What AI regulation applies to UK startups?
Short answer
As of November 2026 the UK has no general AI law. A UK startup that builds or uses AI is regulated through existing law: UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, plus equality, consumer and sector rules enforced by regulators such as the FCA, MHRA and Ofcom. Selling into the EU can bring the EU AI Act into play. This is general information, not legal advice.
By Dr. Dulan Dias, co-founder and CTO of Tellme AI
Key facts
- The UK government's February 2024 response to its AI regulation white paper set five cross-sector principles for regulators to apply and kept them non-statutory.
- The King's Speech of 13 May 2026 contained no AI bill; its proposed Regulating for Growth Bill would create cross-economy sandbox powers, including possible AI sandboxes.
- Section 80 of the Data (Use and Access) Act 2025, which replaced UK GDPR Article 22 with new Articles 22A to 22D on automated decision-making, came into force on 5 February 2026.
- On 30 September 2026 the Information Commission took over from the Information Commissioner's Office as the UK's data protection regulator.
- The ICO's guidance on AI and data protection says most uses of AI to process personal data are likely to be high risk, so a data protection impact assessment is usually required.
- The EU AI Act applies to providers placing AI systems on the EU market wherever they are established, and to non-EU providers and deployers whose AI output is used in the EU.
- As of November 2026, the EU AI Act's high-risk rules apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in products covered by Annex I.
Definitions
- UK GDPR
- The UK's version of the General Data Protection Regulation. With the Data Protection Act 2018 it governs how personal data is processed in the UK, including in AI training, prompts, logs and outputs.
- Data (Use and Access) Act 2025
- A UK Act, given Royal Assent on 19 June 2025 and commenced in stages, that amends UK GDPR, including its automated decision-making rules, and created the Information Commission.
- EU AI Act
- Regulation (EU) 2024/1689, the EU's risk-based law on AI systems. In force since 1 August 2024, it applies in phases to 2028, with dates amended by the 2026 AI Omnibus.
- Provider and deployer
- Roles under the EU AI Act. A provider develops an AI system, or has one developed, and places it on the market under its own name; a deployer uses an AI system under its authority in a professional capacity.
Is there an AI law in the UK?
No. As of November 2026 the UK has no statute that regulates AI as such. Government policy since the 2023 white paper has been for existing regulators to apply five cross-sector principles within their own remits: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. The government's February 2024 response kept those principles non-statutory.
Legislation has been discussed but not delivered. The King's Speech of 17 July 2024 said the government would seek to place requirements on those developing the most powerful AI models, but no such bill has been introduced, and the King's Speech of 13 May 2026 contained no AI bill. Its Regulating for Growth Bill proposes sandbox powers, including possible AI sandboxes where rules could be relaxed temporarily for supervised trials. That bill is a proposal, not law.
Data protection: the rules most AI startups meet first
UK GDPR and the Data Protection Act 2018 apply whenever an AI product processes personal data: in training data, prompts, retrieved documents, logs and outputs. Since 30 September 2026 they have been enforced by the Information Commission, which took over from the Information Commissioner's Office; its guidance remains at ico.org.uk.
The ICO's guidance on AI and data protection, under review after the Data (Use and Access) Act, still sets the expectations: a lawful basis for each purpose, transparency, accuracy, data minimisation, security and support for individual rights. It says most uses of AI to process personal data are likely to be high risk, so a data protection impact assessment (DPIA) is usually required before processing starts.
With a model provider, whoever decides the purposes and means of processing is the controller, whatever the contract says. A provider acting only on your instructions is likely to be your processor; one that trains its own models on your data may be a controller for that part.
Two more duties matter. Since 19 June 2026, every controller must handle data protection complaints made directly to it and acknowledge each within 30 days. And for training on web-scraped personal data, the ICO's position is that legitimate interests is the only available lawful basis, and only if its three-part test is passed.
