Last reviewed: April 10, 2026
Jurisdictions covered: UK (primary), EU (comparison)
Reading time: 17 minutes
Does the UK Have an AI Law? The Six Laws That Apply, the Three Bills That Don’t, and What Comes Next
Does the UK have an AI law? No — and yes.
No, the UK has no cross-sector AI-specific law equivalent to the EU AI Act. No single regulation governs how AI systems are developed, deployed, or monitored. No AI authority exists with binding enforcement powers.
Yes, the UK has six enacted laws with AI-relevant provisions that are already binding and enforceable. The Data (Use and Access) Act 2025 reformed automated decision-making rules. The Online Safety Act 2023 covers AI-generated harmful content. The Automated Vehicles Act 2024 governs autonomous driving AI. The Equality Act 2010 prohibits algorithmic discrimination. These are real obligations with real penalties — they just are not called “AI laws.”
Three AI-specific bills have been proposed. None has passed. A government AI bill has been promised since 2024 but has not been introduced. The King’s Speech is confirmed for May 13, 2026, and multiple observers predict it will again contain nothing on AI legislation.
This article maps what already applies, what has been proposed, why the gap exists, and what practitioners should do while they wait.
Key Takeaways
- The UK has no cross-sector AI law, but six enacted laws contain AI-relevant provisions that are already binding: DUA Act 2025, Online Safety Act 2023, Automated Vehicles Act 2024, DMCCA 2024, Equality Act 2010, and PSTI Act 2022.
- Three AI bills have been proposed — a government bill (promised but not introduced), Lord Holmes’s AI (Regulation) Bill (proposes an AI Authority), and Lord Clement-Jones’s Public Authority ADM Bill. None has progressed to become law.
- The copyright impasse is the primary blocker. The government abandoned its preferred TDM exception in March 2026 after 88% of consultation respondents opposed it. No replacement has been proposed.
- Enforcement without a binding law is fragmented and slow. The ICO’s Clearview AI fine has been contested for over four years. Only £55,000 of £3 million in Ofcom fines has actually been collected. Police facial recognition remains unregulated despite court rulings of unlawfulness.
- 89% of the UK public supports an independent AI regulator with enforcement powers (Ada Lovelace/Turing survey, December 2025, 3,513 nationally representative respondents).
What Laws Already Apply to AI in the UK?
The “no AI law” framing misses the reality on the ground. Six enacted laws already impose binding obligations on organizations using AI:
| Law | AI-Relevant Provision | Binding? | Enforcer | Max Penalty |
|---|---|---|---|---|
| Data (Use and Access) Act 2025 | Section 80: Reforms ADM framework — organizations must implement safeguards (notification, right to challenge, human intervention) for significant automated decisions | Yes (from Feb 2026) | ICO | £17.5M or 4% turnover |
| Online Safety Act 2023 | AI-generated CSAM, deepfakes, and harmful AI content in scope. Platforms must assess and mitigate AI-generated risks | Yes (from March 2025) | Ofcom | £18M or 10% revenue |
| Automated Vehicles Act 2024 | Safety standard for autonomous driving AI. Liability shifts to manufacturer when automated features engaged | Yes (from Jan 2026) | DVSA + courts | Criminal liability for manufacturers |
| DMCCA 2024 | Strategic Market Status designation applies to AI firms. Google designated Oct 2025 (AI Overviews in scope) | Yes (from Jan 2025) | CMA | 10% global turnover |
| Equality Act 2010 | Prohibits algorithmic discrimination in employment, services, housing. Indirect discrimination from AI with disparate impact on protected characteristics | Yes | EHRC + courts | Unlimited (employment tribunal) |
| PSTI Act 2022 | Applies to smart devices with embedded AI. No default passwords, security update periods | Yes (from April 2024) | OPSS | £10M or 4% turnover |
Two additional laws create the framework for specific AI applications. The National Security and Investment Act 2021 designates AI as one of 17 mandatory notification sectors for foreign investment — a March 2026 consultation narrowed the scope to AI developers and modifiers, excluding off-the-shelf AI users. The Product Regulation and Metrology Act 2025 grants the Secretary of State broad delegated powers to regulate products containing AI, though no AI-specific regulations have been issued under it yet.
