The UK has deliberately chosen not to pass a single AI act. Its framework rests on five cross-sector principles set out in the March 2023 white paper and asks existing regulators to apply them within their own remits. The government delayed a primary AI bill through 2025 partly to work through AI and copyright, and in October 2025 published a Blueprint for AI regulation centered on the AI Growth Lab, a set of sandboxes where specific rules can be relaxed under license. The May 13, 2026 King's Speech announced a Regulating for Growth Bill to create cross-economy sandboxing powers, and no AI bill. Since July 2026 AI policy has sat with the Cabinet Office and the new Department for Business, Innovation, Science and Trade, as the Department for Science, Innovation and Technology is wound up. Binding AI rules, where they exist, come from data protection, equality, financial-services, and online-safety law, and from the Crime and Policing Act 2026's offense, in force since June 29, 2026, of making or supplying tools that generate purported intimate images, rather than an AI statute.
Key points
- The approach was set by the March 2023 white paper, 'AI regulation: a pro-innovation approach' (Command Paper 815), and the February 2024 government response.
- Five principles guide regulators: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.
- Sector regulators (the Information Commission, which replaced the Information Commissioner on September 30, 2026 and still operates as the ICO; FCA, PRA, CMA, Ofcom, MHRA) apply the principles using existing powers. On October 8, 2026 the Information Commission secured data protection changes from ten foundation-model developers and opened a call for evidence on agentic AI, closing November 20, ahead of a statutory code of practice on AI and automated decision-making.
- The AI Safety Institute was renamed the AI Security Institute in February 2025, signaling a focus on national-security and misuse risks.
- The Data (Use and Access) Act 2025 took effect in stages through 2026 and reshapes automated-decision safeguards.
- A GOV.UK consultation on workplace monitoring technologies, including tools that make decisions about workers, ran from July 8 to September 30, 2026 and is closed; no outcome has been published.
- The May 13, 2026 King's Speech announced a Regulating for Growth Bill with cross-economy sandboxing powers, including for AI, and no AI bill.
- DSIT is being wound up in the July 2026 machinery-of-government changes and replaced by the Department for Business, Innovation, Science and Trade, the Department for Digital, Culture, Media and Sport, and the Cabinet Office. AI strategy and the AI Security Institute sit with the Cabinet Office, and Kanishka Narayan has been Minister for AI jointly in the Cabinet Office and the business department since July 20, 2026.
- The advisory AI Growth Lab took applications from August 3 to September 27, 2026, starting with legal services, and on October 6, 2026 the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare.
- On October 12, 2026 the government said it will explore strengthening the Cyber Security and Resilience Bill and the wider cyber regime to protect essential services from AI risks, including loss of control by autonomous systems, and will look at how serious AI incidents and near misses are identified and reported. It announced no AI bill. Its report-stage amendments, published October 19, would let regulations give the Secretary of State investigation and penalty powers over compromises caused by loss of control of an AI agent.
- Two private members' bills on AI are before the Commons: the Artificial Superintelligence Bill, a Ten Minute Rule bill from Alex Sobel (first reading September 8, 2026), and Dawn Butler's Artificial Intelligence (Consent and Misuse) Bill on consent to generate a person's likeness (first reading October 20, 2026).
Laws and instruments
AI regulation: a pro-innovation approach (white paper)
Command Paper 815 (March 2023); government response Feb 2024
Sets out the five cross-sector principles and the decision to regulate AI through existing regulators rather than a new horizontal law.
Effective: Policy framework, non-statutory
Blueprint for AI regulation and the AI Growth Lab
DSIT (since wound up), published October 21, 2025
Proposes cross-economy regulatory sandboxes where targeted rules can be relaxed under license, with red lines preserving consumer protection, safety, and fundamental rights. Successful pilots can lead to permanent reform. The first stage is an advisory AI Growth Lab, which took applications from August 3 to September 27, 2026 and focuses first on legal services with the Legal Services Board, the Solicitors Regulation Authority, the Council for Licensed Conveyancers, and the data protection regulator; the May 13, 2026 King's Speech announced a Regulating for Growth Bill to create the statutory sandboxing powers.
