Delivering in the UK: There Is No AI Act, So Your Sector Regulator Is Your AI Rulebook

The most common mistake made by organisations planning UK AI work is preparing for an AI Act. There isn't one, and as of May 2026 no AI Bill sits before Parliament.

What exists instead#

The UK chose a regulator-led, principles-based approach. Existing regulators apply five cross-sectoral principles within their own domains:

1. Safety, security and robustness
2. Appropriate transparency and explainability
3. Fairness
4. Accountability and governance
5. Contestability and redress

DSIT published its Blueprint for AI regulation on 21 October 2025, which replaced the AI Bill as the immediate legislative vehicle. In January 2026, DSIT and the Department for Business and Trade wrote to 19 regulators, including the FCA, the Bank of England and the PRA, directing them to publish plans for enabling safe AI innovation and to report annually on progress.

Why this changes the work, not just the paperwork#

Under a horizontal law like the EU AI Act, you classify your system and read off the obligations. In the UK, the obligations depend on who regulates you.

The same recommendation engine carries materially different requirements at a bank under FCA Consumer Duty than at a retailer. A model touching employment decisions runs into different expectations than one touching credit. There is no single classification exercise that resolves it.

The practical consequence: the first question in a UK AI project is not "what risk tier is this", it is "which regulator will ask us about this, and what have they published". Those 19 regulator plans are the actual rulebook, and they are still arriving.

Data protection is the settled part#

UK GDPR, as amended by the Data (Use and Access) Act 2025, enforced by the ICO. This is the stable ground: mature, well-understood, and with an established regulator that publishes clearly.

For most AI projects, the ICO's requirements will bite before anything AI-specific does. A DPIA, a lawful basis for the training data and the inference, and a position on automated decision-making are the obligations that actually shape the build.

What is genuinely easier here#

No horizontal AI conformity assessment. For a system that would be high-risk under the EU AI Act, the UK route to production is currently shorter.

Sandboxes. The AI Growth Lab runs issue-specific regulatory sandboxes, and £10 million has been provided for regulator capability. Where a use case is genuinely novel, there is a route to engage rather than guess.

If you sell into both the UK and the EU, though, the EU obligations are the binding constraint and the UK position is the easier subset. Design for the EU and the UK follows; the reverse does not hold.

What we would do differently here#

Start with the regulator, not the risk tier. Identify who will ask, and read what they have published. That is a genuinely different opening move from an EU project.

Do the DPIA early and properly. In the UK it is the obligation most likely to change your design, and it is cheapest before the design exists.

Build the evidence anyway. The absence of a conformity assessment is not an absence of scrutiny. Logging, human oversight and the ability to explain a decision are what a regulator asks for when something goes wrong, whichever regulator it is.

Where we are honest about our limits#

We deliver into the UK remotely and through partners rather than from a UK office. For public sector procurement specifically, we are not currently on the frameworks that most central government buying runs through, and we would tell you that before you spent time on a bid.

Start here#

AI Strategy Sprint if you need the governance position and the sequence. AI Readiness Assessment if the use case is still open. AI Agent Implementation if it is chosen and you want it shipped.

Sources#

• AI regulation in the UK, the role of the regulators, Bird and Bird
• UK financial services regulators' approach to AI in 2026
• A pro-innovation approach to AI regulation, DSIT white paper

What else is coming for United Kingdom