The DUA Act deserves particular attention. Section 80 is the most significant AI-relevant legislative change in the UK. It replaces the old UK GDPR Article 22 framework, which generally prohibited solely automated decisions with legal or significant effects. The new framework does not prohibit ADM outright but requires mandatory safeguards: organizations must inform individuals, enable representations and challenges, and allow human intervention. This is a meaningful shift from the EU’s GDPR approach, where Article 22 maintains a general prohibition with narrow exceptions. The ICO launched a public consultation on draft ADM guidance on March 31, 2026 (closing May 29) — the first formal interpretation of Section 80 in practice.
What AI Bills Have Been Proposed?
Three separate legislative tracks exist, each with different prospects:
| Bill | Sponsor | Proposes | Status (April 2026) | Prospects |
|---|---|---|---|---|
| Government AI Bill | DSIT (Peter Kyle, Secretary of State) | Accountability for frontier models, regulator coordinator, consumer redress, testing requirements, copyright | Not introduced. Promised in 2024 King’s Speech; delayed over copyright dispute | May appear H2 2026 at earliest. King’s Speech May 13 unlikely to include it |
| AI (Regulation) Bill [HL] | Lord Holmes of Richmond | AI Authority to coordinate regulators, issue binding codes, accredit AI auditors, identify gaps | Active but not progressing. Introduced March 4, 2025. Has not reached Committee stage | Lacks government backing. Predecessor passed Lords May 2024 but died when Parliament dissolved |
| Public Authority ADM Bill [HL] | Lord Clement-Jones | Transparency and fairness requirements for public sector algorithmic systems | Active. Introduced September 2024 | Symbolic — raises the issue but unlikely to pass without government support |
Lord Holmes published a Parliamentary One-Pager (February 3, 2026) urgently pushing for cross-economy AI legislation. In the Lords debate on AI (December 2025), Lord Clement-Jones called for “binding legislation, not advisory powers” and warned against waiting for AGI/superintelligence before regulating existing AI harms.
The Parliamentary Communications and Digital Committee called for “comprehensive AI law” in April 2026. The Joint Committee on Human Rights launched an inquiry into the adequacy of the existing legal framework in July 2025. The Treasury Committee warned (January 2026) that the FCA and Bank of England are “exposing the public to potentially serious harm” through their “wait-and-see approach” on AI.
Why Hasn’t the Government Introduced an AI Bill?
Three factors explain the delay:
1. The copyright impasse. This is the primary blocker. DSIT Secretary of State Peter Kyle confirmed in mid-2025 that the bill was delayed to develop a “more comprehensive legislative framework” addressing both AI safety and copyright. The government’s initial preferred position — a broad text and data mining (TDM) exception with opt-out — was abandoned in March 2026 after 88% of 11,000+ consultation respondents opposed it. No replacement position has been proposed. The government’s own report acknowledges that “permission would usually be needed to copy protected works at different stages of AI training” — but offers no mechanism for obtaining that permission at scale.
2. Deliberate US alignment. The Starmer government has signaled alignment with the US approach — light regulation, growth-first, voluntary commitments — rather than the EU’s binding framework. The AI Opportunities Action Plan (January 2025) committed to 20x compute growth, £100 billion private investment, and five AI Growth Zones. The AI Safety Institute was rebranded to the AI Security Institute (February 2025), narrowing its mandate to national security and away from broad safety concerns.
3. Sector-first preference. The government maintains that existing sector regulators applying existing powers is the right model. The January 2026 DSIT/DBT letter directing all 19 regulators to publish AI innovation plans by May 2026 is the latest expression of this approach — building from the bottom up rather than legislating from the top down.
What Happens Without a Binding Law?
