AI law for business: the UK rules on artificial intelligence (AI)

What the law says

The UK has no general AI statute and no dedicated AI regulator. Its approach still rests on the March 2023 pro-innovation white paper. DSIT sets policy centrally. Your existing regulators, the Information Commission (formerly the ICO), the FCA, the ASA and the CMA, apply five cross-sector principles within their own remits.

What it means for you

• No AI act does not mean no rules. The regulators you already answer to police your use of AI under the laws they already enforce: the Information Commission on personal data, the FCA if you are authorised, the ASA on advertising, the CMA on consumer law. Compliance planning starts with your existing regulators, not with a hypothetical future AI statute.

  Example: If your AI chatbot misquotes a price to a customer, that is a consumer law matter under existing rules, exactly as if a member of staff had said it. There is no separate AI regulator to answer to, and no AI exemption to hide behind.

• Five non-statutory principles guide how regulators look at AI: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress. They are not law, but regulators apply them within their remits, so a deployment that ignores them invites scrutiny.

  Example: Before you roll out an AI tool that affects customers, check it against the five principles: can you explain its outputs, is someone accountable for it, and how does a customer challenge a result?

• The EU AI Act is not UK law, but it can reach a UK business. It applies if you place an AI system on the EU market or put it into service there, or if the output of your AI system is used in the EU (Article 2(1)). What it asks then depends on the system. Article 4, applicable since 2 February 2025 and reworded on 27 July 2026, asks providers and deployers to take measures that support their staff's AI literacy, with no set level. From 2 August 2026, Article 50 requires people to be told when they deal with an AI system, and deepfakes to be labelled. The high-risk rules start on 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.

  Example: A UK firm whose AI assistant answers customers in Germany has output used in the EU. It should brief its staff on the tool and make sure customers know they are talking to AI. A UK firm that sells an AI recruitment tool to EU employers provides a high-risk system and faces the full regime from 2 December 2027.

• The King's Speech of 13 May 2026 announced no AI bill. The closest measure is the Regulating for Growth Bill. It would create sandbox powers, including AI sandboxes, where some rules can be relaxed for a time under strict controls. Existing law still does the work. Build your compliance on the current framework, not on a law that may never arrive.

  Example: If you are budgeting for AI governance, put the money into UK GDPR, consumer and sector compliance now, rather than waiting for a UK AI act to define the requirements.

What the law says

The UK GDPR, the assimilated and since amended version of the EU regulation, governs every piece of personal data your AI touches. You need a lawful basis, you must inform people, respect their rights and keep the data secure. The Data (Use and Access) Act 2025 amended the rules. The main changes, including the new automated decision-making rules, have applied since 5 February 2026. The duty to handle complaints yourself has applied since 19 June 2026. Since 30 September 2026 the regulator is the Information Commission, which replaced the ICO.

What it means for you

• Everything personal your AI processes, from chat transcripts and call recordings to email addresses and CRM records, sits under the UK GDPR. You need a lawful basis to process it and a privacy notice that tells people what you do with their data.

  Example: If an AI agent answers customers on WhatsApp and saves the conversation history, those transcripts are personal data: you need a lawful basis and a clear entry in your privacy notice.

• Since 5 February 2026, Article 22 has been replaced by Articles 22A to 22D. Solely automated significant decisions are now generally permitted if you apply the safeguards. Tell the individual, let them make representations, give them human intervention on request and a way to contest the decision. Stricter limits remain where the decision uses special category data, and such a decision cannot rely on a recognised legitimate interest. The EU still starts from a prohibition, although an EU reform proposed in November 2025 is under negotiation.

  Example: You can now let a system decide a routine application outcome end to end, provided the person is told, can ask for a human review and can contest the result. The same decision built on health data still falls under the stricter regime.

• The regulator's Guidance on AI and data protection covers fairness across the AI lifecycle, transparency and explainability, accountability, and what an AI-specific DPIA must cover. It was last updated in March 2023 and is under review after the DUAA. Read it alongside the draft guidance on automated decision-making, due in final form in winter 2026. High-risk processing needs a DPIA before you start, not after.

  Example: Before you deploy AI that profiles customers at scale, run a DPIA using the regulator's AI guidance as the checklist. It documents the risks and mitigations, and it is the first thing the Information Commission asks to see.

• The DUAA also added a short list of recognised legitimate interests (Article 6(1)(ea) and Annex 1). The list is narrow: disclosures to public bodies, national security, emergencies, crime and safeguarding. Most commercial AI work still rests on contract, consent or ordinary legitimate interests with a balancing test. A solely automated significant decision cannot rely on a recognised legitimate interest at all (Article 22B(4)).

