Insights

UK AI Regulation in October 2026: There Is Still No UK AI Act - How the UK Approach Compares With the EU AI Act

Last updated · October 14, 2026

If you have been waiting for "the UK AI Act" before building an AI governance programme, the short answer for October 2026 is: stop waiting. There is no UK AI Act, no AI Bill before Parliament, and the political picture got less predictable over the summer, not more. Meanwhile the rules that already apply to AI in the UK keep accumulating, and the EU AI Act reaches across the Channel for any UK business whose AI output is used in the EU.

This guide sets out how UK AI regulation actually works today, what might change in the next 12 months, how it compares with the EU AI Act line by line, and how to run one programme that covers both.

TL;DR

No UK AI Act. The UK still relies on a sector-led model: existing regulators apply existing law to AI.
The most important UK AI rules are data rules. The Data (Use and Access) Act 2025 rewrote automated decision-making law from 5 February 2026, and the ICO is under a statutory duty to produce an AI code.
Pressure for an AI Bill is rising. On 14 September 2026 Parliament's Joint Committee on Human Rights called for a comprehensive AI Bill and an independent AI regulator.
The EU AI Act applies to many UK firms anyway, wherever their AI output is used in the EU.

Is there a UK AI Act?

No. The UK has no single statute regulating AI; the government continues to favour a pro-innovation, sector-led model in which existing regulators apply current legal frameworks to AI risks. That model traces back to the 2023 AI White Paper, with its five cross-sector principles (safety, transparency, fairness, accountability, contestability) applied by regulators such as the ICO, FCA, CMA, Ofcom, MHRA and Ofgem.

The government has repeatedly said it would legislate narrowly for the most powerful frontier models. That bill has never been introduced. The King's Speech of 13 May 2026 announced a Regulating for Growth Bill focused on reducing regulatory burden and enabling regulatory sandboxes, but no standalone AI bill. (Bird & Bird)

The summer added more uncertainty. Following the change of Prime Minister in July 2026, the new government's team is reported to be revisiting the UK's AI strategy. A draft frontier-AI bill had been expected around November 2026, but that timetable may slip. Treat any date as provisional until a bill is actually laid.

What actually regulates AI in the UK today

Five regimes do the real work. Most organisations sit inside three or four of them at once.

1. UK GDPR and the Data (Use and Access) Act 2025

This is the most important AI regime in the UK and the one most often overlooked. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, in force from 5 February 2026. The reform widened the circumstances in which solely automated decisions with legal or similarly significant effects are lawful, but only if safeguards are in place: information about the decision, the ability to make representations, meaningful human intervention, and the right to contest. In practice the default flipped from "not permitted unless" to "permitted provided", and the compliance task became evidencing those safeguards (Scaffold).

Special category data remains more tightly restricted, so recruitment, health and insurance use cases still need careful analysis.

2. The ICO's statutory AI code (coming) and ADM guidance (now)

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force on 12 May 2026, requiring the Information Commissioner to prepare a statutory code of practice on processing personal data when developing and using AI and automated decision-making. The code has not been published yet. When it lands it will carry real evidential weight in enforcement. In parallel, the ICO consulted on updated automated decision-making and profiling guidance from 31 March to 29 May 2026, with a clear emphasis on genuine (not token) human review.

3. Sector regulators

The FCA (Consumer Duty, model risk), the MHRA (AI as a medical device), Ofgem, the CMA, the SRA and others publish increasingly specific expectations for AI in their sectors. If you are regulated, your regulator's AI guidance is effectively your rulebook. The FCA, for example, has no AI-specific rulebook but expects firms to meet existing outcomes-based duties when AI is in the loop.

4. The Online Safety Act 2023

User-facing AI services, including chatbots and AI companions that let users share content, can fall within Ofcom's online safety regime.

5. The EU AI Act, by extraterritorial reach

Covered in detail below. For many UK exporters and SaaS providers this is the most prescriptive AI law they actually face.

What is coming in the next 12 months

A possible AI Bill. On 14 September 2026, Parliament's Joint Committee on Human Rights published its report "Human Rights and the Regulation of AI", calling on the government to introduce a comprehensive AI Bill and establish an independent AI oversight body. Committee chair Alex Sobel MP said that "nowhere in the world, including the UK, has a current legislative and regulatory approach to AI that is fit for purpose" (UK Parliament). The committee described the current framework as fragmented and difficult to navigate. The government is not bound by the report, but it raises the political cost of doing nothing.
The ICO AI code. Expect a consultation draft first. Plan for a documentation uplift once it is final.
Sandboxes. The AI Growth Lab, a cross-economy regulatory sandbox, launched on 8 June 2026 with legal services and conveyancing as the first focus area. The Regulating for Growth Bill would put sandboxing on a firmer statutory footing.
Council of Europe Convention. The UK has signed the Council of Europe Framework Convention on AI and will need domestic measures to give effect to it, which is one of the arguments for legislation.
Copyright. The government's March 2026 report on copyright and AI dropped the proposed broad commercial text-and-data-mining exception. The UK TDM exception remains limited to non-commercial research, which is narrower than the EU position.

