About This Framework
Primary Framework: UK AI White Paper: A Pro-Innovation Approach to AI Regulation (DSIT, March 2023). Five cross-sector principles: Safety/security/robustness, Transparency/explainability, Fairness, Accountability/governance, Contestability/redress.
DSIT Blueprint (October 2025): Replaces AI Bill as immediate legislative vehicle. Introduces AI Growth Lab: sectoral sandboxes where regulations can be relaxed under licence for approved AI innovators.
Data Use and Access Act 2025: Royal Assent June 19, 2025. Bulk of provisions commenced February 5, 2026. New recognised legitimate interests basis for automated decision-making now in force. Section 103 complaints procedure commences June 19, 2026.
Deepfake Criminal Law: Crime and Policing Act amendment in force from February 6, 2026. Criminalises creation of sexually explicit deepfake images of adults without consent.
Copyright and AI Report: Published March 18, 2026 (required by DUAA 2025). Government maintains status quo on AI/copyright for now.
AI Bill Status: As of June 2026, still expected but not introduced. Government deliberately delayed to resolve AI/copyright interaction.
Penalties Under Existing Law: UK GDPR: GBP 17.5M or 4% global turnover. FCA, Ofcom, CMA retain separate enforcement powers. Deepfake criminal law: criminal prosecution.
Key Regulators: ICO, FCA, Ofcom, CMA, MHRA, AI Security Institute/DSIT.
Introduction
No single AI law. No risk tiers. No mandatory impact assessments. The UK has deliberately chosen a principles-based, sector-led model rather than following the EU’s comprehensive AI Act approach. As of June 2026, there is still no UK AI Act. But that absolutely does not mean no rules apply to your AI systems.
In 2026, UK AI regulation is moving on multiple tracks simultaneously. The Data (Use and Access) Act 2025 commenced in February 2026. A deepfake criminal law took effect on February 6, 2026. The government published the Copyright and AI Report on March 18, 2026. The DSIT Blueprint for AI Regulation, published in October 2025, introduces the AI Growth Lab concept. And a government-backed AI Bill remains expected but has not yet been introduced.
This guide explains every active UK AI rule as of June 2026, which sector regulators apply them, and the practical compliance steps your business must take right now.
The Current UK AI Framework: What Is Actually In Force
The UK’s AI governance landscape as of June 2026 is built on layers rather than a single law. The foundational layer is the five White Paper principles from March 2023: safety/security/robustness, transparency/explainability, fairness, accountability/governance, and contestability/redress. These are not statutory. They are guidance that each sector regulator applies within its own binding framework.
The second layer is the Data (Use and Access) Act 2025, in force from February 5, 2026. The most important change for AI businesses: the new recognised legitimate interests lawful basis for automated decision-making means UK GDPR’s ADM rules are now more accessible. The near-blanket prohibition that previously made solely automated decisions difficult to lawfully deploy has been replaced by a legitimate interests framework with genuine human oversight and transparency safeguards.
New Laws Already In Force: What Changed in 2026
Three significant developments have changed the UK AI compliance landscape since January 2026.
The deepfake criminal law is the most immediate. From February 6, 2026, the Crime and Policing Act amendment makes it a criminal offence to create sexually explicit deepfake images of adults without their consent. Businesses deploying any AI capable of generating such content face direct criminal liability without adequate consent and safety controls.
The DUAA automated decision-making framework creates new operational requirements. The new recognised legitimate interests basis for ADM removes the previous consent barrier, but requires genuine human oversight, transparent contestation mechanisms, and a documented balancing test.
The Copyright and AI Report (March 18, 2026) confirmed the government’s status quo on AI training data: no text-and-data mining exception was introduced. AI systems trained on copyrighted UK content without licences remain legally exposed.
Which Regulator Oversees Your AI? The Sector Guide
- ICO (Information Commissioner’s Office): Governs any AI system processing personal data. ADM under the DUAA framework, AI training data privacy, and automated hiring tools are all ICO territory. Its 2025/26 action plan specifically targets deepfakes, LLM-generated outputs, and AI processing biometric or health data.
- FCA (Financial Conduct Authority): Governs AI in financial services including algorithmic trading, credit decisions, robo-advisers, and fraud detection. The FCA’s Mills Review published in 2025 reinforced model risk management expectations on regulated firms.
