How the United Kingdom regulates AI without an AI Act

The design choice

The UK's framework rests on the 2023 white paper and the government's pro-innovation response: no horizontal statute, but a set of non-statutory cross-sector principles, safety, transparency, fairness, accountability, contestability, that existing regulators apply within their remits. The bet is institutional: the ICO, FCA, CMA, Ofcom and their peers know their sectors better than a new AI authority would, and coordination problems are handled through the Digital Regulation Cooperation Forum, which the regulators use to run joint services for AI innovators. Successive governments have kept the model while sharpening the steering: in January 2026 ministers formally asked the ICO to publish a plan for enabling safe AI-powered innovation, and the ICO answered in May 2026, with regulators now expected to publish and annually report on such plans. The direction of travel is more coordination and more accountability for regulators; a statute for companies has not followed so far.

Who regulates your AI in the UK

For most businesses the operative UK rulebook is UK GDPR and the Data Protection Act 2018, and the ICO's guidance on AI and data protection translates them into AI terms: lawful basis for training and deployment, fairness and bias, transparency toward individuals, automated decision-making rights, and accountability documentation. The rules it explains have moved: since 5 February 2026 section 80 of the Data (Use and Access) Act 2025 has replaced Article 22 UK GDPR with Articles 22A to 22D, so a significant decision taken solely by automated means may now rest on any lawful basis, including legitimate interests, provided the safeguards in Article 22C are in place (information, representations, human intervention, a route to contest); decisions based on special-category data stay confined to explicit consent or a contractual or legal footing, and none may rely on the new recognised-legitimate-interest basis. The ICO's AI guidance is marked as under review for these changes, and its updated automated-decision-making guidance is due in winter 2026.

The ICO's strategic approach and the 2026/27 workplan go further, and the centrepiece now has a statutory footing: section 92(2) of the Data (Use and Access) Act 2025 inserted section 124A into the Data Protection Act 2018, and SI 2026/425, in force since 12 May 2026, requires the Information Commissioner to prepare a code of practice on the processing of personal data in the development and use of AI and automated decision-making. The duty to prepare is in force; the code itself is in drafting, with the ICO's published timetable putting the final version in the first half of 2028, after which it goes to Parliament for 40 days and takes effect 21 days after issue (section 125). Once in force, courts, tribunals and the Commissioner must take it into account where relevant, and a departure from it is not of itself a breach (section 127), which is what a code of practice adds without an AI act.

Dedicated guidance on agentic AI is in development alongside it, with a consultation due in September 2026 and the final version in spring 2027, and it will matter to every company deploying autonomous assistants.

For financial firms, the FCA has published its approach to AI, principles-based and anchored in existing frameworks (the Senior Managers regime, the Consumer Duty, operational resilience), with no plan for AI-specific rules; the Financial Services AI Adoption Plan of 14 July 2026, an independent report by the government's AI Champions whose recommendations to government the Treasury has accepted, points the same way: adoption within the existing perimeter, with targeted responses reserved for novel questions. In practice the UK compliance question is "which regulator owns my use case" where the EU's is "which annex am I in": usually the ICO where personal data is involved plus your sector supervisor, with copyright, equality, consumer and product-safety law running alongside and enforced, for the most part, in the courts.

The frontier-model bill that has not arrived

Above the regulator-led model sits the government's stated case for targeted, binding requirements on developers of highly capable general-purpose AI models, language that has appeared in official documents since the white paper response and remains, as at 25 September 2026, an intention without a bill. What the King's Speech of 13 May 2026 did announce is legislation of a different type: the Regulating for Growth Bill, which the government states would create an AI Growth Lab with cross-economy sandboxing powers, allowing regulatory requirements to be temporarily disapplied or modified for supervised, real-world testing of AI products. That is announced legislation, still short of law, and it points away from an AI act: the legislative energy is going into loosening the perimeter for controlled testing. The AI Opportunities Action Plan review shows where government energy is going: adoption, infrastructure and standards, including the digital standards strategy to 2030.

A safety event has since arrived without a bill: the AI Minister's statement of 7 September 2026 reported a series of summer incidents in which AI agents exceeded their operators' intent, and the government's answer ran through cyber-security funding, NCSC guidance and the Cyber Security and Resilience Bill. For planning purposes, treat a UK frontier-model bill as a watch item without a timetable, and treat the ICO code of practice as the statutory instrument to plan for: once issued, courts, tribunals and the Commissioner must take it into account (section 127 DPA 2018), and the ICO's timetable puts the final code in the first half of 2028.

Reading it from Zurich and Brussels

The triangle is now complete, and the three sides differ by design. The EU built a code with roles, risk tiers and conformity machinery, as we mapped in our Article 50 update and the provider-reclassification piece. Switzerland is legislating sectorally on a treaty foundation, with the consultation draft due at the end of 2026, as covered in our Switzerland update. The UK regulates through its regulators, with data protection as the de facto AI law where personal data is processed.

Three consequences for cross-border groups. First, the UK has no AI conformity machinery: a system that needs EU AI Act conformity assessment has no AI-specific equivalent in the UK, which changes sequencing for product launches; where the product is itself regulated, for example software as a medical device, the UK's own conformity assessment applies (UKCA in Great Britain, CE under EU rules in Northern Ireland). Second, UK enforcement is real regardless: the ICO enforces UK GDPR against AI deployments now, and "we complied with the AI Act" is not a defence to a UK data-protection failure; the regimes measure different things. Third, the efficient architecture is the one we keep recommending across these updates: one governance framework, mapped three ways, EU role-and-risk analysis, UK regulator mapping, Swiss sectoral overlay, so that the evidence assembled once serves all three reviews and the jurisdiction-specific decisions (prohibited uses, automated decisions, transparency, product rules) sit in annexes. A UK business is itself inside the AI Act's scope where its systems reach the EU market or their output is used there.

What this means for you

• Do not read "no act" as "no rules". UK GDPR and the DPA 2018 are the operative UK rulebook for AI that touches personal data, the ICO's AI guidance explains how they apply and is under review after the DUAA, and the ICO enforces the legislation now; map each use case to the ICO and to your sector supervisor, which is the UK equivalent of the EU's risk classification.
• Financial firms: work within the published perimeter. The FCA relies on existing accountability structures and plans no AI-specific rules; the Champions' adoption plan, accepted by the Treasury for its part, points the same way.
• Watch the statutory ICO code of practice and agentic-AI guidance. The code, once issued under sections 124A and 125 DPA 2018 (final version due in the first half of 2028 on the ICO's timetable), must be taken into account by courts, tribunals and the Commissioner; agentic-AI guidance is due in spring 2027; the AI Growth Lab and the frontier-model bill sit further out.
• Run one framework across the triangle. EU, UK and Swiss duties overlap in substance and differ in form, scope and the decisions they force; a single governance core with three mappings is cheaper and more defensible than three programmes.

Isak Legal advises companies on AI governance across the EU, UK and Swiss regimes, regulator mapping, deployment policies and cross-border product strategy. See our AI, Data & Technology and United Kingdom pages, or get in touch.

This client update is provided for general information only, reflects the position as at 26 September 2026 and does not constitute legal advice or create a lawyer-client relationship. The UK framework is evolving through regulator publications and targeted legislation; verify the current position at the official sources linked above before acting. For advice on a specific matter, please contact us.