Automated decisions after the Data (Use and Access) Act
The rules on automated decision-making changed on 5 February 2026, when section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of UK GDPR with Articles 22A to 22D. A decision is caught when it has a legal or similarly significant effect on a person and is based solely on automated processing, with no meaningful human involvement.
Such decisions are now generally allowed, with two main restrictions. They cannot rest on special category data, such as health or ethnicity, unless the person gave explicit consent, or the decision is needed for a contract or required or authorised by law and a substantial public interest condition applies. And they cannot rely on the new recognised legitimate interests basis. In every case people must be able to get information about the decision, make representations, obtain human intervention and contest it.
If your product scores, ranks, approves or rejects people for credit, jobs, insurance, housing or services, build those safeguards in. The ICO consulted on updated automated decision-making guidance until 29 May 2026 and has started work on a statutory code of practice on AI and automated decision-making.
Sector regulators and other UK law
Beyond data protection, the rules depend on what your product does. These are the ones startups meet most often:
| Area | Who and what | Status, November 2026 |
|---|---|---|
| Financial services | The FCA applies existing rules, including the Consumer Duty and the Senior Managers and Certification Regime | Law; no extra AI-specific rules planned |
| Health and care | The MHRA regulates many AI products with a medical purpose as medical devices | Law, with MHRA guidance |
| Chatbots and online services | Ofcom enforces the Online Safety Act 2023 for chatbots that are part of user-to-user or search services, or can generate pornography | Law; a chatbot that only talks to one user, searches no other sites and cannot generate pornography is outside it |
| Equality | The Equality Act 2010 in Great Britain, and Northern Ireland's own equality laws, apply to decisions made with AI | Law |
| Copyright | Section 29A of the Copyright, Designs and Patents Act 1988 allows text and data mining only for non-commercial research | Law; the March 2026 government report on copyright and AI did not change it |
| Cyber security | DSIT's Code of Practice for the Cyber Security of AI sets 13 principles | Voluntary guidance, published 31 January 2025 |
When does the EU AI Act apply to a UK startup?
The EU AI Act applies to a UK startup when it places an AI system on the EU market, or when its AI system's output is used in the EU. A UK startup selling an AI product to EU customers is usually a provider; one using an AI tool whose output reaches EU users may be a deployer.
Obligations depend on risk. High-risk uses, including employment, education, essential services such as credit, critical infrastructure, law enforcement and migration, carry the heaviest duties; most startup products sit in the transparency or minimal-risk tiers. For start-ups and other SMEs, fines are capped at the lower of the fixed amount and the turnover percentage.
The AI Omnibus, in force since 27 July 2026, moved the high-risk dates. As of November 2026 the timeline is:
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices banned; AI literacy duty, since amended to require measures that support staff AI literacy |
| 2 August 2025 | Rules for providers of general-purpose AI models |
| 2 August 2026 | Article 50 transparency duties, such as telling people they are interacting with an AI system and disclosing deepfakes |
| 2 December 2026 | New prohibition on AI that generates non-consensual sexual deepfakes or child sexual abuse material; marking deadline for synthetic content from systems on the market before 2 August 2026 |
| 2 December 2027 | High-risk rules for Annex III systems, such as those used in hiring, education and credit |
| 2 August 2028 | High-risk rules for AI built into products covered by EU product safety law (Annex I) |
Law, guidance or proposal: what each instrument is
Much of what is written about UK AI regulation mixes the three. As of November 2026:
| Instrument | Status | What it means for a startup |
|---|---|---|
| UK GDPR and the Data Protection Act 2018, as amended | Law, in force | Applies to any personal data your product touches |
| UK GDPR Articles 22A to 22D | Law, in force since 5 February 2026 | Safeguards for solely automated significant decisions |
| ICO guidance on AI and data protection | Guidance, under review | How the regulator expects the law to be applied |
| ICO code of practice on AI and automated decision-making | In preparation | The statutory reference once issued |
| Five AI regulation principles | Non-statutory policy | Shapes how sector regulators treat AI |
| Regulating for Growth Bill | Proposal, announced 13 May 2026 | Possible AI sandboxes; no duties |
| EU AI Act | EU law, phased in from 2025 to 2028 | Applies if you sell into the EU or your outputs are used there |
A compliance checklist for an AI startup
Work through these in order. Chapter 17 of From Model to Product, Ethics, Governance & Risk, covers the engineering controls that make several of these steps possible, such as model versioning, audit records and controls matched to risk; it does not cover any specific law.
