TerraLex AI Guide

At present, the UK does not have a single, comprehensive, AI-specific statute equivalent to the EU AI Act.

Instead, the UK has adopted a non-statutory, principles-based regulatory framework for AI. This approach was set out initially in the UK Government’s 2023 AI White Paper “A pro-innovation approach to AI regulation” and has been reaffirmed by subsequent governments.

In short, therefore, the UK currently relies on existing laws and guidance from regulators, generally on a sector-by-sector basis, to govern the use and development of AI.

There have been attempts by members of parliament to legislate for AI, including through Private Member’s Bills in parliament, and by seeking to include AI-specific provisions and carve-outs into other new laws. However, so far, these attempts have been unsuccessful.

There are ongoing discussions about future AI legislation, particularly around duties on regulators and transparency obligations. The UK Government has signalled an intent to legislate for AI during the current parliamentary period.

It is unclear, however, whether that will be a standalone AI Act, or reforms to existing laws. For example, the UK Government consulted on reforming copyright law to deal with the issue of data scraping and mining by AI companies in order to train their models using copyright-protected material. However, in early 2026, the Government Report on Copyright and Artificial Intelligence signalled a strategic pause, with ongoing evidence-gathering and monitoring of international developments to be carried out before any definitive legislative solution is passed.

The UK has not adopted a single statutory definition of AI. The UK Government’s March 2023 White Paper conceptualises AI by reference to two characteristics: “adaptivity” (systems learning beyond their initial programming) and “autonomy” (systems operating with minimal human oversight).

There are varying definitions of AI across sectors. For example, the Information Commissioner’s Office (ICO – the UK’s supervisory authority for data protection) defines AI as an umbrella term for a range of algorithm-based technologies that solve complex tasks by carrying out functions that previously required human thinking.

The UK’s approach is commonly described as “pro-innovation and principles-based”. Five core cross-sector principles underpin the framework:

1. Safety, security and robustness
2. Appropriate transparency and explainability
3. Fairness
4. Accountability and governance
5. Contestability and redress

Key characteristics of the approach:

• These principles are not directly binding on businesses.
• Instead, they are intended to be interpreted and applied by existing regulators within their remits.
• Regulators are encouraged to issue guidance, codes of practice and use existing enforcement powers.

Whilst the UK has explicitly rejected, for now, a centralised AI regulator, it has established the AI Standards Hub — an initiative dedicated to the evolving international field of standardisation for AI technologies.

In October 2025, the UK Government announced its blueprint for AI regulation — AI Growth Labs. The scheme envisages responsible AI innovation by enabling monitored testing and modification of AI tools in controlled sandboxes. The Government proposes that the scheme will initially be rolled out amongst key sectors of industry such as healthcare, professional services and transport. The Regulating for Growth Bill, announced in the King's Speech on 13 May 2026, will put regulatory sandboxes onto a statutory footing, allowing businesses to test innovative AI products and other emerging technologies through the temporary relaxation of existing rules.

The AI Opportunities Action Plan is a government initiative laid out by the Department for Science, Innovation and Technology (DSIT) and is designed to make the UK a global leader in AI, focusing on economic growth, better public services, and creating AI Growth Zones across the UK.

Responsible AI Toolkit DSIT published the responsible AI toolkit which is a collection of guidance to support public (and private) sector organisations and practitioners to safely and responsibly develop and deploy AI systems in accordance with certain "AI assurance principles". The toolkit recognises a variety of methods that can be used to ensure the safe development of AI, including conformity assessments, measurements against UK GDPR, and impact assessments. The AI toolkit suggests a holistic approach to evaluating AI and warns against adopting a standardised "tick box" exercise.

**Guidance from the Advertising Standards Authority (ASA): ** In a note published in May 2025, the ASA advised that the use of AI should be disclosed where it features prominently in an advert and is not obvious to consumers, for example, where deepfake content has been used. The ASA noted that disclosure will not mitigate harm caused by misleading advertising. For instance, an advertisement showing an AI generated image of the after-effects of a cosmetic product will be misleading regardless of whether a disclosure has been given.

Some of the main regulators in the UK, currently responsible for publishing guidance to their respective sectors in relation to AI:

• Information Rights: Information Commissioner’s Office (ICO)
• Financial services: Financial Conduct Authority (FCA)
• Telecoms, Digital and Online Services: Ofcom
• Energy: Ofgem
• Healthcare and life sciences: Medicines and Healthcare products Regulatory Agency (MHRA)
• Education: Ofsted and Ofqual
• Legal Services: Law Society of England and Wales / Law Society of Scotland / Law Society of Northern Ireland
• Transport & Aviation: Civil Aviation Authority (CAA)
• Competition and consumer rights: Competition and Markets Authority (CMA)

There is no single list of “AI actors” defined in UK law.

In practice, obligations may apply to:

• Developers of AI systems
• Deployers/users of AI systems
• Suppliers and vendors of AI-enabled products or services

The relevant obligations depend on:

• The sector involved
• The nature of the activity (development vs deployment)
• The applicable existing legal framework (e.g. data protection, consumer protection, financial services)

At present, regulatory bodies across sectors are expected to apply AI principles, and publish sectoral guidance, within their respective domains.

