Global AI Monitor
Preview
UK Page built 23 Oct 2026

United Kingdom

UK10 active modules2 quiet
Build report with United KingdomAsk Co-PilotRequest deeper dive
Framework status
Artificial Intelligence (Regulation) Bill [HL] (Lord Holmes of Richmond) (Draft, no legal force): House of Lords Private Member's Bill sponsored by Lord Holmes of Richmond to make provision for the regulation of artificial intelligence.
Main regulator

RegulatorNo cross-sector AI regulator. Policy lead: Department for Science, Innovation and Technology (DSIT); frontier-risk body: AI Security Institute

Next milestone
: Ofcom evidence request on protections for women and girls closes (05 Transparency & Synthetic Content)
Record status
Preview · baseline record · 117 sources (117 retrieved) · 28 Probable (R-3/R-4) · Not yet expert-reviewed
AI-assembled from cited sources · evidence-gated · Not yet expert-reviewed · Not legal, compliance or investment advice · Methodology →
Disclosure details

Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See methodology.

Research checked · Updated
Record history

Research as of · Record last changed · Publication date pending · Page built

43Instruments
43Current instruments
7Binding, in force+5 more binding, in-force date not recorded
23Obligations
140Claims
4Upcoming milestones
117Sources

Summary counts across modules ?A claim can sit in more than one module; the totals above count each once.

Next milestones in this record

Jump to module (12)
12 of 12 modules
View options & filters
Show
Density

#

Artificial Intelligence (Regulation) Bill [HL] (Lord Holmes of Richmond) (Draft, no legal force): House of Lords Private Member's Bill sponsored by Lord Holmes of Richmond to make provision for the regulation of artificial intelligence.

6 instruments · 0 obligations · 20 claims · Next: (Second reading of the Artificial Superintelligence Bill listed)

6 instruments (6 current) · 0 obligations · 20 claims · 3 milestones

Instruments

  • Artificial Intelligence (Regulation) Bill [HL] (Lord Holmes of Richmond) Draft, no legal force

    House of Lords Private Member's Bill sponsored by Lord Holmes of Richmond to make provision for the regulation of artificial intelligence. Parliament's stages page lists a first reading in the Lords on 4 March 2025 and a second reading with "Date to be announced"; the Bill Papers page shows it in the 2024-26 session. A tracker reports it fell at the end of the session on 30 April 2026; Parliament's own pages do not state this.

    Authority: UK Parliament · Verified · Official text
  • Artificial Superintelligence Bill (Commons Private Member's Bill, Alex Sobel) Draft, no legal force

    Commons Private Member's Bill under the Ten Minute Rule, introduced by Alex Sobel MP, that would prohibit the development, deployment and operation of artificial superintelligence systems and set up monitoring and control powers. UK Parliament's Bill Papers page records it as a Ten Minute Rule Bill in the 2026-27 session; BBC Parliament covered its introduction on 8 September 2026; second reading is listed by a tracker for 13 November 2026.

    Authority: UK Parliament · Verified · Official text
  • Council of Europe Framework Convention on AI and Human Rights, Democracy and the Rule of Law (CETS 225) Adopted 2024-09-05; entry into force not recorded

    International treaty opened for signature at Vilnius on 5 September 2024; the UK is among the signatories but the Convention has not yet entered into force.

    Conditionally binding · Verified · Official text
  • EU Artificial Intelligence Act (applies to UK providers and deployers whose output is used in the EU) Applies since 2025-02-02

    EU regulation that reaches providers and deployers established in third countries, including the UK, where AI system output is used in the Union. Its prohibited-practices chapter has applied since 2 February 2025.

    Binding · Verified · Official text
  • Joint Committee on Human Rights report on human rights and the regulation of AI (HC 160) Date not recorded

    Committee report calling for a dedicated AI Bill and a new single AI regulator, finding AISI engages with developers voluntarily and has no statutory power. Not binding; Government is expected to respond.

    Non-binding · Authority: Joint Committee on Human Rights · Verified · Official text
  • UK pro-innovation, regulator-led approach to AI regulation (non-statutory cross-sectoral principles) Published 2023-03-29

    Non-statutory framework under which existing sector regulators apply cross-sectoral AI principles at their own discretion; the UK has no horizontal AI Act.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text

Milestones

  • EU AI Act Chapters I and II (including Art 5 prohibitions) apply Met
    EU Artificial Intelligence Act (applies to UK providers and deployers whose output is used in the EU)
  • HL Bill 76 (as introduced) published Met
    Artificial Intelligence (Regulation) Bill [HL] (Lord Holmes of Richmond)
  • Second reading of the Artificial Superintelligence Bill listed Upcoming
    Artificial Superintelligence Bill (Commons Private Member's Bill, Alex Sobel)
Claims and evidence (20)

  • The Joint Committee on Human Rights recommended on 14 September 2026 that the government introduce a dedicated AI Bill, stating that no jurisdiction, including the UK, currently has a fit-for-purpose legislative and regulatory approach to AI.

    Confidence: Confirmed · As of 14 Sep 2026 · evidenced
    Evidence and sources

  • No standalone horizontal AI statute was announced in the May 2026 King's Speech; the UK continues to govern AI through existing data protection, online safety, copyright, competition, product and sector-specific law and regulator-led non-statutory principles.

    Confidence: Confirmed · As of 13 May 2026 · evidenced
    Evidence and sources

  • The UK has no horizontal AI statute: its framework relies on non-statutory cross-sectoral principles applied at regulators' discretion, and no AI bill was announced in the May 2026 King's Speech.

    Confidence: Confirmed · As of 14 Sep 2026 · evidenced
    Evidence and sources

  • The White Paper proposed that regulators use a set of cross-sectoral principles to guide responses to AI risks, applied initially at their discretion.

    Confidence: Probable · As of 29 Mar 2023 · evidenced
    Evidence and sources

  • Derived: Probable The EU AI Act applies to UK-based providers and deployers of AI systems where the system's output is used in the Union.

    Confidence: Probable · As of 2 Feb 2025 · evidenced
    Evidence and sources

  • Derived: Probable The UK signed the Council of Europe Framework Convention on AI on 5 September 2024, but it has not been ratified by the UK and has not entered into force.

    Confidence: Confirmed · As of 5 Sep 2024 · evidenced
    Evidence and sources

  • The Joint Committee on Human Rights' report of 14 September 2026 recommended the Government introduce a new AI Bill to place AI regulation on a sound statutory basis and give effect to the Council of Europe Framework Convention on AI.

    Confidence: Confirmed · As of 14 Sep 2026 · evidenced
    Evidence and sources

  • The Artificial Superintelligence Bill is a Commons Private Member's Bill under the Ten Minute Rule in the 2026-27 session (UK Parliament Bill Papers, updated 9 September 2026).

    Confidence: Confirmed · evidenced
    Evidence and sources

  • The Artificial Superintelligence Bill is a Private Member's Bill awaiting second reading and has no legal force.

    Confidence: Probable · As of 8 Sep 2026 · evidenced
    Evidence and sources

  • The Artificial Superintelligence Bill was introduced in the House of Commons on Tuesday 8 September 2026 (BBC Parliament coverage of the Ten Minute Rule introduction; Parliament Bill Papers page created by 9 September).

    Confidence: Probable · As of 8 Sep 2026 · evidenced
    Evidence and sources

  • The bill's long title says it would prohibit the development, deployment and operation of artificial superintelligence systems and establish monitoring and control powers over such systems; a law-firm note adds that it defines superintelligence by outcomes.

    Confidence: Uncertain · As of 8 Sep 2026 · evidenced
    Evidence and sources
    • Artificial Superintelligence Bill (Order Paper bill tracker) T3 · retrieved · retrieved 8 Oct 2026 · Long titleA Bill to make provision to prohibit the development, deployment and operation of artificial superintelligence systems; to establish monitoring and control powers in respect of such systems; and for connected purposes.
    • AI judgment day on the horizon, while UK lawmakers play catch-up (Lewis Silkin) T3 · retrieved · retrieved 8 Oct 2026 · Section "Private Member's Bill on AI superintelligence"Prior to Jones’ letter, Labour MP Alex Sobel introduced a Private Member’s Bill in the House of Commons proposing to prohibit the development, deployment and operation of artificial superintelligence systems. The Bill sets out to define superintelligent AI by
    • 2nd session of the 59th Parliament (Bill Papers: list of bills) T1 · retrieved · retrieved 8 Oct 2026 · List of bills, 2nd session of the 59th Parliament, item 54. Arm's-Length Bodies (Review) Bill 5. Artificial Superintelligence Bill 6. Automated Online Software (Access and Transparency) Bill 7. Bailiffs (Warrants of
    • BBC Parliament: Ten Minute Rule Bill, Artificial Superintelligence T2 · retrieved · retrieved 8 Oct 2026 · Programme descriptionCoverage of the introduction to the House of Commons of a ten minute rule bill, tabled by Labour MP Alex Sobel, on banning the development, deployment and operation of artificial superintelligence systems, from Tuesday 8 September.