The enforcement record shows what the voluntary approach produces in practice:
Contested, slow-moving cases. The ICO fined Clearview AI £7.5 million in 2022 for processing UK residents’ facial data. Clearview appealed. The First-Tier Tribunal overturned the fine in October 2023. The Upper Tribunal reinstated ICO jurisdiction in October 2025. Clearview then obtained permission to appeal to the Court of Appeal in December 2025. As of April 2026 — four years after the original complaint — the enforcement notice has not been enforced and Clearview has not deleted UK data.
Police AI essentially unregulated. No legislation authorizes or restricts police use of live facial recognition. The Court of Appeal ruled in Bridges v South Wales Police (2020) that automated facial recognition was unlawful as deployed. No legislation resulted. The Metropolitan Police conducted 180 LFR deployments in 2024 and 231 in 2025, including installing fixed cameras in Croydon. The EHRC stated in 2025 that it believes the Met’s use is unlawful — but has taken no enforcement action. Essex Police paused its LFR system in March 2026 after an internal study found racial bias. The pattern repeats: deployment, controversy, judicial review, no legislative change.
Public sector algorithms fail without proactive oversight. The A-level algorithm (reversed August 2020 after downgrading 36% of predicted grades). The Home Office visa streaming algorithm (withdrawn before judicial review). The DWP Universal Credit algorithm (High Court ruled unlawful January 2025; DWP confirmed it will not appeal). In each case: deployed, failed, discovered through litigation or FOI, withdrawn or reformed. No binding legislation prevents the next failure.
OSA enforcement is active but collection is weak. Ofcom is the most active UK AI enforcer by volume — approximately 30 companies under investigation covering 96 sites in early 2026. But of £3 million in fines issued, only £55,000 has actually been collected. The X/Grok investigation (opened January 2026) is the first major AI-specific OSA case, after the chatbot generated approximately 3 million sexualized images in 11 days. On February 16, 2026, the government announced it would close a legal loophole by bringing AI chatbot providers within scope of illegal content duties — tacitly acknowledging the existing framework had a gap.
What Is the May 2026 Deadline?
On January 28, 2026, DSIT and DBT directed all 19 sector regulators to publish “AI innovation plans” by May 2026 — explaining how each regulator will enable safe AI adoption in its sector.
As of April 2026, only the Bank of England and PRA have responded early (April 1, 2026), committing to publish a full plan in H1 2026. No other regulator has published. Several Tier 3 regulators — Ofwat, ORR, Environment Agency — have zero identified AI governance activity.
When all 19 plans are published, the picture of UK AI governance will be substantially clearer. Until then, the sector model has a structural gap: the four Tier 1 regulators (ICO, FCA, CMA, Ofcom) are highly active, while Tier 3 regulators are effectively silent.
How Does This Compare to the EU?
| Dimension | UK | EU |
|---|---|---|
| Cross-sector AI law? | No (H2 2026 at earliest) | Yes — AI Act in force |
| AI-relevant enacted laws | Six (DUA Act, OSA, AV Act, DMCCA, Equality Act, PSTI Act) | One comprehensive regulation + sectoral |
| Enforcement body | 19 sector regulators, no central authority | AI Office + national authorities |
| ADM framework | Safeguards required, not prohibited (DUA Act Section 80) | Generally prohibited with exceptions (GDPR Art. 22) |
| Max penalty | £18M or 10% revenue (Ofcom/OSA); £17.5M or 4% (ICO) | EUR 35M or 7% global turnover |
| Copyright/AI training | Legislative limbo (March 2026) | TDM opt-out framework (Directive 2019/790) |
For the full 10-dimension comparison, see our UK vs EU AI Regulation guide.
What Should Practitioners Do Now?
1. Map which existing laws apply to your AI system. The six enacted laws in the table above may already impose binding obligations. DUA Act Section 80 applies to any organization making significant automated decisions about individuals. OSA applies to platforms hosting AI-generated content. Equality Act applies to any AI system that affects access to employment, services, or housing.
2. Identify your sector regulators. The ICO covers all AI that processes personal data. Beyond that, your sector determines your regulator. Financial services: FCA + PRA. Healthcare: MHRA + CQC. Online platforms: Ofcom. Check what your regulator has published on AI governance.
