principle 2

Appropriate transparency and explainability — people should be able to access information about AI systems that affect them

Principle 3

Fairness — AI systems should not undermine legal rights, discriminate unfairly, or create unfair market outcomes

Principle 4

Accountability and governance — governance measures should ensure effective oversight with clear lines of accountability

Principle 5

Contestability and redress — people should be able to contest AI outcomes where rights have been violated or harm has occurred

Statutory basis

Non-statutory (regulators expected to apply, not legally required)

White Paper published

29 March 2023

Consultation response

6 February 2024

DSIT regulator support funding

10 million GBP to boost regulator AI capabilities

Automated decision-making under GDPR

While there is no specific AI Act in the UK, automated decision-making affecting individuals triggers GDPR rights including the right to explanation and human review. Ensure your AI systems can provide meaningful explanations.
Official guidance (opens in a new tab)
Export controls for dual-use technology
Exporting certain technology, software, and cryptographic products may require a licence. This includes dual-use items with potential military applications.

Export control for dual-use technology

When you need an export licence for technology and software
Tech export controls

Dual-use controls cover encryption software, cyber-surveillance tools, and technology with potential military applications.
Controlled items

You need an export licence for:

Cryptography: Encryption software exceeding certain key lengths (56-bit symmetric, 512-bit asymmetric thresholds, with exceptions for mass-market products)

Intrusion software: Tools designed to avoid detection by monitoring tools or defeat protective countermeasures

Surveillance technology: Interception, monitoring, or forensic analysis tools

Dual-use technology: Software/tech with potential military applications (network analysis, cybersecurity tools beyond certain thresholds)

Technology transfer: Technical data, blueprints, know-how for developing controlled items

What counts as export?

Export includes:

Physical export from the UK

Electronic transmission to persons outside the UK (including cloud storage)

Making technology available to non-UK nationals in the UK

Providing services enabling use of controlled items abroad

Mass-market cryptography exemption

Generally available encryption products sold through retail channels without restriction may be exempt, but you must submit a classification request for confirmation.

Open source exemption

Cryptographic software in the public domain (open source) may be exempt, but notification to Export Control Joint Unit may be required.

Embargoed destinations

Additional restrictions apply for exports to sanctioned countries (Russia, Belarus, Iran, North Korea, Syria, etc.). Check current sanctions before any export.

Step 1

Review your software and technology against the dual-use list in Annex I of the Export Control Order

Step 2

For cryptography, determine key lengths and whether products qualify as mass-market

Step 3

Submit classification requests to Export Control Joint Unit if uncertain

Step 4

For controlled items, apply for export licence before shipping or transmitting

Step 5

Check destination country against current UK sanctions lists

Step 6

Implement internal compliance procedures to screen customers and destinations

Step 7

Train staff on export control obligations, especially sales and technical teams

Step 8

Maintain records of export licence applications and decisions

Step 9

For cloud services, consider data residency implications

Step 10

If open source, determine if notification to ECJU is required

Export controls for technology (opens in a new tab)
UK export licensing controls

Understanding UK strategic export controls and the licensing process

Export control penalties

Exporting controlled technology without a licence is a criminal offence. Penalties include unlimited fines and up to 10 years imprisonment.

Maximum imprisonment

10 years for criminal conviction

Criminal fines

Unlimited

Civil penalties

Up to 3 times value of goods (record: £1.16 million in 2025)

Enforcement authority

HMRC (criminal) and Export Control Joint Unit (licensing)

Voluntary disclosure benefit

50-70% penalty reduction if you self-report immediately

Export control breaches are taken extremely seriously. Recent enforcement shows million-pound penalties are increasingly common, with the record £1.16 million civil settlement in 2025 described as a 'wake up call for UK exporters'.
HMRC has primary enforcement responsibility and can offer compound settlements (civil penalties) as alternative to criminal prosecution. The Export Control Joint Unit conducts compliance inspections with statutory rights to review your export records.

ECJU contact for compliance advice (opens in a new tab)

Export control red flags

Know the warning signs that suggest diversion to end-users of concern.

Customer red flags
• Reluctance to provide end-use information or vague responses
• Unfamiliarity with product technical details
• Requests for unusual specifications
• Willingness to pay significantly above market price
• Requests for non-standard shipping or routing
• No established business in relevant sector
• Located in high-risk jurisdiction
• Previous export control violations
Transaction red flags
• Ship to freight forwarder instead of end-user
• Request for labeling inconsistent with end-use
• Requests to falsify documents
• Cash payments or unusual financial arrangements
• Multiple intermediaries without clear reason
• Last-minute destination changes
• Secrecy about final destination
Product red flags
• Orders inconsistent with customer's business
• Quantities inconsistent with stated use
• Equipment beyond customer's technical capacity
• Discussion of controlled items without mentioning licensing

Export control compliance (opens in a new tab)

Encryption software controls

Strong encryption software may require export licences. The UK Control List includes cryptographic items at Category 5. Check before exporting security software to any destination.
Official guidance (opens in a new tab)
Ongoing compliance and growth
As your tech business grows, compliance requirements change. Monitor thresholds for VAT, audit exemptions, and enhanced regulatory obligations.
Company size thresholds

Company size determines audit requirements, IR35 responsibility, and other obligations. New thresholds apply from April 2025.
From 6 April 2025 (for financial years beginning on or after this date), the thresholds that determine whether your company is 'micro', 'small', or 'medium' are changing. These classifications affect audit exemption, abbreviated accounts eligibility, and IR35 off-payroll working rules.

