The AI regulation UK firms already face, and where the EU AI Act reaches

Your largest customer's due diligence questionnaire has a new section on AI. It asks what AI regulation UK firms like yours must follow, and how you comply. Someone on the team says the UK has no AI law yet. They are half right, and the half they missed is the half the customer cares about.

The UK has no AI Act and, as of October 2026, no government AI bill. Existing regulators apply five cross-sector principles instead. AI is still regulated: by data protection law, with new automated decision-making rules since 5 February 2026, by sector rules such as the FCA's Consumer Duty, and by the EU AI Act for firms selling into the EU.

This guide is for founders, CTOs and security leads at UK B2B tech firms that have shipped AI features and sell to regulated buyers. It maps each route to its trigger, its enforcer and the evidence a customer will ask you for, then shows how one governance system answers all three.

What is the UK's approach to AI regulation?

The UK regulates AI through existing regulators applying five cross-sector principles, not through a dedicated AI law. The 2023 white paper set out the principles and chose not to put them on a statutory footing initially. The February 2024 government response kept that approach. As of October 2026, no government AI bill has followed.

The 2023 white paper names the five principles:

• safety, security and robustness;
• appropriate transparency and explainability;
• fairness;
• accountability and governance;
• contestability and redress.

The white paper says the government "will not put these principles on a statutory footing initially". The February 2024 government response kept regulators in the lead, while making the case for future targeted binding requirements on developers of highly capable general-purpose AI models.

The most recent signal is the King's Speech of 13 May 2026. It announced a Regulating for Growth Bill and a Cyber Security and Resilience Bill, and no AI bill. The government's Regulation Action Plan progress report (July 2026) says the Regulating for Growth Bill will introduce "new cross-economy sandbox powers", and that those powers will enable an "AI Growth Lab" sandbox. That is a route to test AI under modified rules, not a new set of obligations.

Private members' AI bills appear in Parliament from time to time. They are not government policy, and none of them changes what applies to you today.

No AI Act is not the same as no AI law.

What AI regulation UK firms already face: the three routes

AI regulation reaches a UK tech firm by three routes: UK law that already covers AI, such as data protection and equality law; sector rules that regulated customers pass down to their suppliers; and the EU AI Act wherever your AI is sold or used in the EU. Each route has its own trigger, enforcer and evidence request.

The table below maps each route. The last column is our view of what a regulated customer typically asks a supplier for, not a list taken from any regulator.

The FCA and PRA rows are the easiest to miss, because the regulator never writes to you. Your customer does, through its supplier questionnaire and contract.

How does UK data protection law regulate AI decisions?

UK data protection law regulates AI most directly through Articles 22A to 22D of the UK GDPR, inserted by section 80 of the Data (Use and Access) Act 2025 and in force since 5 February 2026. Where a significant decision about a person is taken solely by automated processing, the controller must put specific safeguards in place.

What do Articles 22A to 22D require?

Article 22A sets the test. A decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision". It is significant if it has a legal or similarly significant effect on the person. SI 2026/82 commenced section 80 on 5 February 2026, for decisions taken from that date.

Article 22C then requires safeguards. The person must be able to:

1. get information about decisions taken about them;
2. make representations about those decisions;
3. obtain human intervention from the controller;
4. contest the decision.

Article 22B adds tighter limits where the decision relies on special category data, such as health data. Those decisions may not be solely automated unless the person has given explicit consent, or a contract or legal condition applies together with the substantial public interest ground.

The shift matters. The old Article 22 gave people a right not to be subject to solely automated decisions, with exceptions. The new articles keep outright limits only for special category data and for decisions that rely on recognised legitimate interests. Everywhere else they set safeguards, which makes the evidence you hold the real test.

A human who clicks "approve" on every recommendation is not meaningful human involvement.

What is the ICO's AI code of practice?

The ICO's AI code of practice is a statutory code the Information Commissioner must now prepare. SI 2026/425, in force since 12 May 2026, says the Commissioner "must prepare an appropriate code of practice" on processing personal data when developing and using AI and for automated decision-making.

Until that code is issued, the ICO's guidance on AI and data protection remains the reference, but it carries a notice that it "is under review" after the Data (Use and Access) Act. The ICO's AI and biometrics strategy commits to a statutory code, and focuses its work on automated decision-making in recruitment and public services.

Where does the Equality Act 2010 apply to AI?

The Equality Act 2010 applies to AI in the same way it applies to any decision: the Act does not ask whether a person or a system made the call. If an AI-assisted hiring, pricing or eligibility decision produces discriminatory outcomes for people with protected characteristics, the organisation using it is answerable.

For a supplier, the exposure usually arrives through the customer. A customer that faces a discrimination claim will ask what testing you did, and the contract will often say who carries the cost.

How does the FCA regulate AI?

The FCA does not plan AI-specific rules. Its AI approach page, last updated 2 October 2026, says: "We do not plan to introduce extra regulations for AI." Instead, the FCA relies on existing frameworks, chiefly the Consumer Duty and the Senior Managers and Certification Regime (SM&CR).