3. Monitor the ICO ADM consultation. The draft guidance on automated decision-making (launched March 31, 2026, closing May 29) will be the first formal interpretation of DUA Act Section 80. This will define what “meaningful human involvement” and “safeguards” mean in practice. Respond to the consultation if ADM affects your business.
4. Watch the May 2026 regulator plans. All 19 regulators must publish AI innovation plans. These will define sector-specific expectations. If you operate in a Tier 3 sector (energy, rail, water, environment), this will be the first AI-specific guidance from your regulator.
5. If you serve EU customers, comply with the EU AI Act regardless. The EU AI Act applies extraterritorially (Art. 2) to non-EU providers whose AI output reaches the EU. UK companies with EU market exposure face the EU’s binding obligations in addition to whatever UK regulators require. For most dual-market companies, the EU standard is the practical baseline.
What Happens Next?
May 13, 2026: King’s Speech. If no AI Bill appears — as multiple observers predict — the sector-based voluntary model continues without a legislative anchor. If one does appear, it will likely focus on frontier models and copyright, not comprehensive AI regulation.
May 2026: Regulator AI innovation plans. The 19-regulator deadline. This is the UK’s real regulatory moment — not legislation, but sector-specific governance frameworks that will define compliance expectations for the next two to three years.
May 29, 2026: ICO ADM consultation closes. The resulting guidance will shape how Section 80 of the DUA Act operates in practice.
August 2, 2026: EU AI Act enforcement. The EU AI Office gains full enforcement powers. UK companies serving EU customers face binding obligations from this date. The gap between UK voluntary principles and EU binding rules becomes operationally real.
The question is not whether the UK will eventually introduce binding AI legislation. Every expert consulted in the UK’s own policy debates acknowledges this. The question is whether it will happen before a major AI-related harm forces the government’s hand — or after.
Disclaimer: This content is for informational purposes only and does not constitute legal advice. UK AI governance is distributed across multiple sector regulators and evolving rapidly. Organizations should consult qualified legal counsel. Reg Intel is not a law firm and does not provide legal services.
Last verified: April 10, 2026
Sources
Official Sources
- DSIT/DBT Joint Letter to 19 Regulators, January 28, 2026
- Data (Use and Access) Act 2025
- UK Government Report on Copyright and AI, March 18, 2026
- AI (Regulation) Bill — Parliament Bills Tracker
- Bank of England/PRA Response to DSIT, April 1, 2026
- ICO Consultation on ADM Guidance, March 31, 2026
- House of Commons Library: AI Regulation in the UK, March 31, 2026
Analysis and Commentary
- Ada Lovelace Institute / Alan Turing Institute: Attitudes to AI survey, December 2025 (3,513 respondents, nationally representative)
- Lord Chris Holmes, “The urgent need for UK AI legislation now”, February 3, 2026
- Lord Chris Holmes, “The upcoming King’s Speech: where are the words on AI?”, Computer Weekly, March 16, 2026
- Tech Policy Press: UK Seeks More OSA Powers for AI, April 8, 2026
- ICO, “ADM in Recruitment” report, March 31, 2026
Enforcement Data
- ICO: Clearview AI £7.5M fine (2022; contested 4+ years, Court of Appeal pending)
- Ofcom: ~30 companies under investigation; £3M fines issued, £55K collected
- Ofcom: X/Grok investigation (January 2026); ~3M sexualized images generated in 11 days
- Essex Police: LFR paused over racial bias (March 2026)
- Bridges v South Wales Police [2020] EWCA Civ 1058
- DWP Universal Credit: High Court ruled algorithm unlawful (January 2025)
Compare: EU vs UK
For the comprehensive comparison across twelve dimensions — structural divergence, risk classification, the 19 UK regulators vs the EU AI Office, enforcement penalties, the Data (Use and Access) Act 2025, AISI vs the EU AI Office, and a five-step dual-market compliance baseline — see EU vs UK AI Regulation: Precaution vs Innovation Compared (2026).