AI in the UK is heavily shaped by existing horizontal and sectoral laws, including in particular:

• Data protection and privacy (UK GDPR and Data Protection Act 2018)
• Equality and anti-discrimination law (Equality Act 2010)
• Consumer protection law (Consumer Rights Act, unfair trading rules)
• Product safety and liability (including evolving product liability reforms)
• Online safety (Online Safety Act, e.g. where AI is used in content moderation)
• Intellectual property law (particularly copyright, and the Patents Act on the patentability of AI inventions)

Following amendments which came into force in February 2026, there is now divergence between EU and UK data protection law. This includes a number of provisions that apply to the development, training and use of AI, such as the inclusion of commercial research within the definition of “research” and amendments to the rules on automated decision. These amendments potentially provide a more flexible framework under data protection law for AI development and deployment compared to the EU.

The UK Government has mandated the Information Commissioner’s Office to create a statutory code of practice on AI and automated decision-making. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425) came into force on 12 May 2026, placing the ICO under a formal duty to prepare the code. The final code is expected by August 2027, with full compliance anticipated by early 2028.

Online Safety Act & Criminal Law: New provisions criminalise AI tools used for harmful content (e.g., deepfakes, child sexual abuse material).

Criminal offences under the Crime and Policing Act 2026, which received Royal Assent on 29 April 2026 (with commencement of various provisions from 29 June 2026):

• Making sexually explicit deepfake images a criminal offence, with offenders facing up to two years in prison.
• It is an offence to take or record intimate images without consent, with intent to cause alarm, distress, or humiliation, or for sexual gratification.
• Installing or adapting equipment to enable these offences is also a criminal offence.

Separate Offence for Sharing Deepfake Images:

• Sharing deepfake images is already an offence under the Sexual Offences Act 2003, as amended by the Online Safety Act 2023. Offenders can be fined or imprisoned.
• This offence applies only to images of adults, as there is an equivalent offence for images of children.

As there is no single AI statute, territorial scope depends on the underlying legal regime.

Generally:

• UK laws apply where there is a sufficient territorial nexus to the UK.
• For example, UK GDPR applies to:
  • Organisations established in the UK; and
  • Non-UK organisations offering goods or services to or otherwise monitoring UK individuals.

Unlike the EU AI Act, the UK does not currently assert a broad extraterritorial AI-specific reach.

UK businesses serving EU markets must also comply with the applicable provisions of the EU AI Act, which does have extraterritorial reach.

The current UK framework is cross-sector by design but implemented through sector regulators. All sectors fall within scope.

There is no single AI regulator in the UK. Instead, supervision and enforcement sit with existing regulators, including:

• Information Commissioner’s Office (ICO) – data protection and privacy
• Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) – financial services
• Ofcom– online services and communications
• Competition and Markets Authority (CMA) – competition and consumer protection
• Medicines and Healthcare products Regulatory Agency (MHRA)– AI as medical devices

Regulators are expected to align their approaches with the central AI principles set by Government.

The UK Government Department for Science, Innovation & Technology (DSIT) coordinates risk monitoring and regulator capability building via the Office for AI.

DSIT has also published a non-binding code of practice on AI cyber security, as part of its modular approach to guidance on cyber security.

Cross-sector bodies like the Digital Regulation Cooperation Forum (DRCF) and the Regulatory Innovation Office (RIO) support harmonisation and innovation, while sector-specific public bodies (e.g. NHS health boards, such as NHS England) support the relevant regulators.

The AI Security Institute (formerly the AI Safety Institute, renamed in February 2025) oversees testing of advanced AI models and publishes safety reports.

These bodies generally do not have direct enforcement powers over private actors but influence standards and best practice.

Subject to new criminal offences (outlined below), there are currently no AI-specific fines or penalties simply for developing or using AI as such. Instead, enforcement relies on existing laws and the remedies available under those laws. For example:

• ICO can impose fines under UK GDPR (up to £17.5m or 4% of global turnover).
• Regulatory sanctions in financial services (fines, permissions, remediation).
• Enforcement notices, injunctions and civil liability.

Criminal sanctions

New offences under the Crime and Policing Act 2026 (“CPA”), which received Royal Assent on 29 April 2026, with commencement of various provisions from 29 June 2026. The existing offences of creating purported intimate images of an adult and requesting the creation of such images (including AI-generated deepfakes) are made priority offences under the Online Safety Act 2023. Regulated online platforms will be required not only to remove such content from their services when they become aware of it, but also to take steps to prevent such content from appearing in the first place.

The CPA creates a new criminal offence relating to the making, adapting, possessing, supplying or offering to supply "CSA image-generators". A CSA image-generator is a tool which is "made or adapted for use for creating, or facilitating the creation of, CSA images", including AI models that have been optimised to create CSA material (CSAM). While AI-generated CSAM is already illegal to make, possess and distribute in the UK, these fine-tuned models are not currently illegal. This offence applies to corporate bodies as well as individuals.

The CPA creates a new offence of making, adapting, supplying or offering to supply a "thing" (including a program, information in electronic form and a service) for use as a "generator of purported intimate images", which is defined as a "thing for creating, or facilitating the creation of, purported intimate images of a person". This covers AI deepfakes. Again, this offence applies to corporate bodies.