UK AI Law in Practice: What Businesses Must Do Now, Checklist Included

What UK AI law means for a firm like yours

Picture a 120-person recruitment and customer-service business. It runs an AI tool that screens CVs and a chatbot that answers customer queries, and a few of its clients are in the EU. Someone in the leadership team asks what law covers all this. This guide follows that firm through each section.

The short answer is that the UK has no single AI Act in force. The rules that apply come from existing law, applied by existing regulators according to how you use the AI. For the firm above, that means data protection and equality law for the CV screener, and data protection, consumer law and in some cases the Online Safety Act for the chatbot. The AI agents and UK GDPR page covers the data protection side in more depth.

Legislation for the most powerful AI models has been signalled but has not arrived. Proposals such as the AI Growth Lab, which could let some firms test products under relaxed rules, are consultation ideas, not permission to ignore current duties.

This affects most firms. 30% of UK businesses used at least one AI technology in September 2026, according to ONS.

The guide covers the current legal status, a checklist by use case, real enforcement examples, how the UK compares with the EU AI Act, and a verdict on whether the UK approach is working.

This is general information, not legal advice. Facts were checked on the date of publication, so confirm the current position before relying on it for a specific decision.

Who regulates AI in the UK: five principles, many regulators

The UK has no AI regulator. Instead, regulators that already exist apply a shared set of five principles within their remits, meaning the area each one is legally responsible for. The government's guidance for regulators lists them as safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.

The principles are non-statutory, which means no Act of Parliament backs them. They create no new legal duties, rights or regulator powers. For a business, you cannot be fined for breaching "fairness" as a principle. You can be fined or sued under the laws the principles point to, and each regulator decides how to read them for its sector. Regulator guidance is also not legal approval of what you do.

For our 120-person firm, the regulators that matter most are these:

The ICO is the most active. Its Richard Nevinson said on 8 October 2026 that agent autonomy is no excuse for poor compliance.

The regulators also coordinate through the Digital Regulation Cooperation Forum, which brings together the ICO, CMA, Ofcom and FCA. Your first job is to work out which of these remits your tools touch, then check the existing rules each one enforces.

Six existing laws that already cover your CV screener and chatbot

No AI Act is needed for most of your obligations, because older laws already reach both tools. Here is how each applies to the 120-person firm.

Data protection. Using AI does not exempt an employer from UK GDPR and the Data Protection Act 2018. Applicants' CVs are personal data, so you need a lawful basis and fair, transparent handling. Tell candidates the screener exists and how it affects them. You also need a data protection impact assessment (DPIA), a written check of the risks to people before you start. The ICO lists systematic automated evaluation with significant effects as a trigger, and a CV screener fits.

Automated decisions. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D from 5 February 2026, and its data protection changes were all in force by 19 June 2026. Decisions made solely by a machine, with no human involvement, that significantly affect someone, such as auto-rejecting a candidate, are now allowed in more cases. The old near-ban is gone. The safeguards stayed: you must give information about the decision, let people make representations, offer human intervention and a way to contest it. The relaxation does not cover special category data, such as health or ethnicity, or processing based on recognised legitimate interests. A complaints duty has also applied since 19 June 2026, including acknowledging complaints within 30 days. The ICO's revised guidance on automated decisions was not final at the time of writing. Human review must be real, since the ICO says it should be meaningful and consistent, not a rubber stamp.

Equality Act 2010. A neutral screening rule can be indirect discrimination if it disadvantages a protected group and you cannot objectively justify it. Buying the tool from a vendor does not move that risk away from you as the employer. In a case the EHRC reported, a courier won a payout after problems with automated facial-recognition checks. It was a settlement, not a court ruling.

Consumer protection. Rules on unfair commercial practices, now enforced under the Digital Markets, Competition and Consumers Act 2024, cover chatbots too. Government guidance says businesses stay responsible for customer interactions, even when a third party supplies the agent. If your chatbot invents a refund policy or hides that it is a bot, the liability is yours.

Copyright. The Copyright, Designs and Patents Act 1988 restricts copying protected works without permission, subject to exceptions. If staff feed third-party documents into a tool or publish its output, check you have the right to do so.

Sector rules. If you offered regulated financial services, the FCA says firms remain responsible for consumer outcomes when using AI. A recruiter does not face that, but a client in finance may ask you to meet it.

UK AI law timeline: what is in force and what is only planned

As of 31 October 2026, the UK has no general cross-sector AI Act and no single AI regulator. Each step below is labelled by its legal effect.

• March 2023, white paper (policy). It proposed a context-based, regulator-led approach and created no general compliance duty for businesses.
• February 2024, consultation response (policy). The government kept the regulator-led model and enacted no statutory AI code.
• July 2024, Labour manifesto (promise). It pledged binding regulation for developers of the most powerful AI models. No such law has been passed.
• January 2025, AI Opportunities Action Plan (policy). It is a government plan, not a law that places duties on AI users.
• February 2025, AI Security Institute (rename). The former AI Safety Institute was renamed. It does not regulate your everyday AI use.
• 19 June 2025, Data (Use and Access) Act (law). It received Royal Assent and has commenced in stages. The automated decision-making changes took effect on 5 February 2026. The Information Commission replaced the Information Commissioner on 30 September 2026.
• March 2026, copyright and AI report (policy). It created no new copyright exception or AI transparency duty.
• 13 November 2026, Artificial Superintelligence Bill (proposal). This is a Private Member's Bill, and its second reading is scheduled for that date. It has not passed that stage, and bills of this kind rarely become law.