- Ofcom: Governs AI on online content platforms under the Online Safety Act. Platforms using algorithmic recommendation or AI-generated content for UK users face Ofcom scrutiny.
- CMA (Competition and Markets Authority): Oversees AI in competitive markets, particularly AI-driven pricing and dominant platform AI.
- MHRA: Governs AI as medical devices. The National Commission into AI in Healthcare is expected to publish recommendations in 2026.
Unsure which UK regulators apply to your specific AI systems, or whether the new DUAA ADM framework changes your current legal basis for automated decisions? Download our free UK AI compliance readiness guide, updated for June 2026.
The DSIT Blueprint and the AI Growth Lab
Published October 21, 2025, the DSIT Blueprint for AI Regulation replaced the long-awaited AI Bill as the government’s immediate legislative vehicle. The centrepiece is the AI Growth Lab: a set of sectoral sandboxes where specific regulations can be relaxed under licence for approved AI innovators.
For SMEs, the AI Growth Lab represents a genuine opportunity. Approved participants can test AI systems in regulated environments (healthcare, financial services, energy) with temporary relief from specific sector regulations. The DSIT One Year On progress report (January 29, 2026) confirmed 38 of the 50 AI Opportunities Action Plan commitments are met.
Your UK AI Compliance Action Plan for 2026
- Audit for deepfake exposure: If your business deploys any AI capable of generating synthetic images, audio, or video, review whether your consent mechanisms prevent non-consensual intimate imagery generation. The criminal law has been in force since February 6, 2026.
- Review your DUAA ADM legal basis: If you rely on automated decision-making for any UK GDPR-regulated processing, check whether the new recognised legitimate interests basis applies. Ensure your human oversight is genuine and your contestation process is functional.
- Map your AI systems to your sector regulator: Identify your primary regulator and review their latest AI-specific guidance. ICO, FCA, Ofcom, and CMA all published updated AI guidance in 2025.
- Check AI training data for copyright exposure: Given the Copyright and AI Report’s status quo position, AI systems trained on UK copyrighted content without licences remain legally exposed.
- Monitor the AI Bill: Sign up for DSIT updates. When the government-backed AI Bill is introduced, assess which new obligations affect your AI systems.
Frequently Asked Questions
Does the UK have an AI Act?
No. As of June 2026, no comprehensive UK AI Act has been passed. The government’s approach is the DSIT Blueprint and sector-led enforcement of existing law. A government-backed AI Bill is expected to be introduced in 2026, but no timeline has been confirmed.
What does the DUAA 2025 change for businesses using automated decision-making?
The Data (Use and Access) Act 2025, in force from February 2026, replaced the near-blanket prohibition on solely automated decisions with a recognised legitimate interests framework. Businesses can now more readily use automated decision-making under UK GDPR, but must implement genuine human oversight and transparent contestation mechanisms.
Is creating deepfake images now a criminal offence in the UK?
Yes, for sexually explicit images of adults. From February 6, 2026, the Crime and Policing Act amendment makes it a criminal offence to create sexually explicit deepfake images without the subject’s consent. Businesses deploying AI image or video generation tools face criminal liability without adequate safeguards.
How does UK AI regulation compare to the EU AI Act?
The EU AI Act is binding law with fines of up to 7% of global turnover (with high-risk deadlines extended to December 2027 via the Omnibus). UK regulation is principles-based and sector-led with no mandatory AI-specific impact assessment requirement. Existing UK laws create real compliance obligations but without the EU’s unified AI-specific enforcement structure.
Conclusion
UK AI regulation in 2026 is active, layered, and moving fast. The DUAA automated decision-making framework is in force. The deepfake criminal law took effect in February. The Copyright and AI Report has confirmed the government’s near-term stance on training data. And the DSIT Blueprint is shaping the next phase of regulation through the AI Growth Lab.
There is no single law to point to, but there are multiple rules that already apply to your AI systems today.
Ready to identify your specific UK AI compliance obligations under the DUAA, the deepfake law, and your sector regulator’s guidance? Download our free UK AI compliance readiness guide today. Updated for June 2026, it maps your obligations in under 15 minutes.