Micro-entity (April 2025)

Turnover ≤£1m, Balance sheet ≤£500k, Employees ≤10

Small company (April 2025)

Turnover ≤£15m, Balance sheet ≤£7.5m, Employees ≤50

Medium company (April 2025)

Turnover ≤£54m, Balance sheet ≤£27m, Employees ≤250

Large company

Exceeds medium company thresholds

OLD thresholds (until April 2025):
Micro - Turnover ≤£632k, Balance sheet ≤£316k, Employees ≤10
Small - Turnover ≤£10.2m, Balance sheet ≤£5.1m, Employees ≤50
Medium - Turnover ≤£36m, Balance sheet ≤£18m, Employees ≤250
NEW thresholds (from April 2025):
Micro - Turnover ≤£1m (+58% increase), Balance sheet ≤£500k (+58%), Employees ≤10 (same)
Small - Turnover ≤£15m (+47% increase), Balance sheet ≤£7.5m (+47%), Employees ≤50 (same)
Medium - Turnover ≤£54m (+50% increase), Balance sheet ≤£27m (+50%), Employees ≤250 (same)

To determine your company size, you must meet 2 out of 3 thresholds for 2 consecutive years.
For example, a company with £12m turnover, £4m balance sheet, and 45 employees meets all three small company thresholds, so qualifies as 'small' (from second year onwards).

What size classification affects:
1. Audit exemption:
Micro and small companies: EXEMPT from statutory audit (unless excluded, for example financial services, charity)
Medium and large companies: MUST have statutory audit
Many more companies will qualify for audit exemption from April 2025 due to higher thresholds
2. Abbreviated accounts:
Micro-entities: Can file simplified micro-entity accounts with Companies House
Small companies: Can file abridged balance sheet (no profit & loss statement required publicly)
Important - paused filing reform: the proposed requirement for small companies and micro-entities to file profit and loss accounts was paused in January 2026 and has no confirmed commencement date
Medium companies: Must file full accounts
3. IR35 off-payroll working rules:
Small companies (under new thresholds): EXEMPT from IR35 off-payroll rules for contractors/PSCs
Medium and large companies: MUST apply IR35 determinations and operate off-payroll working rules
Delayed effect: IR35 status depends on meeting the CA2006 size test for 2 consecutive financial years, so a company only gains exemption once its size classification changes under the new thresholds - in practice this means the earliest affected tax year is 2027/28, not April 2025

IR35 impact example:
Company with £14m turnover, £6m balance sheet, 40 employees
Under old rules - exceeded the £10.2m turnover threshold, so caught by IR35 off-payroll rules
Under new rules - below the £15m turnover threshold, so would qualify as 'small' and exempt from IR35
Because IR35 status depends on meeting the size test for 2 consecutive financial years, this company will not actually become exempt until it has met the new 'small' thresholds for 2 consecutive years - the earliest practical impact is the 2027/28 tax year, not April 2025

Directors' report requirements:
Micro-entities: NOT required to file directors' report
Small companies: Must prepare directors' report but NOT file it publicly (can file abridged version)
Paused reform: the proposed public filing requirement for small-company directors' reports was paused in January 2026 and has no confirmed commencement date
Medium and large companies: Must file full directors' report publicly

Transition from old to new thresholds:
New thresholds apply to financial years beginning on or after 6 April 2025
Example: Company with December year-end (ending 31 Dec 2025) uses OLD thresholds (financial year began Dec 2024)
Example: Company with June year-end (ending 30 June 2026) uses NEW thresholds (financial year began July 2025)

Legal basis: Companies Act 2006 (as amended by The Companies (Accounts and Reports) (Amendment and Transitional Provision) Regulations 2024 (SI 2024/1303)). IR35 exemption: Chapter 10, Part 2, ITEPA 2003.
Official source: gov.uk/annual-accounts
Win public sector contracts

Access government contracts - requires Cyber Essentials and other certifications

Annual compliance calendar

Set calendar reminders for annual compliance tasks: ICO registration renewal, Cyber Essentials recertification, reviewing your data protection practices, and filing deadlines. Proactive compliance is cheaper than reactive firefighting.

Run a tech business

Data protection and privacy compliance

Electronic marketing and cookie compliance

Digital service regulations

E-commerce and consumer rights

Managing contractors and IR35

Protecting your intellectual property

Cybersecurity requirements

AI regulation and emerging technology

Export controls for dual-use technology

Ongoing compliance and growth

Related journeys

Grow your tech business

Start a fintech business

Meet your data protection obligations

Online Safety Act compliance quick check