What this means for you. The only AI-relevant statute that changed your duties is the Data (Use and Access) Act, and it covers personal data, not AI generally. For the 120-person firm, the CV screener and chatbot are governed by data protection, equality and consumer law as they stand. Promised frontier legislation would target model developers, not businesses buying tools. Plan around current law and treat everything else as background.

A compliance checklist for each AI use case

Compliance depends on what the system does, what data it uses and how it affects people, so the same model can trigger different duties in different jobs. Start with the baseline, then add the use case.

Baseline for every use

• Record each AI system and its purpose in one inventory (you cannot assess what you have not listed).
• Name one accountable owner per system (accountability principle).
• Decide whether a DPIA is needed and write down the reason either way. The ICO treats DPIAs as risk-based, and its draft guidance says one will usually be needed for automated decision-making.
• Ask suppliers for testing, bias monitoring and data-handling details (you stay responsible as the deployer).
• Make human oversight real, with someone able to overrule the tool.
• Monitor after launch and keep records (UK GDPR accountability).
• Issue a staff policy. The government's AI Management Essentials tool will not be published, but its accessible draft still works as a prompt list.

1. HR and recruitment screening Laws: UK GDPR, Data (Use and Access) Act, Equality Act. Regulator: ICO, then EHRC.

• Check whether any hiring-stage decision is significant and solely automated. If so, give the safeguards: information, a way to make representations, human intervention and a way to contest.
• Test for discriminatory outcomes (Equality Act).
• Offer reasonable adjustments or an alternative process.
• Collect only the candidate data you need (data minimisation).
• Review the supplier's own bias testing. The ICO's recruitment audits led to almost 300 recommendations for providers.

The 120-person firm should do all five for its CV screener first, because candidates are the people most affected.

2. Customer-facing chatbots and generative AI Laws: UK GDPR, consumer protection rules. Regulators: ICO, CMA.

• Tell customers they are talking to AI (transparency and fair commercial practice).
• Keep personal data out of prompts unless you have a lawful basis.
• Offer a route to a human for complaints.

3. Marketing and content generation Laws: advertising rules, consumer protection, copyright. Regulator: ASA.

• Check claims in AI-written copy before publishing (misleading advertising).
• Disclose AI use where leaving it out could mislead. There is no blanket UK duty to label every AI-generated advert.
• Confirm you may use the training inputs and outputs commercially (copyright).

4. Financial services decisions Laws: FCA rules, UK GDPR, Equality Act. Regulator: FCA.

• Map each AI decision to existing FCA duties. The FCA's good and poor practice examples apply current rules and are not a new AI regulation.
• Run a DPIA for credit or fraud scoring.
• Explain and allow challenge of adverse outcomes.

5. Internal tools and staff use of public AI Laws: UK GDPR, confidentiality, copyright. Regulator: ICO.

• Ban client and candidate data in public tools unless approved (data security).
• List approved tools and who may use them.
• Require staff to check outputs before they reach clients.

What UK regulators have done so far with AI

UK regulators have used existing law against AI, but the results are mixed and fines are fewer than under the EU regime.

Clearview AI (ICO). The ICO fined the facial recognition company £7.5 million for scraping images to build a database. Litigation over that penalty has since gone through the tribunals and should not be treated as a settled, upheld fine. Lesson: data you collect for one purpose carries UK GDPR duties, and big penalties get contested.

Snap My AI (ICO). The ICO issued a preliminary enforcement notice over how Snap assessed risks to children. After Snap revised its DPIA, the ICO found it compliant and imposed no fine. Lesson: a preliminary notice is not a penalty, and a proper DPIA before launch is the cheapest defence.

Recruitment audits (ICO). These produced recommendations for providers, not fines, as covered in the checklist above.

Ofcom. The regulator fined the operator of a nudification site £50,000 for lacking effective age checks, plus £5,000 for ignoring an information request. Lesson: answer regulator requests.

CMA. Its foundation model work was a market review, not a finding of wrongdoing. On 5 March 2025 it decided the Microsoft/OpenAI partnership did not qualify for merger investigation.

FCA. Its AI work is supervisory guidance and engagement, with no public AI-specific enforcement case.

The ICO has also opened formal investigations into X and X.AI over Grok, announced on 3 February 2026, which are ongoing. It is consulting on agentic AI too.

For the 120-person firm, the pattern is clear. Run the DPIA for the CV screener and chatbot before launch, keep the paper trail, and reply promptly if a regulator writes.

How UK and EU AI rules differ, and when the EU Act reaches a UK firm

The EU AI Act is a binding, cross-sector law with risk tiers: banned practices, high-risk systems, transparency duties and separate rules for general-purpose AI models. The UK has no equivalent statute and relies on existing law and sector regulators.