  • A tracker and a law-firm note list second reading of the Artificial Superintelligence Bill for 13 November 2026 and observe that Private Members' Bills rarely become law.

    Confidence: Uncertain · As of 13 Nov 2026 · evidenced
    Evidence and sources

  • Derived: Probable BBC News reports that the Cabinet Office, which leads on AI safety, said the UK "cannot simply turn AI off" and that the Government opposes the legislation, which makes it unlikely to become law.

    Confidence: Uncertain · As of 11 Sep 2026 · evidenced
    Evidence and sources

  • The Artificial Intelligence (Regulation) Bill [HL], sponsored by Lord Holmes of Richmond, is recorded on bills.parliament.uk with its current version HL Bill 76 as introduced.

    Confidence: Probable · As of 4 Mar 2025 · evidenced
    Evidence and sources

  • The Artificial Intelligence (Regulation) Bill [HL] is a bill with only its introduced text recorded and has no legal force.

    Confidence: Probable · As of 4 Mar 2025 · evidenced
    Evidence and sources

  • HL Bill 76, the Artificial Intelligence (Regulation) Bill [HL], is dated 4 March 2025 on its Parliament page.

    Confidence: Probable · As of 4 Mar 2025 · evidenced
    Evidence and sources

  • Parliament's stages page for the Artificial Intelligence (Regulation) Bill [HL] lists a first reading in the Lords on 4 March 2025 and a second reading with "Date to be announced"; the bill is in the 2024-26 session and is not marked withdrawn or defeated.

    Confidence: Probable · As of 4 Mar 2025 · evidenced
    Evidence and sources

  • Derived: Probable A tracker reports that the Artificial Intelligence (Regulation) Bill [HL] fell at the end of the parliamentary session on 30 April 2026 without reaching second reading.

    Confidence: Uncertain · As of 30 Apr 2026 · evidenced
    Evidence and sources

  • The Joint Committee on Human Rights published a report on human rights and the regulation of AI (HC 160).

    Confidence: Confirmed · evidenced
    Evidence and sources

  • The Committee recommends that the Government introduce a dedicated AI Bill and establish a new single AI regulator.

    Confidence: Confirmed · evidenced
    Evidence and sources

#

Artificial Superintelligence Bill (Commons Private Member's Bill, Alex Sobel) (Draft, no legal force): Commons Private Member's Bill under the Ten Minute Rule, introduced by Alex Sobel MP, that would prohibit the development, deployment and operation of artificial superintelligence systems and set up monitoring and control powers.

4 instruments · 5 obligations · 6 claims · Next: (Second reading of the Artificial Superintelligence Bill listed)

4 instruments (4 current) · 5 obligations · 6 claims · 6 milestones

Instruments

  • Artificial Superintelligence Bill (Commons Private Member's Bill, Alex Sobel) Draft, no legal force

    Commons Private Member's Bill under the Ten Minute Rule, introduced by Alex Sobel MP, that would prohibit the development, deployment and operation of artificial superintelligence systems and set up monitoring and control powers. UK Parliament's Bill Papers page records it as a Ten Minute Rule Bill in the 2026-27 session; BBC Parliament covered its introduction on 8 September 2026; second reading is listed by a tracker for 13 November 2026.

    Authority: UK Parliament · Verified · Official text
  • Crime and Policing Act 2026 In force since 2026-04-29

    Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • Data (Use and Access) Act 2025 In force since 2025-08-20

    Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • EU Artificial Intelligence Act (applies to UK providers and deployers whose output is used in the EU) Applies since 2025-02-02

    EU regulation that reaches providers and deployers established in third countries, including the UK, where AI system output is used in the Union. Its prohibited-practices chapter has applied since 2 February 2025.

    Binding · Verified · Official text

Obligations

  • Sexual Offences Act 2003 s.66E (inserted by DUAA s.138)

    It is an offence to intentionally create a purported intimate image of another person without consent and without reasonable belief in consent.

    prohibition · Applies to: other · Data (Use and Access) Act 2025
  • Sexual Offences Act 2003 s.66F (inserted by DUAA s.138)

    It is an offence to intentionally request the creation of a purported intimate image of another person who does not consent.

    prohibition · Applies to: other · Data (Use and Access) Act 2025
  • Sexual Offences Act 2003 s.46A (inserted by CPA 2026 s.72)

    It is an offence to make, adapt, possess, supply or offer to supply a CSA image-generator, an AI model or file designed to create child sexual abuse images; s.72 had not been brought into force on the evidence found at 5 October 2026.

    prohibition · Applies to: other · Crime and Policing Act 2026
  • Sexual Offences Act 2003 s.66I (inserted by CPA 2026 s.99)

    It is an offence to make or adapt, or supply or offer to supply, a thing (including a program or service) for use as a generator of purported intimate images; it is a defence to show all reasonable steps were taken to prevent use without consent.

    prohibition · Applies to: provider · Crime and Policing Act 2026
  • Article 5(1)

    Placing on the market, putting into service or use of listed prohibited AI practices is banned; the Act reaches UK providers and deployers whose output is used in the Union.

    prohibition · Applies to: provider · EU Artificial Intelligence Act (applies to UK providers and deployers whose output is used in the EU)

Milestones

  • EU AI Act Chapters I and II (including Art 5 prohibitions) apply Met
    EU Artificial Intelligence Act (applies to UK providers and deployers whose output is used in the EU)
  • Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
    Data (Use and Access) Act 2025
  • Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
    Data (Use and Access) Act 2025
  • Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent Met
    Crime and Policing Act 2026
  • Section 99 (purported intimate image generators) and ss.100-101 in force Met
    Crime and Policing Act 2026
  • Second reading of the Artificial Superintelligence Bill listed Upcoming
    Artificial Superintelligence Bill (Commons Private Member's Bill, Alex Sobel)
Claims and evidence (6)

#

Personal Data (Digital Twins) Bill (Commons Private Member's Bill) (Draft, no legal force): Commons Private Member's Bill under the Ten Minute Rule on software using personal data to model individuals' preferences or behaviour; no text papers published; no legal force.

1 instrument · 0 obligations · 3 claims

1 instrument (1 current) · 0 obligations · 3 claims · 0 milestones

Instruments

  • Personal Data (Digital Twins) Bill (Commons Private Member's Bill) Draft, no legal force

    Commons Private Member's Bill under the Ten Minute Rule on software using personal data to model individuals' preferences or behaviour; no text papers published; no legal force.

    Authority: UK Parliament · Verified · Official text
Claims and evidence (3)

  • The Personal Data (Digital Twins) Bill is a Commons Private Member's Bill under the Ten Minute Rule in the 2026-27 session; it is not an Act and has not been withdrawn or defeated.

    Confidence: Probable · evidenced
    Evidence and sources
    • Personal Data (Digital Twins) Bill (UK Parliament Bill Papers) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page header and tablePersonal Data (Digital Twins) Bill 1. Bill Papers 2. Bills 3. Personal Data (Digital Twins) Bill # Personal Data (Digital Twins) Bill Parliament bill page |Bill type:|Private Members' Bill (under the Ten Minute Rule)| |--|--| |Originating House:|House of C
    • Personal Data (Digital Twins) Bill (UK Parliament Bill Papers) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Originating session (bill system ID):|Parliament 59 - Session 2 (2026-27)| |Is Act:|false| |Is with

  • The Bill is a Private Member's Bill with no published papers and no legal force.

    Confidence: Probable · evidenced
    Evidence and sources
    • Personal Data (Digital Twins) Bill (UK Parliament Bill Papers) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page header and tablePersonal Data (Digital Twins) Bill 1. Bill Papers 2. Bills 3. Personal Data (Digital Twins) Bill # Personal Data (Digital Twins) Bill Parliament bill page |Bill type:|Private Members' Bill (under the Ten Minute Rule)| |--|--| |Originating House:|House of C
    • Personal Data (Digital Twins) Bill (UK Parliament Bill Papers) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Originating session (bill system ID):|Parliament 59 - Session 2 (2026-27)| |Is Act:|false| |Is with

  • A tracker reports that Dame Chi Onwurah MP introduced the Bill under the Ten Minute Rule on 9 September 2026.

    Confidence: Uncertain · As of 9 Sep 2026 · evidenced
    Evidence and sources

#

Nothing recorded for this module in the research of 2026-10-08.

0 instruments · 0 obligations · 0 claims

Nothing recorded for this module in the research of 2026-10-08.