Effective: Advisory AI Growth Lab took applications from August 3 to September 27, 2026 (legal services first); statutory sandboxing powers await the Regulating for Growth Bill announced May 13, 2026
Data (Use and Access) Act 2025 (DUAA)
DUAA 2025
Reforms UK data-protection law, including the safeguards around solely automated decision-making that bear directly on AI, and adds a new individual right to complain.
Effective: Most provisions from Feb 5, 2026; complaints route from June 19, 2026; the Information Commission replaced the Information Commissioner on September 30, 2026
Artificial Intelligence (Regulation) Bill
Private Member's Bill (Lord Holmes), 2024-26 session
A private member's bill that would have created an 'AI Authority' and imposed duties on developers. It was not government legislation and fell when the 2024-26 session ended in spring 2026, but it signals appetite for a statutory backstop.
Effective: Not enacted; fell at the end of the 2024-26 session
Crime and Policing Act 2026 (AI image-generator offenses and AI services power)
2026 c. 20, sections 72, 99, and 248
Makes it an offense to make, adapt, supply, or offer to supply a tool for generating purported intimate images, with up to three years in prison on indictment and a defense for those who took all reasonable steps to prevent non-consensual use. A separate offense covering tools for creating child sexual abuse images, with up to five years, has not yet been brought into force. Section 248 lets the Secretary of State, by regulations, extend Online Safety Act duties to providers of AI services to reduce the risk of illegal AI-generated content and of AI services being used for priority offenses.
Effective: Section 248 from Royal Assent on April 29, 2026; section 99 (intimate image generators) from June 29, 2026; section 72 (child sexual abuse image-generators) not yet in force
Timeline
- March 2023
Pro-innovation white paper published.
- February 2024
Government response reaffirms the principles-based approach.
- February 2025
AI Safety Institute renamed the AI Security Institute.
- October 21, 2025
DSIT Blueprint and AI Growth Lab consultation opens.
- January 27, 2026
FCA launches the Mills Review of AI in retail financial services.
- February 5, 2026
Most Data (Use and Access) Act provisions take effect.
- April 29, 2026
The Crime and Policing Act 2026 receives Royal Assent; section 248, a power to extend Online Safety Act duties to AI services, takes effect the same day.
- May 13, 2026
King's Speech announces a Regulating for Growth Bill with cross-economy sandboxing powers; no AI bill.
- June 19, 2026
DUAA complaints procedure commences.
- June 29, 2026
The Crime and Policing Act 2026 offense of making or supplying purported intimate image generators takes effect.
- July 6, 2026
The FCA publishes the Mills Review of AI in retail financial services, with seven priority recommendations.
- July 8, 2026
Consultation on workplace monitoring technologies opens; it closes September 30, 2026.
- July 20, 2026
DSIT is wound up; its functions pass to the Department for Business, Innovation, Science and Trade, the Department for Digital, Culture, Media and Sport, and the Cabinet Office, with Kanishka Narayan as Minister for AI in the Cabinet Office and the business department.
- August 3, 2026
The advisory AI Growth Lab opens to applications, starting with legal services.
- September 8, 2026
Alex Sobel's Artificial Superintelligence Bill, a Ten Minute Rule bill, has its first reading; second reading is set for November 13.
- September 27, 2026
Applications to the advisory AI Growth Lab for legal services close.
- September 30, 2026
The Information Commission, a board, replaces the Information Commissioner under the Data (Use and Access) Act, and its office keeps the ICO name; the workplace monitoring consultation closes.
- October 6, 2026
The government accepts all 44 recommendations of the National Commission into the Regulation of AI in Healthcare.
- October 8, 2026
The Information Commission secures data protection changes from ten foundation-model developers and opens a call for evidence on agentic AI, closing November 20.
- October 12, 2026
The government says it will explore extending the Cyber Security and Resilience Bill regime to AI risks, including loss of control and the reporting of AI incidents and near misses.
- October 19, 2026
The government's report-stage amendments to the Cyber Security and Resilience Bill would let regulations give the Secretary of State powers over compromises caused by loss of control of an AI agent; Lords report stage is set for October 26.
- October 20, 2026
Dawn Butler presents the Artificial Intelligence (Consent and Misuse) Bill; second reading is set for November 27.