  Example: Map the lawful basis for each AI workflow. A bot answering questions about a customer's own order sits on contract. Using the chat history for marketing sits on legitimate interests and needs a written balancing test, plus PECR consent or the soft opt-in for any email or text.

• Since 19 June 2026 every controller must handle data protection complaints itself (section 164A of the Data Protection Act 2018). Make it easy to complain, for example with a form that can be completed online. Acknowledge each complaint within 30 days, look into it without undue delay and tell the person the outcome. Your privacy notice must mention the right to complain to you. There is no small-business exemption.

  Example: If a customer complains that your AI assistant kept or misused their chat, that is a complaint under section 164A. Log it, acknowledge it within 30 days, investigate and reply with the outcome. The person can still go to the Information Commission afterwards.

• PECR sits beside the UK GDPR and covers cookies and electronic marketing. An AI chat widget that sets non-essential cookies needs consent. Marketing emails and texts that your AI writes or sends to individuals need consent or the soft opt-in. Automated marketing calls need prior consent. Since 5 February 2026, PECR breaches can be fined up to £17.5 million or 4% of global turnover.

  Example: If your AI assistant collects a visitor's email and then sends them offers, check you have PECR consent or a valid soft opt-in first. A UK GDPR lawful basis alone is not enough for electronic marketing.

What the law says

All VAT-registered businesses must already keep digital records and file VAT returns through compatible software under Making Tax Digital. Since 6 April 2026, MTD also applies to Income Tax for sole traders and landlords whose qualifying income for 2024 to 2025 was over £50,000. There is no general B2B e-invoicing mandate today, but one is coming: all VAT invoices must be issued as e-invoices from April 2029.

What it means for you

• MTD for VAT requires digital records and digital links across the whole VAT return process. AI can prepare, check and reconcile, but the flow has to stay digital end to end, with no manual retyping in the middle.

  Example: An AI workflow that drafts invoices and reconciles them straight into your accounting software keeps the digital link intact. Retyping figures from a PDF into the VAT return breaks it.

• MTD for Income Tax has applied since 6 April 2026 to sole traders and landlords with qualifying income over £50,000. The threshold falls to £30,000 from 6 April 2027 and to £20,000 from 6 April 2028. It means digital records and quarterly updates through compatible software, due on 7 August, 7 November, 7 February and 7 May.

  Example: A sole trader above £50,000 sent the first quarterly update by 7 August 2026, and the next is due by 7 November 2026. HMRC will not give penalty points for late quarterly updates in 2026 to 2027, but it will from 2027 to 2028. Automate record capture now.

• E-invoicing is coming, not current. At Budget 2025 the government announced that all VAT invoices must be issued as e-invoices from April 2029. It covers B2B and B2G sales, not B2C, on a decentralised model. Real-time reporting to HMRC will not start in 2029. The implementation roadmap is due at the Budget on 28 October 2026.

  Example: If you are building an invoicing workflow in 2026, design it so structured e-invoices are an output format you can switch on, rather than a rebuild in 2028.

What the law says

There are no AI-specific advertising rules, but the CAP and BCAP Codes apply in full to AI-generated ads: an ad must not mislead, whatever generated, edited or targeted it. Since 6 April 2025 the CMA can also decide consumer law breaches itself and fine businesses directly under the DMCC Act 2024, and the Consumer Rights Act 2015 gives consumers statutory rights over digital content.

What it means for you

• There is no blanket legal requirement to disclose AI use in an ad. Disclosure is needed where the audience would otherwise be misled, and, crucially, disclosing AI use cannot cure a claim that is misleading in itself. The truth of the claim comes first; the label comes second.

  Example: AI-generated imagery showing product results that are not real misleads even with an 'AI-generated' label attached. Fix the claim, not the caption.

• The DMCC Act 2024 regime, in force since 6 April 2025, bans fake reviews outright, covering posting them, commissioning them and hosting duties for platforms, and bans drip pricing: every mandatory fee must appear in the headline price. AI-generated fake reviews and misleading AI-driven pricing sit squarely inside it, and the CMA no longer needs a court to act.

  Example: Using AI to generate customer reviews, or letting a pricing engine reveal a compulsory admin fee only at checkout, are both breaches the CMA can now fine directly.

• The Consumer Rights Act 2015 covers goods, services and digital content: what you sell must be of satisfactory quality, fit for purpose and as described, and pre-contract information becomes part of the contract. That applies to any AI-powered product or software you sell to UK consumers.