#

CAP and ASA guidance on AI-generated advertising and deepfakes (Published 2026-06-11): Self-regulatory guidance from CAP and the ASA saying the CAP and BCAP Codes contain no AI-specific rules but apply media-neutrally: misleading deepfake endorsements, harmful AI-generated images and automated ad campaigns are judged under the existing Codes and the advertiser stays responsible.

5 instruments · 6 obligations · 16 claims · Next: (Ofcom evidence request on protections for women and girls closes)

5 instruments (5 current) · 6 obligations · 16 claims · 6 milestones

Instruments

  • CAP and ASA guidance on AI-generated advertising and deepfakes Published 2026-06-11

    Self-regulatory guidance from CAP and the ASA saying the CAP and BCAP Codes contain no AI-specific rules but apply media-neutrally: misleading deepfake endorsements, harmful AI-generated images and automated ad campaigns are judged under the existing Codes and the advertiser stays responsible.

    Regulatory expectation · Authority: Advertising Standards Authority and Committee of Advertising Practice · Verified · Official text
  • CMA guidance: Complying with consumer law when using AI agents Published 2026-03-09

    CMA guidance of 9 March 2026 telling businesses that they are responsible for what an AI agent does as for an employee, that they should consider labelling AI agents, and that they should train, monitor and quickly refine agents, with a human in the loop. It sits alongside CMA research on agentic AI and consumers.

    Non-binding · Authority: Competition and Markets Authority · Verified · Official text
  • CMA publisher conduct requirement on Google general search (generative AI controls) Published 2026-06-03; entry into force not recorded

    Conduct requirement imposed by the CMA on Google requiring publisher controls over use of search content in generative AI, clear information, engagement metrics and attribution.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • Data (Use and Access) Act 2025 In force since 2025-08-20

    Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Online Safety Act 2023 Date not recorded

    Act imposing illegal-content risk assessment and safety duties on regulated user-to-user and search services, enforced by Ofcom with penalties of up to the greater of £18 million or 10% of qualifying worldwide revenue. Ofcom has said it applies to generative AI chatbots and platforms.

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text

Obligations

  • Sexual Offences Act 2003 s.66E (inserted by DUAA s.138)

    It is an offence to intentionally create a purported intimate image of another person without consent and without reasonable belief in consent.

    prohibition · Applies to: other · Data (Use and Access) Act 2025
  • Online Safety Act 2023 s.9(2)

    Providers of regulated user-to-user services must carry out a suitable and sufficient illegal content risk assessment.

    risk management · Applies to: provider · Online Safety Act 2023
  • Publisher conduct requirement (final decision and notice)

    Google must provide publishers with effective controls over use of their search content in generative AI and related transparency, metrics and attribution measures.

    transparency disclosure · Applies to: provider · CMA publisher conduct requirement on Google general search (generative AI controls)
  • Guidance section "Tell your customers if you use an AI agent"

    Businesses using AI agents with customers should consider labelling them so customers are not misled into thinking a real person provides the service, and should not overstate the role of AI.

    transparency disclosure · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
  • CAP Code (media-neutral application to AI-generated ads); CAP News 11 June 2026

    Advertisers using AI to create or distribute ads, including deepfakes and automated ad platforms, must make the ads comply with the CAP Code and remain responsible for AI output used in their ads.

    other · Applies to: deployer · CAP and ASA guidance on AI-generated advertising and deepfakes
  • Automated Vehicles Act 2024 s.79 (Part 4)

    It is an offence to make, in the course of business, a communication about a product or service likely to confuse end-users in Great Britain as to whether a vehicle that is not an authorised automated vehicle can travel autonomously, safely and legally; due-diligence defences apply.

    transparency disclosure · Applies to: provider · Automated Vehicles Act 2024

Milestones

  • Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
    Data (Use and Access) Act 2025
  • CMA guidance on complying with consumer law when using AI agents published Met
    CMA guidance: Complying with consumer law when using AI agents
  • Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
    Data (Use and Access) Act 2025
  • CAP guidance "AI and Deepfakes: Four Things Advertisers Need to Know" published Met
    CAP and ASA guidance on AI-generated advertising and deepfakes
  • Ofcom expectation that platforms have hash-matching for illegal intimate images and deepfakes in place Status not recorded
    Online Safety Act 2023
  • Ofcom evidence request on protections for women and girls closes Upcoming
    Online Safety Act 2023
Claims and evidence (16)

  • Derived: Probable Section 138 of the Data (Use and Access) Act 2025, creating offences of intentionally creating or requesting the creation of a purported intimate image of another person without consent, came into force on 6 February 2026 under SI 2026/31.

    Confidence: Confirmed · As of 6 Feb 2026 · evidenced
    Evidence and sources

  • Derived: Probable Section 99 of the Crime and Policing Act 2026 inserts Sexual Offences Act 2003 section 66I, making it an offence to make, adapt, supply or offer to supply a 'nudification' tool for generating purported intimate images; section 99 came into force on 29 June 2026.

    Confidence: Confirmed · As of 29 Jun 2026 · evidenced
    Evidence and sources

  • CAP confirmed on 11 June 2026 that the media-neutral CAP Code applies to AI-generated advertising content, including deepfakes, and the ASA has upheld rulings against harmful AI-generated images on that basis.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • Derived: Probable Ofcom published an open letter reminding providers what the Online Safety Act regulates and how it applies to generative AI chatbot tools and platforms.

    Confidence: Probable · evidenced
    Evidence and sources

  • Section 9 of the Online Safety Act 2023 requires providers of regulated user-to-user services to carry out a suitable and sufficient illegal content risk assessment.

    Confidence: Probable · evidenced
    Evidence and sources

  • The publisher conduct requirement requires Google to provide publishers with effective controls over the use of their search content in generative AI, among other transparency and attribution obligations.

    Confidence: Probable · As of 3 Jun 2026 · evidenced
    Evidence and sources

  • The ASA/CAP state that the media-neutral CAP Code applies in full to AI-generated advertising, and recent rulings have found harmful AI-generated images in breach of the Code on the same basis as any other image.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • The guidance says businesses should consider labelling AI agents so they do not mislead customers into thinking they deal with a real person, and should keep a human in the loop checking the agent's decisions.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "Tell your customers if you use an AI agent"If you use an AI agent, consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person – if the fact they are dealing with AI rather than a person might affect people's decisions then you should tell them. Do not overstate the ro
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "Monitor how your AI agents are performing"Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results. Regular human oversight is important to catch mistakes and ensure that AI agents are completing tasks in a legally complian

  • The guidance applies the DMCCA to AI agents running marketing campaigns, processing refunds, answering customer queries and providing comparison services, including accurate pricing, labelled paid endorsements and genuine offers.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Example: using an AI agent to run your latest marketing campaignThink about the requirements of the Digital Markets, Competition and Consumers Act 2024 when you design and train the AI. For example:
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu

  • CAP published "AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit Run" on 11 June 2026, following earlier AI and deepfake guidance of 8 February 2024, 7 February 2025 and 12 June 2025.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • CAP said on 12 June 2025 that the CAP and BCAP Codes do not contain specific rules relating to AI and that marketers must ensure AI use does not breach the existing rules; there is no separate Code section for AI-generated or deepfake ads.

    Confidence: Confirmed · As of 12 Jun 2025 · evidenced
    Evidence and sources
    • "Write a useful article helping marketers with tips for using AI" (CAP News) T1 · retrieved · retrieved 8 Oct 2026 · CAP News 12 June 2025Whilst the CAP and BCAP Codes do not contain specific rules relating to AI at this time, marketers should ensure that their use of AI doesn’t generate an issue with the existing rules. Download the latest advice for marketers on using AI in ads.
    • In at the Deep(fake) End (CAP News) T1 · retrieved · retrieved 8 Oct 2026 · CAP News 8 February 2024, section "CAP Code vs Coding?"There isn’t a separate section of the CAP Code that deals with AI-generated ads. This means any ads the ASA might assess that use deepfake t
    • AI and Deepfakes: Four Things Advertisers Need to Know Before They Hit "Run" (CAP News) T1 · retrieved · retrieved 8 Oct 2026 · Point 1: The CAP Code is media-neutralAI might change how ads are made, but it doesn't change how they're regulated. The Code is media-neutral, meaning the rules apply regardless of how the content

  • CAP says an AI-generated celebrity endorsement that looks real enough to mislead consumers is likely to breach the Code, and that marketers must ensure deepfake content complies with the rules on misleadingness, testimonials and endorsements; personality and intellectual property rights are not ASA matters.