Under the Consumer Duty, firms must design products and services that meet the needs of their target customers and provide fair value, communicate in a way that meets customers' information needs, and provide support that meets those needs. If your AI is part of a regulated firm's customer journey, its outcomes become that firm's Consumer Duty outcomes. SM&CR puts a named senior manager on the hook for them.

Two recent FCA developments show where expectations are heading:

• The Mills Review. Published on 6 July 2026, the Mills Review looked at how AI could reshape retail financial services by 2030. It made seven recommendations to the FCA Board and Executive, including monitoring the move to autonomous models and laying the foundations for agentic finance.
• AI Live Testing. The FCA's AI Live Testing service helps selected firms live test AI applications and work through risk management and live monitoring. Its second cohort, announced on 21 April 2026, includes Barclays, Experian and UBS.

Neither creates new rules for suppliers. Both tell you what your financial services customers will be asked about, and so what they will ask you.

How does PRA SS1/23 reach a supplier's AI model?

PRA SS1/23 sets the Prudential Regulation Authority's model risk management expectations for banks. It applies to all models used to inform business decisions, "whether developed in-house or externally (including vendor models)", and covers AI and machine learning techniques. If a bank uses your AI to inform decisions, your model can sit inside its model risk framework.

The supervisory statement is addressed to UK-incorporated banks, building societies and PRA-designated investment firms with internal model approval for regulatory capital. Its current version was published on 23 April 2026.

For a supplier, the practical effect is documentation. A bank customer will want to know what your model does, what data trained it, how it was validated and how you will tell them when it changes.

A customer's model inventory does not stop at its own front door.

When does the EU AI Act apply to a UK firm?

The EU AI Act applies to a UK firm that places AI systems on the EU market, or whose AI output is used in the EU, regardless of where the firm is established. Brexit does not remove that reach. A UK SaaS firm whose AI reaches EU customers is likely in scope for part of the Act.

Article 2 of the EU AI Act covers providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country". It also covers providers and deployers outside the EU "where the output produced by the AI system is used in the Union".

The timetable moved in 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, sets the date of application for high-risk systems listed in Annex III at 2 December 2027. Annex III includes uses close to UK financial services, such as creditworthiness assessment and risk assessment and pricing for life and health insurance. High-risk systems tied to products under Annex I follow on 2 August 2028.

This page stops at scope. For the risk tiers and obligations, see our EU AI Act overview. For what a SaaS provider has to do, see our guide to EU AI Act compliance for SaaS.

Which voluntary UK instruments are worth evidencing?

Two voluntary instruments are worth evidencing for UK AI regulation: the government's AI Cyber Security Code of Practice and the international management system standard ISO/IEC 42001:2023. Neither is legally required. Both give a regulated customer something concrete to assess, which is what a questionnaire is really asking for.

• The AI Cyber Security Code of Practice. Published by the government on 31 January 2025, the code sets out "baseline cyber security principles to help secure AI systems and the organisations which develop and deploy them". It is not legislation, but it gives your security answers a UK reference point.
• ISO/IEC 42001:2023. The international standard for an AI management system. No UK law requires it. We recommend it because one system of policies, risk assessments, controls and reviews can produce the evidence all three routes ask for, rather than a separate answer for each.

One instrument has dropped out. The government consulted on an AI Management Essentials self-assessment tool, but its February 2026 response says "DSIT will not be publishing AIME". Do not cite it as live guidance.

A governance system you can show beats a legal opinion you cannot share.

What should you do this quarter?

This quarter, find where your AI touches decisions about people, map each customer to the routes that apply, and build the evidence once, so every questionnaire draws on the same record. The steps below take a lean team from an unanswered questionnaire to a repeatable position.

1. List your AI features. Record what each one does, what data it uses and whether it makes or supports decisions about people.
2. Flag solely automated significant decisions. For each, check the Article 22C safeguards: information, representations, human intervention and a way to contest.
3. Map customers to routes. Note which customers are FCA-regulated, which are PRA-regulated banks, and which use your AI in the EU.
4. Prepare a model pack. Write one short document per AI feature covering purpose, training data, testing, known limits and change notice. Bank and insurer questionnaires draw on the same facts.
5. Test for unfair outcomes. Decide how you test for discriminatory outcomes, how often, and who signs off the results.
6. Name an owner. Give one person accountability for AI governance and for tracking changes, such as the ICO code and the EU dates. Our guide to regulatory change management sets out a lean way to do it.

Common mistakes

The common mistakes with UK AI regulation come from reading "no AI Act" as "no obligations", or from answering each customer's questions from scratch. Each one shows up later as a stalled deal or a contract clause you cannot meet.

• Waiting for a UK AI bill. The rules that reach you already exist. A future bill may add to them; it will not switch them on.
• Treating the regulator as the only audience. For a supplier, the FCA and PRA expectations arrive through customers. Your evidence has to satisfy their reviewers, not just the law.
• Assuming Brexit keeps the EU AI Act out. Article 2 reaches output used in the EU. Check where your customers deploy your AI, not just where you are based.
• Writing a policy instead of a record. A policy shows intent. A customer asking about AI accountability wants to see who owns each system and what they checked.

Frequently asked questions