Safe and secure
AI should work reliably and be protected from misuse and attack.
The UK approach
Rules by sector, not one rulebook
In 2023 the government chose what it calls a "pro-innovation" approach. Rather than writing a new AI law, it set out five principles and asked existing regulators to apply them to AI in the areas they already look after. The idea: a hospital AI and a bank AI raise different problems, so they should be judged by people who know those fields.
Transparent and explainable
People should be able to find out when AI is used and roughly how it reaches its answers.
Fair
AI mustn't discriminate against people or lead to unfair outcomes.
Accountable
There must be a clear person or organisation responsible for how it's used.
Open to challenge
People should be able to contest a harmful AI decision and get it put right.
Is a UK AI law coming? The current government has said it intends to bring in binding rules for the companies building the most powerful AI models, and has consulted on how copyright should apply to AI training. At the time of writing, no dedicated UK AI Act has become law — check for the latest before relying on this.
Who's in charge
The watchdogs keeping an eye on AI
If something goes wrong with AI in the UK, the right place to go depends on what went wrong. Several of these regulators co-ordinate through the Digital Regulation Cooperation Forum.
Information Commissioner's Office
Your personal data. Covers AI trained on or making decisions from information about you, including decisions made purely by computer.
UK GDPR · Data Protection Act 2018 · Data (Use and Access) Act 2025Financial Conduct Authority
Banks, insurers, lenders and investment firms. AI used on customers must still deliver fair outcomes.
Consumer Duty · Senior Managers regimeCompetition and Markets Authority
Stops big tech firms using AI to dominate markets, and protects shoppers from misleading AI-driven practices.
Digital Markets, Competition and Consumers Act 2024Office of Communications
Online safety. AI chatbots and generative tools built into online services must protect users, especially children.
Online Safety Act 2023Medicines and Healthcare products Regulatory Agency
AI used to diagnose or treat people is regulated as a medical device and must be proven safe.
Medical Devices Regulations 2002Equality and Human Rights Commission
AI that treats people unfairly because of age, race, sex, disability or other protected characteristics breaks equality law.
Equality Act 2010AI Security Institute
A government body that tests the most advanced AI models for serious risks. It researches and advises rather than issuing fines.
Part of the Department for Science, Innovation and TechnologyPublic sector
Central government departments are expected to publish records of the algorithmic tools they use to make decisions about the public.
Algorithmic Transparency Recording StandardAlready the law
Existing laws that already cover AI
"No AI Act" is easy to misread. Plenty of UK law applies to AI simply because it applies to everything.
Data protection
You have the right to be told how your data is used, and safeguards apply when a computer makes a significant decision about you with no human involved.
Equality
An employer or service can't hide behind "the algorithm did it" if the outcome is discriminatory.
Consumer protection
Fake AI-generated reviews and misleading AI claims about products are unlawful.
Deepfakes and abuse
Sharing sexually explicit deepfakes without consent is a criminal offence, and the law has been extended to cover creating them too.
Online safety
Platforms must tackle illegal and harmful content, whether a person or an AI made it.
Product safety and negligence
If an AI-powered product injures someone, the usual rules on liability still apply.
Side by side
The UK and the EU compared
| United Kingdom | European Union | |
|---|---|---|
| The law | No single AI law. Existing laws plus five principles. | One regulation — the AI Act (EU) 2024/1689 — applying across 27 countries. |
| How risk is handled | Each regulator judges risk in its own sector. | Four fixed risk levels, from banned to minimal. |
| Banned uses | No AI-specific ban list; harmful uses are caught by existing law. | A defined list, e.g. social scoring and emotion-reading at work. |
| Who enforces | ICO, FCA, CMA, Ofcom, MHRA and others. | The EU AI Office plus a watchdog in each member state. |
| Big AI models | Voluntary testing with the AI Security Institute; binding rules proposed. | Legal duties for general-purpose AI since August 2025. |
| Penalties | Under each existing law, e.g. data breaches up to £17.5m or 4% of turnover. | Up to €35m or 7% of worldwide turnover. |
| Selling point | Flexible and quick to adapt. | Clear, predictable rules across one big market. |
Brexit doesn't switch it off
When the EU AI Act applies to UK businesses
The EU Act follows the AI, not the company's address. A UK firm is covered when it puts AI on the EU market, or when the output of its AI is used in the EU. Non-EU makers of high-risk systems and general-purpose models must also appoint a representative inside the EU.
Many UK firms are choosing to meet the EU standard anyway: it's simpler to build one product to the strictest rules than two different versions.
Northern Ireland has special trading arrangements with the EU for goods. If you place AI-enabled products on the market there, take specific advice.
Real examples
In practice
A Manchester start-up selling CV-screening software to recruiters in Dublin
It's a provider of high-risk AI on the EU market. It needs the full high-risk safeguards, an EU representative, and registration.
A London retailer with a website chatbot serving shoppers in France
Chatbots must tell people they're talking to AI. Limited-risk transparency rules apply.
A Leeds building society using AI to score UK mortgage applicants
No EU link, so the EU Act doesn't apply. The FCA's Consumer Duty, UK GDPR and the Equality Act all do.
A Cardiff café using AI to plan its stock orders
Minimal risk and UK-only. Normal law applies. Nothing AI-specific to do, but it helps if staff understand the tool.
If you live in the UK
What this means for you
You don't get the EU Act's rights unless a service is covered by it. But UK law still protects you.
Test yourself: take the AI Act Crew quiz, for adults or kids.Ask what data was used
You can ask any organisation for a copy of the personal information it holds about you, including what fed into an AI decision.
Challenge computer-only decisions
When a significant decision about you is made by a computer alone, you can ask for a human to look at it again.
Fight unfair treatment
Discrimination is unlawful whether a person or an AI made the call.
Go to the right watchdog
Data misuse → ICO. Bank or insurer → Financial Ombudsman, then FCA. Harmful online content → Ofcom. Medical AI → MHRA.
Thought leadership
Two rulebooks, one strategy
UK organisations increasingly have to satisfy UK regulators at home and the EU AI Act abroad. Apollo AI and Private Equity Systems help businesses build AI that stands up to both.
Apollo AI Ltd
Delivering AI solutions for customers since 2017, and designing them to be transparent, overseen by people and ready for regulation in both the UK and the EU.
Visit apolloai.co.ukPrivate Equity Systems Ltd
A London consultancy helping private equity, hedge funds and asset managers implement technology and meet FCA, ECB and AIFMD obligations. That same discipline now applies to AI.
Visit privateequitysystems.comOur view: design for the stricter rulebook
If there's any chance your AI will touch EU customers, build to the EU AI Act from day one. Its requirements for records, human oversight and transparency also line up with what UK regulators are asking for, so one well-governed system can serve both markets.