    Confidence: Confirmed · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • Derived: Probable CAP says the advertiser remains responsible for any AI output used in its ads, and the ASA found that an advertiser was still primarily responsible for CAP Code compliance although the ad was produced with Google's automated tools.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • The ASA applies the CAP Code to ads within its remit, so AI-generated ads must comply with it; the guidance itself adds no new rule.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources

  • Derived: Probable CAP said on 7 February 2025 that it is closely monitoring AI policy developments and that the rules in Section 6 of the CAP and BCAP Codes on depicting or referring to living persons would likely apply to generative AI replicas.

    Confidence: Probable · As of 7 Feb 2025 · evidenced
    Evidence and sources

  • Derived: Probable Part 4 of the Act (marketing restrictions), so far as not already in force, comes into force on 7 January 2027 under SI 2026/731 made 1 July 2026.

    Confidence: Confirmed · As of 7 Jan 2027 · evidenced
    Evidence and sources

#

Copyright, Designs and Patents Act 1988 (Date not recorded): Core UK copyright statute; s.29A permits copying for text and data analysis only for non-commercial research by a person with lawful access.

3 instruments · 1 obligation · 6 claims

3 instruments (3 current) · 1 obligation · 6 claims · 2 milestones

Instruments

  • Copyright, Designs and Patents Act 1988 Date not recorded

    Core UK copyright statute; s.29A permits copying for text and data analysis only for non-commercial research by a person with lawful access. No commercial AI training exception has been enacted. Getty v Stability AI tested secondary infringement over model weights.

    Binding · Authority: UK Parliament · Verified · Official text
  • Data (Use and Access) Act 2025 In force since 2025-08-20

    Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Report on Copyright and Artificial Intelligence (section 136 Data (Use and Access) Act 2025) Published 2026-03-18

    Government report laid under DUAA s.136 stating that a broad text-and-data-mining exception with opt-out is no longer its preferred way forward.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text

Obligations

  • Copyright, Designs and Patents Act 1988 s.29A(1)

    Copying for computational analysis is non-infringing only if made by a person with lawful access for the sole purpose of non-commercial research and accompanied by sufficient acknowledgement.

    other · Applies to: other · Copyright, Designs and Patents Act 1988

Milestones

  • Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
    Data (Use and Access) Act 2025
  • Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
    Data (Use and Access) Act 2025
Claims and evidence (6)

  • The copyright and AI reporting duties in sections 135-137 of the Data (Use and Access) Act 2025 came into force on 20 August 2025.

    Confidence: Probable · As of 20 Aug 2025 · evidenced
    Evidence and sources

  • Sections 135-136 required the Secretary of State to publish an economic impact assessment and a report on the use of copyright works in AI development within nine months of Royal Assent; the report was published on 18 March 2026.

    Confidence: Probable · As of 18 Mar 2026 · evidenced
    Evidence and sources

  • Derived: Probable The High Court's judgment in Getty Images v Stability AI, handed down 4 November 2025, held that Stability AI's model weights do not themselves store or reproduce Getty's copyright works, while finding limited trade mark infringement.

    Confidence: Probable · As of 4 Nov 2025 · evidenced
    Evidence and sources

  • In its section 136 report published 18 March 2026 the Government said a broad copyright exception with opt-out is no longer its preferred way forward and proposed to gather further evidence.

    Confidence: Probable · As of 18 Mar 2026 · evidenced
    Evidence and sources
    • Report on Copyright and Artificial Intelligence T1 · retrieved · retrieved 8 Oct 2026 · Report on Copyright and AI, executive summarya broad copyright exception with opt-out is no longer the government's preferred way forward. We propose to gather further evidence on how copyright laws are impacting the development and deployment of AI across the economy.
    • Report on Copyright and Artificial Intelligence T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK publication headerPublished 18 March 2026 This was published under the 2024 to 2026 Starmer Labour government ## Contents 1. Section A:
    • Report on Copyright and Artificial Intelligence T1 · retrieved · retrieved 8 Oct 2026 · Report, introductionThis report has been prepared pursuant to section 136 of the Data (Use and Access) Act 2025 ("the D(UA) Act"). It considers the use of copyright works in the development of artificial in

  • Section 29A of the Copyright, Designs and Patents Act 1988 permits a copy made for computational analysis only where the sole purpose is non-commercial research and the person has lawful access.

    Confidence: Probable · evidenced
    Evidence and sources
    • Copyright, Designs and Patents Act 1988, section 29A T1 · retrieved · retrieved 8 Oct 2026 · CDPA s.29A(1)(1)The making of a copy of a work by a person who has lawful access to the work does not infringe copyright in the work provided that—
    • Copyright, Designs and Patents Act 1988, section 29A T1 · retrieved · retrieved 8 Oct 2026 · CDPA s.29A(1)(a)(a)the copy is made in order that a person who has lawful access to the work may carry out a computational analysis of anything recorded in the work for the sole purpose of research for a non-commercial purpose, and

  • Derived: Probable In its judgment of 4 November 2025 the High Court held that Stability AI's trained Stable Diffusion model does not store Getty's copyright works and that the model weights are not themselves an infringing copy; Getty has sought permission to appeal.

    Confidence: Probable · As of 4 Nov 2025 · evidenced
    Evidence and sources

#

AI Action Plan for Justice: one year on (Ministry of Justice, 24 September 2026) (Published 2026-09-24): Ministry of Justice progress report published 24 September 2026 introducing a fourth strategic priority to strengthen the response to emerging AI risks in the justice system.

24 instruments · 12 obligations · 56 claims · Next: (First regulations (social media for under-16s) to be laid before Parliament "by the end of the year"; AI chatbot measures later by regulations)

24 instruments (24 current) · 12 obligations · 56 claims · 9 milestones

Instruments

  • AI Action Plan for Justice: one year on (Ministry of Justice, 24 September 2026) Published 2026-09-24

    Ministry of Justice progress report published 24 September 2026 introducing a fourth strategic priority to strengthen the response to emerging AI risks in the justice system.

    Non-binding · Authority: Ministry of Justice · Verified · Official text
  • AI Opportunities Action Plan Published 2026-01-29; valid from 2025-01-01

    Government plan launched in January 2025; the January 2026 update reports that commitments on 38 of 50 actions have been met.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
  • AI Risk Management Toolkit (DSIT guidance, 8 September 2026) Published 2026-09-08

    DSIT guidance and workbook to help anyone involved in AI projects understand, assess and manage risks when designing, procuring or delivering AI products; aligned with the Orange Book risk management framework.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
  • Algorithmic Transparency Recording Standard (ATRS) mandatory scope and exemptions policy Published 2024-12-17; entry into force not recorded

    Non-statutory cross-government policy requiring central government organisations to complete ATRS records for in-scope algorithmic tools. Mandated across government departments on 6 February 2024.

    Binding · Authority: Cabinet Office · Verified · Official text
  • Artificial Intelligence (AI) Guidance for Judicial Office Holders (October 2025) Published 2025-10-31

    Judiciary guidance for judicial office holders, clerks and support staff on responsible use of AI in courts and tribunals, replacing earlier versions; requires AI use to be consistent with protecting the integrity of the administration of justice.

    Non-binding · Authority: Courts and Tribunals Judiciary · Verified · Official text
  • Automated Vehicles Act 2024 In force since 2026-07-01

    Act on authorisation and use of self-driving vehicles in Great Britain; s.1 sets the self-driving test; s.79 (Part 4) makes it an offence to communicate in a way likely to confuse end-users about autonomous capability, commencing 7 January 2027 under SI 2026/731.

    Binding · Authority: UK Parliament · Verified · Official text
  • Bank of England response to Treasury Committee report on AI in financial services (1 April 2026) Published 2026-04-01

    Letter of 1 April 2026 from Sarah Breeden to the Treasury Committee Chair rejecting the Committee's characterisation that the Bank takes a "wait and see" approach to AI and responding to its call for AI-specific stress testing.

    Non-binding · Authority: Bank of England · Verified · Official text
  • Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience Published 2026-05-15

    Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

    Regulatory expectation · Authority: Bank of England, Financial Conduct Authority · Verified · Official text
  • Children's Wellbeing and Schools Act 2026 In force since 2026-04-29

    Act of 29 April 2026 whose Part 3 inserts a power into the Online Safety Act 2023 (s.214A) for the Secretary of State to require providers of internet services to prevent or restrict access by children to services or features. The Government says it will use these powers for under-16 social media limits and, in July 2026, for measures on AI chatbots.

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • CMA guidance: Complying with consumer law when using AI agents Published 2026-03-09

    CMA guidance of 9 March 2026 telling businesses that they are responsible for what an AI agent does as for an employee, that they should consider labelling AI agents, and that they should train, monitor and quickly refine agents, with a human in the loop. It sits alongside CMA research on agentic AI and consumers.