For context, the US has no comprehensive federal AI statute. A December 2025 executive order seeks to challenge some state AI laws.

When a UK firm is caught

A "provider" builds an AI system or model, or has one built, and puts it on the market under its own name. A "deployer" uses a system in its work. The Act reaches non-EU providers who place systems on the EU market, and third-country providers or deployers whose system output is used in the EU.

Dates: prohibitions and AI literacy duties applied from February 2025, and general-purpose AI duties from 2 August 2025. Article 50 transparency duties applied from 2 August 2026, with a transition to 2 December 2026 for some legacy synthetic-content systems. Regulation (EU) 2026/1744, in force since 27 July 2026, moved high-risk deadlines to 2 December 2027 for Annex III systems and 2 August 2028 for product-related Annex I systems.

What the 120-person firm should do

Recruitment screening is an Annex III use, so the CV screener is high-risk if its output is used for EU candidates or clients. Steps:

• Ask each EU client whether the screener's results feed EU hiring decisions.
• Confirm whether your firm or the software vendor is the provider.
• Check the screener and chatbot against the Article 5 bans.
• Make sure the chatbot tells EU users they are talking to AI.
• Train staff on AI use, since literacy duties already apply.
• Diarise December 2027 for high-risk compliance.

Verdict: workable for routine use, thin on accountability

My view: the UK approach works for routine, lower-risk AI use and leaves gaps elsewhere. Only 19% of AI-using businesses found regulatory guidance clear, and a parliamentary committee called the framework fragmented and difficult to navigate. No AI-specific statute exists, and promised frontier-model legislation hasn't appeared. I expect more sector rules to follow.

Next steps:

1. Name an owner and list every AI tool in use.
2. Run a DPIA on the CV screener.
3. Ask your EU clients where the screener's output is used.

Sources

• AI regulation in the UK — House of Commons Library
• AI Agents and UK GDPR: Yes, It Applies in Full (ICO 2026) — Org
• Regulation Action Plan – Progress Update and Next Steps — GOV.UK
• UK AI Statistics 2026: Adoption, Market Size and Use — Org
• Implementing the UK’s AI regulatory principles: initial guidance for regulators — UK Government
• A pro-innovation approach to AI regulation: government response — UK Government
• AI and biometrics strategy update: March 2026 — Information Commissioner’s Office
• Equality and Human Rights Commission strategic plan 2025 to 2028 — Equality and Human Rights Commission
• CMA AI strategic update — Competition and Markets Authority
• Ofcom’s strategic approach to AI — Ofcom
• AI approach — Financial Conduct Authority
• How do we ensure lawfulness in AI? — Information Commissioner's Office
• When do we need to do a DPIA? — Information Commissioner's Office
• Data (Use and Access) Act 2025, Part 5, Chapter 1 — legislation.gov.uk
• Recruitment Rewired — Information Commissioner's Office
• Equality Act 2010, section 39 — legislation.gov.uk
• Uber Eats courier wins payout with help from equality watchdog after facing problematic AI checks — Equality and Human Rights Commission
• What businesses need to know about unfair commercial practices — GOV.UK
• Copyright, Designs and Patents Act 1988, section 16 — legislation.gov.uk
• AI in financial services: examples of good and poor practice — Financial Conduct Authority
• AI regulation: a pro-innovation approach — UK Government
• AI regulation: a pro-innovation approach — policy proposals — UK Government
• Labour Party Manifesto 2024 — Labour Party
• AI Opportunities Action Plan: government response — UK Government
• Tackling AI security risks to unleash growth and deliver Plan for Change — UK Government
• The Data (Use and Access) Act 2025 (Commencement No. 5 and Transitional and Saving Provisions) Regulations 2026 — Legislation.gov.uk
• Report on copyright and artificial intelligence — UK Government
• Artificial Superintelligence Bill — news — UK Parliament
• AI Management Essentials tool — Department for Science, Innovation and Technology
• ICO intervention into AI recruitment tools leads to better data protection for job seekers — Information Commissioner's Office
• Disclosure of AI in advertising: striking the balance between creativity and responsibility — Advertising Standards Authority
• UK Upper Tribunal hands down judgment on Clearview AI Inc — Information Commissioner's Office
• ICO warns organisations must not ignore data protection risks as it concludes Snap My AI chatbot investigation — Information Commissioner's Office
• Ofcom fines nudification site £50,000 for failing to introduce age checks — Ofcom
• AI foundation models: initial review — Competition and Markets Authority
• AI Act FAQ — European Commission AI Act Service Desk
• Article 5: Prohibited AI practices — European Commission AI Act Service Desk
• Article 99: Penalties — European Commission AI Act Service Desk
• Enforcement of the AI Act — European Commission
• Eliminating State Law Obstruction of National Artificial Intelligence Policy — The White House
• Article 2: Scope — European Commission AI Act Service Desk
• When does enforcement of the AI Act start? — European Commission AI Act Service Desk
• AI Omnibus enters into force — European Commission
• AI adoption research — Department for Science, Innovation and Technology
• Report on artificial intelligence and human rights — Joint Committee on Human Rights