AI Regulation UK: What Businesses Must Prepare For

AI-related obligations depend on what a system does, the data it uses, the organisation’s role, and the jurisdictions it touches. A chatbot, a hiring filter, and an invoice extractor cannot be assigned the same duties simply because they use a model.

Legal sources checked on 15 September 2026. This is general operational guidance, not a legal determination for a particular system.

UK Rules and Guidance

Existing UK data protection, equality, consumer, sector, and other applicable law can govern AI use. The government’s 2023 AI white paper describes a regulator-led policy approach. It is a policy document, not a complete statement of current legal duties or a substitute for checking later legislation.

UK GDPR applies when personal data is processed, including through AI. The presence of a model does not make all input data personal data, and using AI does not exempt personal-data processing from the law.

The Data (Use and Access) Act 2025 changed UK data protection law. Most Part 5 data protection and privacy provisions commenced on 5 February 2026, according to the government’s commencement guidance.

For significant decisions based solely on automated processing, the revised framework permits a wider range of uses subject to safeguards. These include information about the decision, making representations, human intervention, and contesting it. Stricter conditions remain for special-category data. It is inaccurate to say every significant AI-assisted action must always be approved by a person before it happens. See the ICO’s explanation of the changes.

Check sector-specific duties with the relevant regulator. A general AI checklist cannot establish compliance with financial-services, employment, or other specialist requirements.

When the EU AI Act Can Reach a UK Business

The EU AI Act can apply to organisations outside the Union, including providers placing systems or general-purpose models on the EU market and certain providers or deployers whose system outputs are used in the EU. Scope depends on the facts and the organisation’s role; having an EU customer alone does not identify every applicable duty. Start with Article 2.

The Commission reports that the AI Omnibus entered into force on 27 July 2026. Its updated dates include 2 December 2027 for Annex III high-risk rules and 2 August 2028 for high-risk systems embedded in regulated products. Those extensions do not defer every AI Act obligation. See the Commission’s notice.

Transparency obligations require a separate assessment. Article 50 includes disclosure for systems intended to interact directly with people, subject to stated exceptions, and distinct obligations for certain generated content. The relevant duty can fall on a provider or deployer depending on the provision. Do not replace that analysis with “every generative system must display the same banner”. See Article 50.

Assess the Actual Use

Describe the intended purpose and the decisions the system influences. Then establish:

Who provides, deploys, or modifies the system.
Whether it processes personal data or special-category data.
Whether outputs affect individuals’ rights, opportunities, or access to services.
Whether the EU market or use of outputs in the EU brings it within scope.
Which statutory classifications and sector rules apply.

Labels such as “low”, “medium”, and “high” can help an internal review, but an informal three-level checklist is not an EU AI Act classification. A product’s name does not determine its legal risk category.

Risk Assessment and Documentation

A UK GDPR data protection impact assessment (DPIA) is required where processing is likely to result in high risk to people’s rights and freedoms. That is not the same test as whether a system is classified as high-risk under the EU AI Act. See the ICO’s DPIA criteria.

As an operational starting point, keep:

Record	What it should explain
System description	Purpose, users, models, tools, and permitted actions
Data map	Inputs, recipients, processors, locations, access, and retention
Assessment	Applicable duties, risks, controls, and accountable decisions
Testing evidence	Cases tested, errors found, mitigations, and remaining limits
Review procedure	Who can intervene and how a person can challenge an outcome
Supplier file	Relevant terms, subprocessors, deletion, export, and exit arrangements

These records support a review. They are not a certificate, and one generic file does not automatically satisfy several legal regimes. Required content and retention depend on the applicable duty.

Controls to Build into the System

Keep enough evidence to investigate a disputed output while applying the retention and access rules in the data map. For a retrieval assistant, that may include the model version, source identifiers, actions taken, and reviewer decisions.

Make review mechanisms usable. A person asked to approve an action needs enough context and authority to change it. Logging a click alone does not establish meaningful review.

Test factual accuracy, access controls, and relevant error patterns when models or prompts change. If testing requires sensitive information, establish the applicable processing conditions before collecting it.

Readiness Checklist

List the AI systems in use and their owners.
Describe each purpose and permitted action.
Identify personal-data processing and its lawful basis.
Record the DPIA screening decision and complete one where required.
Assess EU scope, operator roles, classifications, and application dates.
Implement the transparency duties that apply to that system.
Provide required safeguards and an effective challenge or review route.
Set proportionate logging, access, and retention.
Keep test results and reassess after material changes.
Review supplier terms and unresolved questions with the responsible adviser.

Use the checklist to find missing work. Resolve system-specific legal questions before treating a deployment as compliant.

Where Fernside Fits

Advisory here is operational, not legal advice: inventory, proportionate controls, logging and review paths, and a paper trail your counsel or DPO can use. We will say when a use case needs a solicitor before it needs another model.

Want a readiness pass on the systems you already run? Book a discovery call and we will walk the checklist against your stack.