    Non-binding · Authority: Competition and Markets Authority · Verified · Official text
  • Crime and Policing Act 2026 In force since 2026-04-29

    Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • Cyber Security and Resilience (Network and Information Systems) Bill Draft, no legal force

    Government Bill reforming the NIS Regulations 2018, bringing managed service providers, data centres and other critical suppliers into scope; AI relevance is indirect (data-centre infrastructure that hosts AI).

    Authority: UK Parliament · Verified · Official text
  • Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime) In force since 2025-04-06

    Act whose consumer protection provisions prohibit unfair commercial practices and let the CMA decide infringements directly and impose penalties of up to the greater of £300,000 or 10% of turnover. The consumer regime has applied since 6 April 2025, and CMA guidance of 9 March 2026 says it governs AI agents used with consumers.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • FCA approach to AI: no new AI-specific rules and AI Live Testing Published 2026-06-08

    FCA position that it will not introduce new regulations for AI and will rely on existing frameworks such as the Consumer Duty and SM&CR, supported by an AI Live Testing programme whose second cohort was announced on 21 April 2026.

    Non-binding · Authority: Financial Conduct Authority · Verified · Official text
  • FCA Mills Review: impact of AI on retail financial services (6 July 2026) Published 2026-07-06

    FCA-commissioned review led by executive director Sheldon Mills, published 6 July 2026, on how AI could reshape retail financial services; makes 7 recommendations for the FCA Board and Executive to consider, including adapting the regulatory perimeter. Advisory; the FCA has not adopted the recommendations in the sources read.

    Non-binding · Authority: Financial Conduct Authority · Verified · Official text
  • FCA multi-firm review: Frontier AI and cyber resilience (September 2026) Published 2026-09-02

    FCA publication of 2 September 2026 summarising what firms reported about using, testing and preparing for frontier AI models with cyber capabilities; it states that it does not introduce new rules, guidance or regulatory expectations.

    Non-binding · Authority: Financial Conduct Authority · Verified · Official text
  • Financial Policy Committee judgement on frontier AI and financial stability (July 2026) Published 2026-07-07

    In July 2026 the Financial Policy Committee judged that rapid progress in frontier AI capabilities significantly increases financial stability risks from cyber and operational vulnerabilities, and urged firms to act on the May 2026 joint statement.

    Non-binding · Authority: Financial Policy Committee (Bank of England) · Verified · Official text
  • Growing up in the online world: government response (July 2026), AI chatbot measures Published 2026-07-15

    Government response of 15 July 2026 to a national consultation on children's online safety. It commits to require AI chatbots to introduce mandatory breaks for under-18s, to stop under-18s accessing chatbot services that primarily offer sexualised content, and to consider banning children from certain chatbots, using powers in the Children's Wellbeing and Schools Act 2026; definitions will follow in regulations.

    Non-binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • JSP 936: Dependable Artificial Intelligence (AI) in defence (part 1: directive) Published 2024-11-13

    MOD policy framework for the safe and responsible use of AI in defence, with directives on governance, development and assurance across the AI lifecycle.

    Legal force not established · Authority: Ministry of Defence · Verified · Official text
  • National Commission into the Regulation of AI in Healthcare: recommendations and Government response Published 2026-10-06

    The National Commission's 44 recommendations on regulating AI in healthcare were published on 10 September 2026, and on 6 October 2026 the Government said it accepts all of them. The MHRA is to consult on classification and then use secondary legislation to update the medical device definition.

    Non-binding · Authority: Medicines and Healthcare products Regulatory Agency · Verified · Official text
  • PRA Supervisory Statement SS1/23: Model risk management principles for banks Published 2023-05-17; valid from 2024-05-17

    PRA supervisory statement setting five model risk management principles for banks, including managing risks from AI and machine learning models. Current version published and effective from 23 April 2026.

    Regulatory expectation · Authority: Prudential Regulation Authority (Bank of England) · Verified · Official text
  • SRA warning notice: misuse of AI Published 2026-08-17

    Warning notice on misuse of AI in legal services, including false citations; states reliance on AI output is not a defence and existing professional standards still apply. The SRA reports 42 AI-misuse reports from July 2025 to July 2026 and ongoing investigations.

    Non-binding · Authority: Solicitors Regulation Authority · Verified · Official text
  • The Medical Devices Regulations 2002 Date not recorded

    UK medical devices regulations whose definition of medical device expressly includes software intended for diagnosis or therapy. The Government has accepted proposals to update the definition and classification for AI-enabled devices by secondary legislation.

    Binding · Authority: Medicines and Healthcare products Regulatory Agency · Verified · Official text
  • UK Government and Google DeepMind Memorandum of Understanding on AI opportunities and security Published 2025-12-11

    Voluntary, non-binding memorandum between DSIT and Google DeepMind to collaborate on public services, scientific discovery and AI security. Published on 11 December 2025.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text

Obligations

  • Medical Devices Regulations 2002 reg 11

    A person must not affix a UK marking to a general medical device unless the relevant requirements of other applicable product safety legislation are also satisfied.

    conformity assessment · Applies to: product manufacturer · The Medical Devices Regulations 2002
  • ATRS policy sections 2-3

    Central government departments and in-scope arm's-length bodies must complete ATRS records for in-scope algorithmic tools.

    transparency disclosure · Applies to: deployer · Algorithmic Transparency Recording Standard (ATRS) mandatory scope and exemptions policy
  • SS1/23 Principles 1-5

    PRA expects banks to maintain a model risk management framework under five principles, including identifying and managing risks from AI and machine learning models.

    risk management · Applies to: deployer · PRA Supervisory Statement SS1/23: Model risk management principles for banks
  • BoE/FCA/HMT joint statement, 15 May 2026

    Regulated firms and financial market infrastructures must plan for and mitigate cybersecurity risks posed by frontier AI, consistent with existing operational resilience rules and expectations.

    risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • DMCCA s.225(1) (Part 4 Chapter 1)

    Traders must not engage in unfair commercial practices; the prohibition applies whether the practice is carried out by a person or by a system acting for the trader (CMA guidance applies it to AI agents).

    prohibition · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
  • DMCCA s.226(1) (misleading actions)

    A commercial practice involving false or misleading information, or an overall presentation likely to deceive the average consumer, is a misleading action and is an unfair commercial practice.

    transparency disclosure · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
  • Guidance section "Tell your customers if you use an AI agent"

    Businesses using AI agents with customers should consider labelling them so customers are not misled into thinking a real person provides the service, and should not overstate the role of AI.

    transparency disclosure · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
  • Guidance sections "Train", "Monitor" and "Refine"

    Businesses should train AI agents to comply with consumer law, monitor them with a human in the loop, and refine them quickly if problems arise; the business remains responsible for what the agent does.

    human oversight · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
  • Statement section "What this means for regulated firms"

    Regulated firms and financial market infrastructures need to take action to plan for and mitigate cybersecurity risks posed by frontier AI, including board understanding, faster vulnerability remediation and automated defences.

    risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • Statement domain "Managing risks from third parties"

    Firms should manage frontier-AI cyber risks from third parties and supply chains, including open-source software, and be able to identify, monitor and manage external applications, libraries and services.

    risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • Online Safety Act 2023 s.214A (inserted by CWSA 2026 s.70)

    The Secretary of State may by regulations require providers of specified internet services to prevent or restrict access by children of specified ages to services or features, including time-of-day and daily-time limits; the Act itself imposes no duty until regulations are made.

    other · Applies to: provider · Children's Wellbeing and Schools Act 2026
  • Automated Vehicles Act 2024 s.79 (Part 4)

    It is an offence to make, in the course of business, a communication about a product or service likely to confuse end-users in Great Britain as to whether a vehicle that is not an authorised automated vehicle can travel autonomously, safely and legally; due-diligence defences apply.

    transparency disclosure · Applies to: provider · Automated Vehicles Act 2024

Milestones

  • DMCCA consumer enforcement regime (unfair commercial practices; CMA direct enforcement) in force Met
    Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
  • CMA guidance on complying with consumer law when using AI agents published Met
    CMA guidance: Complying with consumer law when using AI agents
  • Current version of SS1/23 published and effective Met
    PRA Supervisory Statement SS1/23: Model risk management principles for banks
  • Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent Met
    Crime and Policing Act 2026
  • Joint statement on frontier AI models and cyber resilience published Met
    Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • Section 99 (purported intimate image generators) and ss.100-101 in force Met
    Crime and Policing Act 2026
  • Lords second reading (tracker) Met
    Cyber Security and Resilience (Network and Information Systems) Bill
  • (year)First regulations (social media for under-16s) to be laid before Parliament "by the end of the year"; AI chatbot measures later by regulations Upcoming
    Growing up in the online world: government response (July 2026), AI chatbot measures
  • Part 4 (marketing restrictions, incl. s.79 offence) in force Upcoming
    Automated Vehicles Act 2024
Claims and evidence (56)

  • Section 248 of the Crime and Policing Act 2026, in force at Royal Assent (29 April 2026), gives the Secretary of State a power to amend the Online Safety Act 2023 to address risks of harm from AI services.