- Map where personal data enters, moves and is stored, including prompts, logs and anything sent to model providers.
- Record a lawful basis for each purpose, explain the AI processing in your privacy notice and run a DPIA before launch.
- Check your model provider's data processing terms: retention, use for training, location and sub-processors.
- Identify solely automated significant decisions and build the safeguards for them.
- Set up the data protection complaints process every controller now needs.
- Check the sector rules for what the product does, from the FCA, MHRA, Ofcom or others.
- If you sell into the EU, decide whether you are a provider or a deployer, classify the risk and meet the Article 50 duties.
- Log model versions, inputs, outputs and fallbacks so any decision can be reconstructed, and take legal advice before any high-risk launch.
Frequently asked questions
Does the EU AI Act apply to UK companies?
It can. The Act applies to providers that place AI systems on the EU market wherever they are based, and to non-EU providers and deployers whose AI output is used in the EU. A UK startup selling an AI product to EU customers is usually a provider in scope. What it must do depends on the risk tier: most products face transparency duties, while high-risk uses such as hiring or credit carry far heavier obligations from 2 December 2027.
Will the UK introduce its own AI Act?
Not on any announced timetable. The 2024 King's Speech promised requirements for developers of the most powerful AI models, but no bill has been introduced, and the King's Speech of 13 May 2026 contained no AI bill. Policy remains regulation through existing law and regulators, with the proposed Regulating for Growth Bill adding possible sandboxes. Plan around current law.
Do I have to tell users they are talking to an AI?
In the EU, yes: since 2 August 2026, Article 50 of the AI Act requires providers to design systems that interact with people so users know they are dealing with an AI, unless that is obvious. UK law has no equivalent AI-specific rule, but UK GDPR transparency duties apply when personal data is involved. Telling people is the safe default.
Do I need a DPIA for an AI product?
Usually, yes. The ICO's guidance says most uses of AI to process personal data are likely to be high risk, and high-risk processing legally requires a data protection impact assessment before it starts. A DPIA records what data you use, why, the risks to people and how you reduce them. If a high risk remains that you cannot reduce, you must consult the regulator before going ahead.
Can a UK startup train a model on data scraped from the web?
Only with care on two fronts. For personal data, the ICO's position is that legitimate interests is the only available lawful basis for training generative AI on web-scraped data, and only if you pass its three-part test, including necessity. For copyright, the UK's text and data mining exception covers non-commercial research only, so commercial training on protected works needs permission.
Is it legal to use a third-party LLM API with customer data in the UK?
Yes, if you meet data protection law. Establish whether the provider is your processor, sign data processing terms that limit retention and use for training, check where the data is processed and that international transfer rules are met, and cover the use in your privacy notice and DPIA. Then send the provider only the data each request needs.
Sources
- GOV.UK: A pro-innovation approach to AI regulation, government response (6 February 2024)
- GOV.UK: The King's Speech 2026, background briefing notes
- legislation.gov.uk: Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, regulation 2
- GOV.UK: Information Commission succeeds the ICO as UK's data protection regulator
- ICO: What are the accountability and governance implications of AI?
- European Commission, AI Act Service Desk: Timeline for the implementation of the EU AI Act
- EU AI Act Service Desk: Article 2, Scope
- FCA: Our approach to AI
About the author
Dr. Dulan Dias is co-founder and Chief Technology Officer of Tellme AI in Belfast; founder of EchonLabs, grown from 2017 to more than 60 people before its acquisition in 2026; holder of a PhD in AI and data science from Queen’s University Belfast; and the author of From Model to Product.