  Example: If you sell a consumer app with an AI feature, the marketing description of what that feature does becomes a contractual term. Overselling it creates a statutory claim, not just a refund conversation.

What the law says

AI used in hiring and people management is regulated through the Equality Act 2010, the UK GDPR and guidance from the Information Commission. You are liable for the discriminatory outcomes of the tools you deploy, automated hiring decisions must carry safeguards, and monitoring staff with AI needs a lawful basis and usually a DPIA.

What it means for you

• The Equality Act 2010 makes the employer liable for the discriminatory outcomes of an AI screening tool it uses, even if a vendor built it. Bias can be direct discrimination under section 13 or indirect under section 19: a facially neutral algorithm that disadvantages a protected group engages section 19 unless you can justify it as a proportionate means of achieving a legitimate aim.

  Example: If a CV screening tool consistently ranks candidates from one ethnic group lower, the tribunal claim lands on you, not on the software vendor.

• The ICO's audit of AI recruitment tools, published in November 2024, found tools that let recruiters filter candidates by protected characteristics, tools inferring gender and ethnicity from names, excessive data collection and indefinite retention. It produced almost 300 recommendations. The practical asks: demand bias-testing evidence from vendors, minimise the data you collect, and tell candidates clearly how AI uses their information.

  Example: Before you buy a screening tool, ask the vendor for its bias-testing evidence and its retention policy. The Information Commission expects you to have both on file.

• Since 5 February 2026, a solely automated rejection of a job applicant is a significant decision under UK GDPR Articles 22A to 22D. It is generally permitted for non-special-category data if you provide the Article 22C safeguards: information about the decision, the ability to make representations, meaningful human intervention on request and a route to contest. The human involvement must be genuine, not a rubber stamp.

  Example: You may auto-reject applicants who lack a required qualification, provided each rejected candidate is informed, can respond and can obtain a genuine human review on request.

• Monitoring workers with AI falls under the ICO's monitoring guidance from October 2023, which is under review after the DUAA: you need a lawful basis, transparency and proportionality, and a DPIA for monitoring likely to cause high risk. The guidance names biometric monitoring, keystroke monitoring and performance monitoring that can lead to financial loss as examples.

  Example: An AI tool that scores staff productivity and feeds pay or dismissal decisions is high-risk monitoring. Run the DPIA before switching it on, not after.

What the law says

There is no AI-specific FCA rulebook. AI in regulated financial services is governed through the existing FSMA framework. The Consumer Duty requires firms to deliver good outcomes for retail customers, and financial promotions must be clear, fair and not misleading. The sector's biggest compliance event in 2026 is the motor finance commission redress scheme. The Upper Tribunal will hear the legal challenges to it between 16 and 26 February 2027. Until that process ends, lenders do not have to calculate or pay redress under the scheme.

What it means for you

• The FCA confirmed an industry-wide motor finance redress scheme in PS26/3 on 30 March 2026. It covers agreements from 6 April 2007 to 1 November 2024: about 12.1 million eligible agreements, average redress of about £829 and an estimated total cost to firms of £9.1 billion. On 2 July 2026 the Upper Tribunal suspended parts of the scheme while four legal challenges run. The hearing is fixed for 16 to 26 February 2027. The rules that are not suspended still bind firms.

  Example: A lender does not need to calculate or pay redress under the scheme while the challenge runs. It must still follow the rules in force, keep preparing, keep its records and make financial provision. If the scheme is quashed, complaints go back to the normal process and timescales.

• Financial promotions are restricted by section 21 of FSMA 2000, and FCA rules in CONC 3 require consumer credit promotions, including AI-generated or AI-targeted ads, to be clear, fair and not misleading. The rule attaches to every promotion that goes out, however it was produced.

  Example: An AI tool that drafts and targets car finance ads is producing financial promotions. Every variant it generates has to satisfy CONC 3, not just the master copy a human approved.

• The Consumer Duty requires firms to put customers' needs first across how retail products are designed, sold and supported. That includes AI-driven sales, pricing and support journeys: the FCA judges the outcome the customer gets, not the technology that produced it.

  Example: If an AI support agent handles customers of a regulated product, the quality of the outcome it delivers is Consumer Duty evidence, good or bad.

• Solely automated creditworthiness or pricing decisions are significant decisions under UK GDPR Articles 22A to 22D, in force since 5 February 2026. The Article 22C safeguards apply on top of the FCA rules, not instead of them.

  Example: An automated affordability decline must offer the customer information about the decision, a way to make representations, human intervention and a route to contest it, alongside your FCA obligations.