    Confidence: Confirmed · As of 29 Apr 2026 · evidenced
    Evidence and sources

  • The Bank of England, FCA and HM Treasury issued a joint statement on 15 May 2026 setting expectations that regulated firms plan for and mitigate cybersecurity risks posed by frontier AI.

    Confidence: Probable · As of 15 May 2026 · evidenced
    Evidence and sources

  • The PRA's SS1/23 model risk management principles for banks, confirmed as technology-neutral and covering AI models, remained the Bank of England's primary AI model-risk supervisory expectation as at April 2026.

    Confidence: Probable · As of 1 Apr 2026 · evidenced
    Evidence and sources

  • The CMA published guidance on 9 March 2026 stating that a business is responsible under consumer law for what an AI agent does, as it would be for an employee, even where a third party designed or provides the agent.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu

  • Regulation 2 of the Medical Devices Regulations 2002 defines a medical device to include software intended by the manufacturer to be used specifically for diagnosis or therapeutic purposes.

    Confidence: Probable · evidenced
    Evidence and sources
    • The Medical Devices Regulations 2002, regulation 2 T1 · retrieved · retrieved 8 Oct 2026 · MDR 2002 reg 2(1) "medical device"any instrument, apparatus, appliance, software, material or other article, whether used alone or in combination, together with any accessories, including the software intended by its manufacturer to be used specifically for diagnosis or therapeutic p

  • The FCA has said it will not introduce new AI-specific regulation and will instead rely on existing frameworks such as the Consumer Duty and SM&CR.

    Confidence: Probable · As of 8 Jun 2026 · evidenced
    Evidence and sources

  • The PRA's SS1/23 model risk management principles for banks are technology-neutral and the Bank of England has confirmed they apply to AI models.

    Confidence: Probable · As of 17 May 2023 · evidenced
    Evidence and sources

  • The Bank of England, FCA and HM Treasury jointly stated on 15 May 2026 that frontier AI poses cyber and operational risks firms must manage under existing operational resilience rules.

    Confidence: Confirmed · As of 15 May 2026 · evidenced
    Evidence and sources

  • The FCA stated on 8 June 2026 that it will not introduce new AI-specific regulation and will rely on existing frameworks including the Consumer Duty and SM&CR, and on 21 April 2026 announced a second AI Live Testing cohort.

    Confidence: Probable · As of 8 Jun 2026 · evidenced
    Evidence and sources

  • JSP 936 (part 1: directive) is the MOD's principal policy framework governing safe and responsible use of AI in defence.

    Confidence: Probable · As of 13 Nov 2024 · evidenced
    Evidence and sources

  • The AI Opportunities Action Plan One Year On update, dated 29 January 2026, reports the Government has met its commitments on 38 of the plan's 50 actions.

    Confidence: Probable · As of 29 Jan 2026 · evidenced
    Evidence and sources
    • AI Opportunities Action Plan: One Year On T1 · retrieved · retrieved 8 Oct 2026 · Action Plan One Year On (introduction)Since then, the government has met its commitments on 38 of the plan’s 50 actions.

  • On 6 October 2026 the Government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare; the MHRA will consult on classification of software and AI-enabled devices before using secondary legislation to update the medical device definition.

    Confidence: Confirmed · As of 6 Oct 2026 · evidenced
    Evidence and sources

  • The Digital Markets, Competition and Consumers Act 2024 (c. 13) contains the UK consumer-enforcement regime in Part 3 Chapters 3-4 and Part 4 Chapter 1.

    Confidence: Probable · As of 24 May 2024 · evidenced
    Evidence and sources

  • Section 225 prohibits unfair commercial practices and section 226 defines misleading actions, which cover the provision of false or misleading information about a product, trader or other matter relevant to a transactional decision.

    Confidence: Probable · As of 6 Apr 2025 · evidenced
    Evidence and sources

  • The CMA published its guidance "Complying with consumer law when using AI agents" and the research paper "Agentic AI and consumers" on 9 March 2026.

    Confidence: Confirmed · As of 9 Mar 2026 · evidenced
    Evidence and sources

  • Derived: Probable The CMA guidance explains how businesses can use agentic AI with customers while complying with consumer law; it is guidance and not itself legislation.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources

  • The CMA says a business is responsible for what an AI agent does in the same way as for an employee, even where someone else designed or provides the agent.

    Confidence: Confirmed · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu
    • Agentic AI and consumers (CMA research and analysis) T1 · retrieved · retrieved 8 Oct 2026 · Section on AI and pricing / collusionBusinesses remain responsible for the outcomes of pricing and commercial decisions shaped by AI systems, and must take proactive steps to understand, test and govern the technologies they deploy. As AI systems become more autonomous, ensuring that they are designed, monitored and constrained in ways

  • Derived: Probable The CMA warns that a business that breaks consumer protection law, including through an AI agent, could face enforcement action, be fined up to 10% of its worldwide turnover and be forced to compensate affected consumers.

    Confidence: Confirmed · As of 9 Mar 2026 · evidenced
    Evidence and sources

  • The guidance says businesses should consider labelling AI agents so they do not mislead customers into thinking they deal with a real person, and should keep a human in the loop checking the agent's decisions.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "Tell your customers if you use an AI agent"If you use an AI agent, consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person – if the fact they are dealing with AI rather than a person might affect people's decisions then you should tell them. Do not overstate the ro
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "Monitor how your AI agents are performing"Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results. Regular human oversight is important to catch mistakes and ensure that AI agents are completing tasks in a legally complian

  • The guidance applies the DMCCA to AI agents running marketing campaigns, processing refunds, answering customer queries and providing comparison services, including accurate pricing, labelled paid endorsements and genuine offers.

    Confidence: Probable · As of 9 Mar 2026 · evidenced
    Evidence and sources
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Example: using an AI agent to run your latest marketing campaignThink about the requirements of the Digital Markets, Competition and Consumers Act 2024 when you design and train the AI. For example:
    • Complying with consumer law when using AI agents (CMA guidance) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu

  • The Bank of England, the FCA and HM Treasury published their joint statement on frontier AI models and cyber resilience on 15 May 2026.

    Confidence: Confirmed · As of 15 May 2026 · evidenced
    Evidence and sources

  • Derived: Probable The joint statement says firms need to act to mitigate frontier-AI cyber risk "in line with our operational resilience rules and expectations", and that the authorities judge firms should take active steps across five domains; it sets no new rule.

    Confidence: Probable · As of 15 May 2026 · evidenced
    Evidence and sources

  • The authorities say firms should ensure board understanding of frontier AI risks, remediate vulnerabilities faster and at scale, manage third-party and open-source risk, adopt automated defences and be able to respond and recover quickly.

    Confidence: Confirmed · As of 15 May 2026 · evidenced
    Evidence and sources

  • The statement says the cyber capabilities of current frontier AI models already exceed what a skilled practitioner could achieve, at higher speed, greater scale and lower cost, which amplifies threats to firms and financial stability if used maliciously.

    Confidence: Probable · As of 15 May 2026 · evidenced
    Evidence and sources

  • The Bank of England published the July 2026 Financial Stability Report and the FPC record, including the frontier AI judgement, on 7 July 2026.

    Confidence: Confirmed · As of 7 Jul 2026 · evidenced
    Evidence and sources
    • Financial Policy Committee Record - July 2026 T1 · retrieved · retrieved 8 Oct 2026 · Page headerFinancial Stability Report - July 2026 Published on 07 July 2026 Financial Policy Committee Record - July 2026 (PDF 0.
    • Financial Stability Report - July 2026 T1 · retrieved · retrieved 8 Oct 2026 · FSR July 2026 headline summaryRapid advances in and differing access to AI capabilities have increased cyber and operational resilience risks

  • The FPC judged that rapid progress in frontier AI capabilities since the December Financial Stability Report presents a significant increase in financial stability risks from cyber and operational vulnerabilities.

    Confidence: Confirmed · As of 7 Jul 2026 · evidenced
    Evidence and sources
    • Financial Policy Committee Record - July 2026 T1 · retrieved · retrieved 8 Oct 2026 · Headline judgements, "Developments in frontier AI"Rapid progress in frontier AI capabilities since the December FSR present a significant increase in the risks to financial stability from cyber and operational vulnerabilities. ** Frontier AI models are increasingly capa
    • Financial Stability Report - July 2026 T1 · retrieved · retrieved 8 Oct 2026 · FSR July 2026 headline summaryRapid advances in and differing access to AI capabilities have increased cyber and operational resilience risks

  • The FPC said the developments reinforce the importance of firms acting on the May 2026 Bank, FCA and HM Treasury joint statement and on existing cyber and operational resilience frameworks.

