There is no AI statute in Britain and no government AI bill before Parliament. That is the part most summaries get right. The part they miss is that the rule governing automated decisions about people was replaced in February 2026, the ICO now has a statutory duty to write an AI code, and five instruments already reach the AI most organisations actually use.
Plain-language summary, not legal advice. Every instrument, date and status on this page was checked against a primary or first-party source on 2026-09-05.
Under the old Article 22 a solely automated decision with a legal or similarly significant effect was banned unless an exception applied. Under the new Article 22C, for decisions that do not rely on special-category data, you may make that decision without an exception — provided the person is told, can make representations, can obtain human intervention and can contest it. Special-category decisions stay restricted under Article 22B.
Read plainly: the law got more permissive and the evidence burden got heavier at the same moment. Permission is now something you demonstrate with records, not something you argue from an exception — and the ICO’s forthcoming code will decide what those records need to look like.
Source: Data (Use and Access) Act 2025, s. 80 and Sch. 6; commenced by SI 2026/82, reg. 2 — legislation.gov.uk.
There is no single statute to point at, which is precisely why this is hard to look up. These are in force now. Read the first two if you make decisions about people; the Equality Act if you hire.
Replaced the old Article 22 prohibition with permission subject to safeguards: for decisions not based on special-category data, a controller may make a significant automated decision without an exception, provided it gives the person information about the decision, lets them make representations, obtains human intervention on request and lets them contest it (Art. 22C). Decisions using special-category data stay restricted (Art. 22B).
In force 5 February 2026. Applies to: Any controller making a decision about a person by solely automated means with a legal or similarly significant effect. Data (Use and Access) Act 2025, s. 80 and Sch. 6, inserting Arts. 22A–22D into the UK GDPR
Lawful basis, transparency, data-protection impact assessments for high-risk processing (including most profiling), subject access — one calendar month to respond — and the accountability principle that makes 'show me the record' the regulator's opening question. This is the law the ICO enforces AI under today.
In force since 25 May 2018; amended by the 2025 Act. Applies to: Anyone processing the personal data of people in the UK. Retained Regulation (EU) 2016/679 (UK GDPR); Data Protection Act 2018
Requires the Commissioner to prepare a code of practice on good practice in processing personal data when developing and using AI and automated decision-making. Draft ADM guidance went to consultation in spring 2026; the statutory code itself is not expected to take effect before 2027.
Regulations in force 12 May 2026 · code expected 2027. Applies to: The Information Commissioner — the code, once made, will bind how the ICO reads the law for everyone else. Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, SI 2026/425 — the code's 2027 timing is the ICO's stated expectation, not a statutory date
Indirect discrimination does not need intent: a screening or scoring tool that disadvantages a protected group is unlawful whoever built it. Public bodies must also show due regard to equality when they deploy AI — the algorithmic equality assessment the UK controls call for.
In force since 1 October 2010. Applies to: Employers, service providers and public bodies. Equality Act 2010, incl. the public sector equality duty (s. 149)
Duties of care over illegal and harmful content, which reach AI-generated material and generative features inside a regulated service; Ofcom's codes set out how they are met.
Royal Assent 26 October 2023 · duties phased in through 2025. Applies to: User-to-user and search services reaching UK users, policed by Ofcom. Online Safety Act 2023
The UK chose principles over a statute. The principles are policy; the one AI bill in Parliament is a private member’s bill. Neither creates an obligation on its own.
Would establish an AI Authority to coordinate existing regulators, require regulatory sandboxes, and impose transparency and record-keeping duties on businesses developing or deploying AI. A private member's bill: it has had a Lords second reading and no government backing, and no government AI bill has been introduced.
Introduced 4 March 2025 · not law. Private member's bill, House of Lords, introduced 4 March 2025 by Lord Holmes of Richmond. Source: UK Parliament, bills.parliament.uk/bills/3942. — the current stage could not be re-read on the verification date; treat it as a live bill that has not passed either House
Safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress. Not a statute — the government chose to route AI through existing regulators rather than write an AI Act, and that choice is why UK compliance means answering the ICO, the CMA, the FCA, Ofcom and the EHRC rather than one authority.
March 2023 · February 2024. A pro-innovation approach to AI regulation (White Paper, March 2023) and the government response (February 2024). Source: GOV.UK.
If a summary tells you the UK has an AI Act, or gives you a compliance date for one, check it against Parliament’s own bill status page. It is public, free, and settles the question in about a minute.
None of these instruments turns on where you are incorporated. They turn on whose decisions you are making — which is why a US company with a London office and a UK customer list is inside all three.
Credit, eligibility, pricing, hiring, renewal. If the decision is solely automated, Articles 22A to 22D attach — and have since February.
Then the Equality Act reaches it whoever built it. Indirect discrimination does not need intent, and the employer is the one who answers for it.
Then the UK GDPR already applies to whatever your models do with it — including the impact assessment before deployment and the one-month clock on a subject access request.
Any yes? You are already inside UK AI regulation, whatever Parliament does next. All three no? You still need an AI policy — just not this one. And if you also sell into the EU, the AI Act applies on its own terms, with its own dates.
Read the two automated-decision instruments beside the Equality Act and they converge on the same evidence. Article 22C words it as safeguards, the ICO as accountability, the EHRC as an equality assessment — but a regulator asking any of them is asking to see the same four things.
An inventory naming every tool that touches a decision about a person, what it does, what personal data it uses, and a single accountable owner — a person, not a department. The UK GDPR's accountability principle starts here, and so does the ICO.
A data-protection impact assessment before a high-risk tool goes live is a UK GDPR duty, not a nicety — and an algorithmic equality assessment is what the Equality Act's public-sector duty asks for. Both are records of someone having looked, and of what was done about what they found.
Article 22C's first safeguard is information about the decision, given to the person. A privacy notice that mentions 'automated processing' in passing is not that; a record of what was said, to whom, and when, is.
Human intervention on request and the right to contest are the other two Article 22C safeguards. They are only real if the reviewer could actually change the outcome — and a rationale that can be rewritten afterwards is worth nothing to the ICO.
The United Kingdom is a jurisdiction in the control library — five authored controls covering data protection and automated-decision explainability, the five cross-sector principles, equality and human rights, online safety and synthetic media, and sector regulators. For an organisation based in the UK it is included with your plan from Starter+, alongside Canada’s law; the EU AI Act and the GDPR join at Pro+. For a US organisation it sits in the Europe jurisdiction on Agency / Enterprise. Enable the jurisdiction and every instrument comes with it, including the ones that pass after you subscribe.
Take the free scorecard →Every clause the platform writes cites one of these. The system retrieves controls; it never invents them — which is what makes the output defensible to an auditor rather than merely plausible.
Fifteen questions, about ten minutes, free. No account and no sales call. You get a banded score and a named list of the gaps behind it.
This page is a plain-language summary of United Kingdom instruments governing artificial intelligence and automated decision-making, verified against primary and first-party sources on 2026-09-05. It is not legal advice, it is not a substitute for advice from UK counsel, and GOVERNBOX.ai does not promise a regulatory outcome. GOVERNBOX.ai is a product of Gradient Descent LLC, an independent commercial company that is not affiliated with, endorsed by, or sponsored by His Majesty’s Government, the Information Commissioner’s Office, or any UK regulator.