UK & EU AI Regulation:
What Applies, What Doesn't.
Every key AI regulation and standard relevant to UK businesses, tracked in one place. Grouped by what actually applies to you, sourced from the authoritative text, and verified against the latest legislative changes including the 2026 Digital Omnibus deferral.
UK Law
These rules apply to UK businesses today, regardless of any EU exposure.
UK approach: no AI Bill yet, DSIT AI Growth Lab
ConditionalThe UK has no primary AI Bill and a sector-led, principles-based approach. DSIT consulted on an AI Growth Lab regulatory sandbox. Watch this space, but nothing here is a duty today.
UK GDPR Article 22 (reformed by the DUAA 2025)
Duty todayThe Data (Use and Access) Act 2025 reformed the rules on solely-automated decisions with legal or similarly significant effects on people. In force now and it bites on hiring, credit, insurance and pricing.
ICO automated decision-making and profiling guidance
ConditionalThe ICO consulted on new draft guidance on automated decision-making and profiling under the reformed rules, with a focus on AI in recruitment. Final guidance is expected in Summer 2026; the direction is more explicit expectations, not fewer.
EU AI Act
Hard law only if your AI is used in the EU market. A voluntary benchmark for purely UK operations.
EU AI Act: prohibited practices
ConditionalThe outright bans on unacceptable AI uses (for example social scoring and untargeted facial-image scraping) already apply.
EU AI Act: general-purpose AI model obligations
ConditionalTransparency and documentation duties for providers of general-purpose AI models apply.
EU AI Act: transparency duties (Article 50)
ConditionalDuties to tell people when they are interacting with AI or seeing AI-generated content. This date did not move in the 2026 reform, though the watermarking obligation has a grace period to 2 December 2026.
EU AI Act: watermarking grace period ends (Article 50)
ConditionalThe machine-readable watermarking requirement under Article 50 has a grace period running to 2 December 2026. The primary disclosure duty (telling people when content is AI-generated) applies from 2 August 2026; watermarking compliance must follow by December 2026.
EU AI Act: ban on AI-generated non-consensual intimate imagery
ConditionalThe Digital Omnibus added a new outright ban on AI systems that generate non-consensual intimate imagery or nude depictions of real people. It applies from December 2026 and sits in the same prohibited-practices category as social scoring and mass biometric surveillance.
EU AI Act: high-risk systems (Annex III)
ConditionalObligations for stand-alone high-risk systems (such as recruitment and credit scoring) were deferred to December 2027. Both EU co-legislators have now adopted this change: the European Parliament on 16 June 2026 and the Council on 29 June 2026. It becomes binding once it is published in the EU Official Journal and enters into force three days later; as of late June 2026 it is adopted but not yet published or in force.
EU AI Act: high-risk AI in regulated products (Annex I)
ConditionalObligations for high-risk AI embedded in already-regulated products were deferred to August 2028. Both EU co-legislators have now adopted this change: the European Parliament on 16 June 2026 and the Council on 29 June 2026. It becomes binding once it is published in the EU Official Journal and enters into force three days later; as of late June 2026 it is adopted but not yet published or in force.
Voluntary Standards
Internationally recognised frameworks. Not law, but increasingly expected by procurement, insurers and enterprise clients.
NIST AI Risk Management Framework
VoluntaryA widely used voluntary framework for identifying and managing AI risks. A practical reference point for building governance.
ISO/IEC 42001 (AI management system standard)
VoluntaryThe first certifiable international standard for AI management systems. Voluntary, but increasingly asked for by procurement and insurers.
AI Management Essentials (AIME) - shelved
ShelvedDSIT's proposed AI Management Essentials tool was shelved in its 2026 consultation response. We do not present AIME as a live framework; our methodology is grounded in ISO/IEC 42001 and the NIST AI RMF.
Find out which of these apply to you
The tracker shows the landscape. The free 10-minute scorecard shows your position within it: which rules bite for your sector, your AI use, your EU exposure. RAG-rated results delivered to your inbox.