Who it applies to
There is no single AI-scope statute. Obligations attach through whichever existing regime applies: data protection (the Information Commission, still known as the ICO), financial services (FCA, PRA), competition (CMA), online safety and communications (Ofcom), and medical devices (MHRA).
Penalties
No AI-specific penalty regime. Enforcement flows through each regulator's existing powers, for example data-protection fines imposed by the Information Commission of up to the higher of GBP 17.5 million or 4% of global turnover. Making or supplying a purported intimate image generator carries up to three years in prison.
Recent developments
October 19, 2026
UK Parliament
The UK government proposes powers over AI agents that slip out of human control
The government's report-stage amendments to the Cyber Security and Resilience Bill, published in the running list of amendments on October 19, would let regulations give the Secretary of State investigation, inspection, and penalty powers over security or operational compromises attributable to loss of oversight or control of an AI agent, and the government's supporting memorandum names the AI Security Institute as a possible delegate. Peers have also tabled amendments that would give the institute audit and enforcement powers over frontier AI and require frontier developers to report unauthorized access to essential services' systems. Report stage in the House of Lords was set for October 26.
The UK will look at extending its cyber resilience regime to AI incidents and loss of control
The government said it will explore strengthening parts of the Cyber Security and Resilience Bill and the wider regime so that essential services such as hospitals and utilities are better protected from AI-related risk, including loss of control by autonomous systems that evade human oversight, and will look at how serious AI incidents and near misses are identified and reported. The detail will be worked through with parliamentarians, technical experts, and operators. It announced no AI bill; the AI minister said the government will legislate wherever necessary. The cyber bill is scheduled for report stage in the House of Lords on October 26.
October 8, 2026
Information Commission
The Information Commission secures data protection changes from ten AI developers and opens an agentic AI call for evidence
The regulator said ten of the largest foundation-model developers operating in the UK (Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI) have made or committed to data protection changes after its scrutiny. It opened a six-week call for evidence on agentic AI, closing November 20, 2026, that will feed its forthcoming statutory code of practice on AI and automated decision-making, and confirmed inquiries to OpenAI, Anthropic, Meta, and the AI Security Institute about agentic AI testing in which agents reportedly bypassed protections and reached external systems. Two days earlier the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare, committing to proportionate, risk-based regulation of AI products in health care across their lifecycle.
Common questions
Does the United Kingdom have a comprehensive AI law?
No. The UK has deliberately chosen not to pass a single AI act. Its framework rests on five cross-sector principles set out in the March 2023 white paper and asks existing regulators to apply them within their own remits. The government delayed a primary AI bill through 2025 partly to work through AI and copyright, and in October 2025 published a Blueprint for AI regulation centered on the AI Growth Lab, a set of sandboxes where specific rules can be relaxed under license. The May 13, 2026 King's Speech announced a Regulating for Growth Bill to create cross-economy sandboxing powers, and no AI bill. Since July 2026 AI policy has sat with the Cabinet Office and the new Department for Business, Innovation, Science and Trade, as the Department for Science, Innovation and Technology is wound up. Binding AI rules, where they exist, come from data protection, equality, financial-services, and online-safety law, and from the Crime and Policing Act 2026's offense, in force since June 29, 2026, of making or supplying tools that generate purported intimate images, rather than an AI statute.
What are the penalties for AI violations in the United Kingdom?
No AI-specific penalty regime. Enforcement flows through each regulator's existing powers, for example data-protection fines imposed by the Information Commission of up to the higher of GBP 17.5 million or 4% of global turnover. Making or supplying a purported intimate image generator carries up to three years in prison.
Who does AI regulation in the United Kingdom apply to?
There is no single AI-scope statute. Obligations attach through whichever existing regime applies: data protection (the Information Commission, still known as the ICO), financial services (FCA, PRA), competition (CMA), online safety and communications (Ofcom), and medical devices (MHRA).
Cite this page
Artificial Intelligence Regulations, "AI Regulation in the United Kingdom," reviewed October 26, 2026, https://artificialintelligenceregulations.com/jurisdictions/united-kingdom.html.
Entries state the position as of the review date and link to the primary text for verification.
