Journey

Start using AI responsibly in your business

End-to-end learning path for businesses adopting AI: understanding the regulatory landscape, assessing obligations, setting up governance, managing specific risks around data, bias, and transparency, and maintaining ongoing compliance.

Running a Business Updated 15 September 2026

8 milestones references 8 guides

Why AI regulation matters for your business

Artificial intelligence is transforming how businesses operate, from customer service chatbots to automated hiring tools and financial risk models. But AI adoption brings regulatory responsibilities. The UK does not yet have a single AI Act, but existing laws on data protection, equality, consumer protection, and sector-specific regulation all apply to AI systems.

This learning path takes you from understanding the regulatory landscape through to verifying ongoing compliance with AI-specific obligations.

Understand the UK AI regulatory landscape

The UK government's approach to AI regulation is principles-based and sector-led. Rather than a single AI regulator, existing regulators apply five cross-cutting principles within their domains. Understanding this framework is your starting point.

The five AI regulation principles

The UK framework rests on five principles that all regulators must apply: safety and robustness, transparency and explainability, fairness, accountability and governance, and contestability and redress. These shape how every regulator assesses AI use in their sector.

The UK government's AI regulatory framework is based on five cross-cutting principles that existing sector regulators must apply within their remits. These principles were established in the March 2023 White Paper and confirmed in the February 2024 consultation response.

The principles are not currently on a statutory footing. Regulators are expected to apply them but are not legally required to do so. The government has announced that a comprehensive AI Bill (expected second half of 2026) may place these principles on a statutory basis.

Principle 1

Safety, security and robustness — AI systems should function in a robust, secure and safe way throughout their lifecycle

Principle 2

Appropriate transparency and explainability — people should be able to access information about AI systems that affect them

Principle 3

Fairness — AI systems should not undermine legal rights, discriminate unfairly, or create unfair market outcomes

Principle 4

Accountability and governance — governance measures should ensure effective oversight with clear lines of accountability

Principle 5

Contestability and redress — people should be able to contest AI outcomes where rights have been violated or harm has occurred

Statutory basis

Non-statutory (regulators expected to apply, not legally required)

White Paper published

29 March 2023

Consultation response

6 February 2024

DSIT regulator support funding

10 million GBP to boost regulator AI capabilities

UK AI regulation overview

How the UK regulates AI, the pro-innovation framework, five cross-cutting principles, and how they compare to the EU AI Act.
Identify which regulators apply to you

Multiple regulators may have jurisdiction over your AI use depending on your sector, what the AI does, and who it affects. A recruitment AI tool, for example, could fall under the ICO, the EHRC, and a sector regulator simultaneously.

Which regulators oversee AI

The ICO covers all AI that processes personal data. The EHRC covers AI decisions that could discriminate. The FCA, Ofcom, CMA, and sector regulators apply additional rules within their remits. Most businesses using AI will answer to at least two regulators.

The UK does not have a single AI regulator. Instead, existing sector regulators apply the five AI principles within their remits. The key regulators with AI jurisdiction are listed below.

ICO (Information Commissioner's Office)

AI and data protection — lawful basis, DPIAs, automated decision-making, transparency. Developing statutory AI code of practice. Max fine: 17.5 million GBP or 4% of global turnover

FCA (Financial Conduct Authority)

AI in financial services — Consumer Duty, SM&CR senior manager accountability, operational resilience, model risk management. Max fine: unlimited

CMA (Competition and Markets Authority)

AI and competition — foundation models review, Strategic Market Status regime for AI platforms, merger investigations for AI deals. Max fine: 10% of global turnover (digital markets)

Ofcom (Office of Communications)

AI and online safety — AI-generated content duties, algorithmic recommendation transparency, AI chatbot regulation under Online Safety Act. Max fine: 10% of qualifying worldwide revenue

MHRA (Medicines and Healthcare products Regulatory Agency)

AI medical devices — AI as Medical Device (AIaMD) and Software as Medical Device (SaMD) registration and post-market surveillance. Max fine: unlimited (criminal offence)

EHRC (Equality and Human Rights Commission)

AI and equality — algorithmic discrimination under Equality Act 2010, AI bias in recruitment, Public Sector Equality Duty for AI

HSE (Health and Safety Executive)

AI workplace safety — risk assessments for AI systems, Market Surveillance Authority for AI products under PRMA 2025. Max fine: unlimited

DSIT (Department for Science, Innovation and Technology)

Central AI policy coordination, AI Opportunities Action Plan, AI and copyright report obligation

AI Security Institute

Frontier AI model safety evaluations (voluntary), security risk research, Inspect testing platform. Directorate of DSIT

DRCF coordination

ICO + CMA + Ofcom + FCA coordinate on cross-cutting AI issues via the Digital Regulation Cooperation Forum

Which AI regulator applies to your business

How to determine which regulators have jurisdiction over your AI use, based on your sector, data processing, and the decisions your AI makes.
Assess your AI obligations

Before deploying AI, assess what obligations apply. If your AI processes personal data, a Data Protection Impact Assessment is likely mandatory. The nature and risk level of your AI system determines how extensive your compliance obligations are.