    Confidence: Probable · As of 7 Jul 2026 · evidenced
    Evidence and sources
    • Financial Policy Committee Record - July 2026 T1 · retrieved · retrieved 8 Oct 2026 · Headline judgements, "Developments in frontier AI"These developments reinforce the importance of firms acting on the May 2026 joint statement from the Bank, Financial Conduct Authority (FCA) and HM Treasury on frontier models, and on existing cyber and operational resilience frameworks. UK authorities are providing further support through supervi

  • The FCA published its multi-firm review "Frontier AI and cyber resilience" on 2 September 2026.

    Confidence: Probable · As of 2 Sep 2026 · evidenced
    Evidence and sources

  • The FCA says the review summarises observations reported by firms and does not introduce new rules, guidance or regulatory expectations.

    Confidence: Probable · As of 2 Sep 2026 · evidenced
    Evidence and sources
    • Frontier AI and cyber resilience (FCA multi-firm review) T1 · retrieved · retrieved 8 Oct 2026 · Section "What we expect from firms"This publication summarises observations reported by firms during our engagement. It does not introduce new rules, guidance or regulatory expectations.

  • The Children's Wellbeing and Schools Act 2026 (c. 21) received Royal Assent on 29 April 2026.

    Confidence: Confirmed · As of 29 Apr 2026 · evidenced
    Evidence and sources

  • The Children's Wellbeing and Schools Act 2026 is an Act of Parliament; its Part 3 online safety power is in force.

    Confidence: Confirmed · As of 29 Apr 2026 · evidenced
    Evidence and sources

  • Derived: Probable Section 70 (power to restrict children's access to internet services) came into force at Royal Assent on 29 April 2026.

    Confidence: Confirmed · As of 29 Apr 2026 · evidenced
    Evidence and sources

  • Section 70 inserts Online Safety Act 2023 section 214A, which lets the Secretary of State make regulations requiring providers of specified internet services to prevent or restrict access by relevant children to services or features, including daily time limits; the Explanatory Notes list AI chatbots among emerging services the consultation covers.

    Confidence: Confirmed · As of 29 Apr 2026 · evidenced
    Evidence and sources

  • The Government published its response to the "Growing up in the online world" consultation on 15 July 2026.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources

  • The response announces policy and says definitions and detail will be set out in regulations; it creates no legal duty itself.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources

  • Derived: Probable The Government said it will require AI chatbots to introduce mandatory breaks for all children under 18, working with an expert panel on how frequent and how long breaks should be.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources

  • Derived: Probable The Government said it will prevent under-18s from accessing AI chatbot services that primarily offer sexualised content, and other chatbot services will not be able to offer children features enabling sexually explicit or sexual role-playing content.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources
    • Growing up in the online world: government response (July 2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 1, summary of measuresPrevent under-18s from accessing AI chatbot services that primarily offer sexualised content. Other AI chatbot services will not be able to offer children features that enable sexually explicit or sexual role-playing content

  • Business and customer-service chatbots will be exempt from the chatbot measures, with detailed definitions of in-scope chatbots to be set out in regulations in due course.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources

  • Derived: Probable The Government said it will work with regulators to act on chatbots that share harmful mental health advice and will consider all options, including banning children from certain chatbots where other mechanisms are not enough.

    Confidence: Probable · As of 15 Jul 2026 · evidenced
    Evidence and sources
    • Growing up in the online world: government response (July 2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbots, "What will change"We will work with regulators to take action on chatbots that share harmful mental health advice and will consider all options, including banning children from certain chatbots where other regulatory and safety mechanisms are not enough.

  • The Automated Vehicles Act 2024 (c. 10) sets a self-driving test, under section 1, for authorising vehicles that travel autonomously in Great Britain.

    Confidence: Confirmed · evidenced
    Evidence and sources

  • The Automated Vehicles Act 2024 is an Act of Parliament commenced in stages by regulations; Part 4 commences on 7 January 2027.

    Confidence: Confirmed · evidenced
    Evidence and sources

  • Section 1 of the Act defines the self-driving test by reference to intended design, autonomous capability, and safe and lawful operation in the intended location and circumstances.

    Confidence: Confirmed · evidenced
    Evidence and sources

  • Derived: Probable Part 4 of the Act (marketing restrictions), so far as not already in force, comes into force on 7 January 2027 under SI 2026/731 made 1 July 2026.

    Confidence: Confirmed · As of 7 Jan 2027 · evidenced
    Evidence and sources

  • The Cyber Security and Resilience (Network and Information Systems) Bill is a Government Bill that has passed the House of Commons and is before the House of Lords; it is not yet an Act.

    Confidence: Probable · evidenced
    Evidence and sources

  • The Bill has no legal force while before Parliament.

    Confidence: Probable · evidenced
    Evidence and sources

  • The Government states the Bill will reform and add to the Network and Information Systems Regulations 2018, extending scope to managed service providers, data centres and supply chains.

    Confidence: Probable · evidenced
    Evidence and sources

  • A tracker reports the Bill was introduced to the Commons on 12 November 2025 and had its Lords second reading on 14 July 2026.

    Confidence: Uncertain · As of 12 Nov 2025 · evidenced
    Evidence and sources

  • The Solicitors Regulation Authority published a warning notice on misuse of AI, relevant to all firms and individuals it regulates, on 17 August 2026.

    Confidence: Confirmed · As of 17 Aug 2026 · evidenced
    Evidence and sources

  • The SRA says use of AI does not change the professional standards expected of solicitors and law firms, and reports 42 AI-misuse reports between July 2025 and July 2026 with ongoing investigations.

    Confidence: Confirmed · As of 17 Aug 2026 · evidenced
    Evidence and sources

  • The Courts and Tribunals Judiciary issued refreshed AI guidance for judicial office holders dated 31 October 2025.

    Confidence: Confirmed · As of 31 Oct 2025 · evidenced
    Evidence and sources

  • The guidance states that any use of AI by or on behalf of the judiciary must be consistent with the judiciary's overarching obligation to protect the integrity of the administration of justice.

    Confidence: Confirmed · As of 31 Oct 2025 · evidenced
    Evidence and sources

  • The document is judicial guidance for office holders and does not create statutory duties.

    Confidence: Probable · As of 31 Oct 2025 · evidenced
    Evidence and sources

  • DSIT published the AI Risk Management Toolkit on 8 September 2026 to help AI project teams understand, assess and manage risks when designing, procuring or delivering AI products.

    Confidence: Confirmed · As of 8 Sep 2026 · evidenced
    Evidence and sources
    • AI Risk Management Toolkit (DSIT) T1 · retrieved · retrieved 8 Oct 2026 · Page summaryGuidance to help anyone involved in AI projects understand, assess and manage risks when designing, procuring or delivering AI products.
    • AI Risk Management Toolkit: guidance (DSIT) T1 · retrieved · retrieved 8 Oct 2026 · Guidance introductionThe AI Risk Management Toolkit is intended as a starting point for teams looking to implement good risk management practices.

  • The Ministry of Justice's AI Action Plan for Justice one-year-on update, published 24 September 2026, adds a fourth strategic priority to strengthen the response to emerging AI risks.

    Confidence: Probable · As of 24 Sep 2026 · evidenced
    Evidence and sources

  • The FCA-commissioned Mills Review, published 6 July 2026, sets out seven recommendations for the FCA Board and Executive, including adapting the regulatory perimeter and monitoring the transition to autonomous models.

    Confidence: Probable · As of 6 Jul 2026 · evidenced
    Evidence and sources

  • The Bank of England told the Treasury Committee, in a letter dated 1 April 2026, that it does not agree it is taking a 'wait and see' approach to AI in financial services, and that it agrees stress testing and scenario analysis are valuable tools for understanding AI risks.

    Confidence: Probable · As of 1 Apr 2026 · evidenced
    Evidence and sources

#

Nothing recorded for this module in the research of 2026-10-08.

0 instruments · 0 obligations · 0 claims

Nothing recorded for this module in the research of 2026-10-08.

#

AI Cyber Security Code of Practice (Published 2025-01-31): Voluntary government code setting baseline cyber security principles for securing AI systems.