UK vs EU AI Act: side-by-side

Dimension	United Kingdom (Oct 2026)	European Union (EU AI Act)
Legal form	No AI statute; principles applied through existing law and regulators	Directly applicable regulation (EU) 2024/1689, amended by (EU) 2026/1744
Approach	Sector-led, outcomes-based	Horizontal, risk-tiered (prohibited, high, limited, minimal)
Prohibited AI	None AI-specific (general law still applies)	Article 5 bans since Feb 2025; nudifier/CSAM ban from 2 Dec 2026
High-risk systems	No legal category; sector rules apply	Annex III from 2 Dec 2027; Annex I from 2 Aug 2028
Automated decisions	UK GDPR Arts 22A to 22D (DUAA) with safeguards	GDPR Art 22 plus AI Act human oversight and deployer duties
Transparency	UK GDPR transparency; sector rules; no labelling mandate	Article 50 disclosure, deepfake labelling, machine-readable marking
Frontier / GPAI models	Voluntary testing via AI Security Institute; promised bill not introduced	Binding GPAI obligations since Aug 2025, AI Office enforcement since Aug 2026
Copyright / TDM	TDM exception for non-commercial research only	Commercial TDM allowed subject to opt-outs; GPAI copyright policy required
Regulator	ICO, FCA, CMA, Ofcom, MHRA and others	AI Office plus national market surveillance authorities
Penalties	Under existing regimes (e.g. UK GDPR up to GBP 17.5M or 4%)	Up to EUR 35M or 7% of global turnover
Sandboxes	AI Growth Lab (launched June 2026)	National sandboxes due 2 Aug 2027; new EU-level sandbox

When the EU AI Act applies to UK businesses

Brexit did not take UK firms out of scope. The EU AI Act applies based on where AI is placed on the market or where its output is used, not where the company is incorporated. Under Article 2(1)(c), a provider or deployer established outside the EU is caught where the output of its AI system is used in the Union. Run each system through these questions:

Do you place an AI system or GPAI model on the EU market (sell, license or make it available to EU customers)? If yes, you are likely a provider in scope.
Is the output of your AI used in the EU, for example scores, decisions or content delivered to EU users or EU-based clients? If yes, you are likely in scope even with no EU entity.
Do you integrate AI into products sold in the EU (machinery, medical devices, toys, vehicles)? Annex I rules will follow the product.
Is the use case on the Annex III list (recruitment, credit, insurance, education, biometrics, critical infrastructure)? If yes, high-risk obligations apply from 2 December 2027.
Are you a high-risk provider with no EU establishment? You will need an EU authorised representative under Article 22.

Our detailed walkthrough of Article 2 extraterritorial scope covers the edge cases.

One programme for both regimes

Because the UK is principles-based and the EU is rules-based, the efficient strategy is to build to the EU standard where you are in scope and reuse the evidence for UK regulators.

Build one AI register covering bespoke systems and AI features inside SaaS tools. Tag each entry with the regimes it touches: UK GDPR/DUAA, sector regulator, Online Safety Act, EU AI Act.
Run one impact assessment template that satisfies a UK DPIA, the DUAA automated decision safeguards and, where relevant, the EU fundamental rights impact assessment. See our EU AI Act and GDPR dual-compliance guide.
Design human review once, properly. The ICO's emphasis on genuine human involvement and Article 14 of the EU AI Act point in the same direction.
Ship transparency to the EU standard. Article 50 disclosure and labelling exceed UK requirements but rarely cost more to apply globally.
Name an accountable owner with authority to stop a deployment. Both the JCHR report and EU enforcers will look for one.
Watch three dates: the ICO code consultation, any frontier-AI bill, and 2 December 2026 for the EU transparency grace period and new prohibition.

For comparison with other non-EU approaches, see our analysis of US state AI laws vs the EU AI Act and Switzerland's FADP-based approach.

FAQ

Is there a UK AI Act in 2026? No. The UK has no AI-specific statute and no AI Bill before Parliament as of October 2026.

What is the UK AI Bill? A long-promised bill to regulate the most powerful AI models. It has not been introduced. A draft was expected around November 2026, but the timetable is uncertain after the July 2026 change of Prime Minister. Separately, the Joint Committee on Human Rights has called for a much broader AI Bill.

Who regulates AI in the UK? Existing regulators within their remits: the ICO for personal data, the FCA for financial services, the CMA for competition and consumer law, Ofcom for online safety, the MHRA for medical devices, and others.

Does the EU AI Act apply to UK companies? Yes, if they place AI on the EU market or their AI output is used in the EU.

Is UK AI regulation stricter or looser than the EU AI Act? Looser in form, since there are no AI-specific bans or high-risk rules. But UK data protection law on automated decisions, sector rules and the Online Safety Act still impose real obligations, and penalties under UK GDPR are significant.

This article is general information, not legal advice.