AI and data protection impact assessments

The ICO expects a DPIA for any AI system that processes personal data for profiling, automated decision-making, or large-scale processing. A DPIA must be completed before deployment, not after. Failure to conduct one where required is itself a regulatory breach.

A Data Protection Impact Assessment (DPIA) is mandatory for AI systems that process personal data in ways likely to result in high risk to individuals' rights and freedoms. The ICO provides AI-specific DPIA guidance.

When mandatory

AI processing involving profiling, large-scale processing of special category data, systematic monitoring of public areas, or automated decision-making with legal/significant effects

AI-specific considerations

Algorithmic fairness, training data quality and representativeness, model accuracy and error rates, explainability, automated decision safeguards, data minimisation in training

ICO risk toolkit

AI and data protection risk toolkit provides structured assessment framework for AI-specific DPIAs

Timing

Must be conducted before AI processing begins — not retrospectively

Consultation

Must consult the ICO if DPIA indicates high risk that cannot be mitigated

Review

DPIAs must be kept under review — reassess when AI system changes significantly (new training data, model updates, expanded use)

AI compliance assessment

How to assess your AI obligations, conduct a DPIA for AI systems, and determine the risk level of your AI deployment.
Set up AI governance

Effective governance means assigning clear accountability for AI decisions, establishing review processes, and documenting how your AI systems work. This is not optional: regulators expect you to demonstrate governance, not just claim it.

AI governance framework

How to establish AI governance in your organisation: accountability structures, risk management, documentation, and ongoing monitoring.
Manage transparency and explainability

People affected by AI decisions have a right to understand how those decisions are made. Transparency requirements apply under UK GDPR, consumer protection law, and sector-specific rules.

AI transparency and explainability

How to meet transparency obligations: explaining AI decisions to affected individuals, documenting model logic, and providing meaningful information about automated processing.
Address bias and equality

AI systems can embed and amplify existing biases, leading to discriminatory outcomes. The Equality Act 2010 applies to AI decisions just as it does to human ones. You must test for bias and take steps to mitigate it.

AI and equality: managing bias

How the Equality Act applies to AI, bias testing requirements, protected characteristics, and practical steps to identify and reduce algorithmic discrimination.
Understand copyright considerations

Using AI to generate content or training AI on existing material raises copyright questions. The legal position in the UK is evolving, and businesses need to manage intellectual property risk on both the input and output sides.

AI and copyright

UK copyright law as it applies to AI-generated content, training data, and intellectual property ownership. Covers the current legal position and risk mitigation.
Maintain ongoing compliance

AI compliance is not a one-off exercise. Models drift, regulations evolve, and new risks emerge. Embed regular reviews, maintain audit trails, and stay current with regulatory guidance from each regulator that oversees your AI use.

AI compliance checklist

Ongoing compliance checklist covering data protection, transparency, bias monitoring, governance reviews, record keeping, and regulatory reporting.

Take note

The EU AI Act may also apply to you. If your AI systems affect people in the EU, or you supply AI products or services into the EU market, the EU AI Act obligations may apply regardless of where your business is based. Check whether your AI has EU-facing exposure.

You have completed this learning path

You now understand the key steps to using AI responsibly and compliantly. Your priorities are:

Map which regulators have jurisdiction over your AI use
Conduct a Data Protection Impact Assessment before deploying AI that processes personal data
Establish governance structures with clear accountability for AI decisions
Meet transparency obligations so people can understand AI decisions that affect them
Test for bias and document your mitigation steps
Embed ongoing compliance monitoring as your AI systems and the regulatory landscape evolve

The guides signposted in this journey provide the detailed procedures for each step. The regulatory landscape for AI is developing rapidly, so revisit these guides regularly to stay current.

Start using AI responsibly in your business

Why AI regulation matters for your business

Understand the UK AI regulatory landscape

Identify which regulators apply to you

Assess your AI obligations

Set up AI governance

Manage transparency and explainability

Address bias and equality

Understand copyright considerations

Maintain ongoing compliance

You have completed this learning path

Related journeys

AI compliance quick check

Responding to an AI regulatory investigation

Using AI in recruitment safely

Run a tech business