3 instruments · 0 obligations · 8 claims

3 instruments (3 current) · 0 obligations · 8 claims · 0 milestones

Instruments

  • AI Cyber Security Code of Practice Published 2025-01-31

    Voluntary government code setting baseline cyber security principles for securing AI systems. DSIT said it would submit the Code to ETSI as the basis for a global standard.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
  • BS EN ISO/IEC 42001:2026 Artificial intelligence management system Published 2026-03-31

    UK and European adoption of ISO/IEC 42001 AI management system standard, published by BSI on 31 March 2026 with no technical differences from BS ISO/IEC 42001:2023.

    Non-binding · Authority: BSI Group (British Standards Institution) · Verified · Official text
  • ETSI EN 304 223 V2.1.1: Baseline Cyber Security Requirements for AI Models and Systems Date not recorded

    European standard defining baseline security requirements for AI models and systems, including generative AI. It is voluntary unless adopted or referenced by a regulator.

    Non-binding · Authority: European Telecommunications Standards Institute · Verified · Official text
Claims and evidence (8)

  • ETSI published EN 304 223, defining baseline cyber security requirements for AI models and systems, based on DSIT's AI Cyber Security Code of Practice.

    Confidence: Probable · evidenced
    Evidence and sources

  • BSI published BS EN ISO/IEC 42001:2026 on 31 March 2026 as the UK/European adoption of ISO/IEC 42001:2023 for AI management systems, with no change to requirements.

    Confidence: Confirmed · As of 31 Mar 2026 · evidenced
    Evidence and sources

  • ETSI EN 304 223 defines baseline cyber security requirements for AI models and systems, developed from DSIT's AI Cyber Security Code of Practice in collaboration with NCSC.

    Confidence: Probable · evidenced
    Evidence and sources

  • BSI published BS EN ISO/IEC 42001:2026, the UK adoption of the AI management system standard, on 31 March 2026, with no technical changes from the 2023 edition.

    Confidence: Probable · As of 31 Mar 2026 · evidenced
    Evidence and sources

  • The AI Cyber Security Code of Practice sets baseline cyber security principles for AI systems and is a voluntary government code.

    Confidence: Probable · As of 31 Jan 2025 · evidenced
    Evidence and sources
    • AI Cyber Security Code of Practice T1 · retrieved · retrieved 8 Oct 2026 · Code of Practice, introductionThis Code of Practice sets out baseline cyber security principles to help secure AI systems and the organisations which develop and deploy them. Addressing the cyber risks to AI will protect our citizens and our digital economy while ensuring the man

  • DSIT said it would submit the UK AI Cyber Security Code to ETSI as the basis for a global standard; ETSI later published EN 304 223.

    Confidence: Uncertain · As of 1 Dec 2025 · evidenced
    Evidence and sources

  • DSIT published a Copper Horse mapping of 2,182 AI security requirements onto the 13 principles of ETSI EN 304 223 and states the UK Code mirrors that standard.

    Confidence: Probable · As of 10 Jul 2026 · evidenced
    Evidence and sources
    • Mapping global AI security standards, regulations and guidance (DSIT) T1 · retrieved · retrieved 8 Oct 2026 · Page bodyCopper Horse then undertook a mapping of the 2,182 requirements against the 13 principles set out in the European Telecommunications Standards Institute’s AI security global standard, EN 304 223. The government’s AI Cyber Security Code of Practice mirrors EN 304 223.

  • BSI published BS EN ISO/IEC 42001:2026 on 31 March 2026 as the UK and European adoption of ISO/IEC 42001 with no technical differences.

    Confidence: Probable · As of 31 Mar 2026 · evidenced
    Evidence and sources

#

Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience (Published 2026-05-15): Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

9 instruments · 4 obligations · 28 claims · Next: (Ofcom evidence request on protections for women and girls closes)

9 instruments (9 current) · 4 obligations · 28 claims · 9 milestones

Instruments

  • Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience Published 2026-05-15

    Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

    Regulatory expectation · Authority: Bank of England, Financial Conduct Authority · Verified · Official text
  • CMA publisher conduct requirement on Google general search (generative AI controls) Published 2026-06-03; entry into force not recorded

    Conduct requirement imposed by the CMA on Google requiring publisher controls over use of search content in generative AI, clear information, engagement metrics and attribution.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • Crime and Policing Act 2026 In force since 2026-04-29

    Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • Data (Use and Access) Act 2025 In force since 2025-08-20

    Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 In force since 2026-05-12

    Requires the Information Commissioner to prepare a statutory code of practice on AI development/use and automated decision-making, including children's data.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime) In force since 2025-04-06

    Act whose consumer protection provisions prohibit unfair commercial practices and let the CMA decide infringements directly and impose penalties of up to the greater of £300,000 or 10% of turnover. The consumer regime has applied since 6 April 2025, and CMA guidance of 9 March 2026 says it governs AI agents used with consumers.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • Joint Committee on Human Rights report on human rights and the regulation of AI (HC 160) Date not recorded

    Committee report calling for a dedicated AI Bill and a new single AI regulator, finding AISI engages with developers voluntarily and has no statutory power. Not binding; Government is expected to respond.

    Non-binding · Authority: Joint Committee on Human Rights · Verified · Official text
  • Online Safety Act 2023 Date not recorded

    Act imposing illegal-content risk assessment and safety duties on regulated user-to-user and search services, enforced by Ofcom with penalties of up to the greater of £18 million or 10% of qualifying worldwide revenue. Ofcom has said it applies to generative AI chatbots and platforms.

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • SRA warning notice: misuse of AI Published 2026-08-17

    Warning notice on misuse of AI in legal services, including false citations; states reliance on AI output is not a defence and existing professional standards still apply. The SRA reports 42 AI-misuse reports from July 2025 to July 2026 and ongoing investigations.

    Non-binding · Authority: Solicitors Regulation Authority · Verified · Official text

Obligations

  • Regulation 2(1)-(2)

    The Information Commissioner must prepare a code of practice on good practice in processing personal data when developing and using AI and in automated decision-making, including children's data.

    documentation · Applies to: other · Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
  • Publisher conduct requirement (final decision and notice)

    Google must provide publishers with effective controls over use of their search content in generative AI and related transparency, metrics and attribution measures.

    transparency disclosure · Applies to: provider · CMA publisher conduct requirement on Google general search (generative AI controls)
  • CMA guidance: Complying with consumer law when using AI agents

    A business is responsible for the acts of an AI agent it uses towards customers to the same extent as for a human employee or agent, including compliance with consumer protection law.

    other · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
  • DMCCA s.225(1) (Part 4 Chapter 1)

    Traders must not engage in unfair commercial practices; the prohibition applies whether the practice is carried out by a person or by a system acting for the trader (CMA guidance applies it to AI agents).

    prohibition · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)

Milestones

  • DMCCA consumer enforcement regime (unfair commercial practices; CMA direct enforcement) in force Met
    Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
  • Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
    Data (Use and Access) Act 2025
  • Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
    Data (Use and Access) Act 2025
  • Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent Met
    Crime and Policing Act 2026
  • Regulations in force; Information Commissioner to prepare AI and ADM code of practice Met
    Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
  • Joint statement on frontier AI models and cyber resilience published Met
    Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • Section 99 (purported intimate image generators) and ss.100-101 in force Met
    Crime and Policing Act 2026
  • Ofcom expectation that platforms have hash-matching for illegal intimate images and deepfakes in place Status not recorded
    Online Safety Act 2023
  • Ofcom evidence request on protections for women and girls closes Upcoming
    Online Safety Act 2023
Claims and evidence (28)

#

FCA approach to AI: no new AI-specific rules and AI Live Testing (Published 2026-06-08): FCA position that it will not introduce new regulations for AI and will rely on existing frameworks such as the Consumer Duty and SM&CR, supported by an AI Live Testing programme whose second cohort was announced on 21 April 2026.

3 instruments · 0 obligations · 9 claims

3 instruments (3 current) · 0 obligations · 9 claims · 0 milestones

Instruments

  • FCA approach to AI: no new AI-specific rules and AI Live Testing Published 2026-06-08

    FCA position that it will not introduce new regulations for AI and will rely on existing frameworks such as the Consumer Duty and SM&CR, supported by an AI Live Testing programme whose second cohort was announced on 21 April 2026.

    Non-binding · Authority: Financial Conduct Authority · Verified · Official text
  • Legal services advisory AI Growth Lab (DSIT) Date not recorded

    DSIT advisory programme giving AI innovators and adopters in legal services coordinated access to regulators; applications opened August 2026 and closed 27 September 2026; advisory only, disapplies no law.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
  • Regulating for Growth Bill (announced; regulatory sandbox powers) Draft, no legal force

    Announced Government bill (King's Speech, 13 May 2026) that would give the Government cross-sector sandbox powers to temporarily modify or disapply legislation blocking innovation, including through the AI Growth Lab. No introduction to Parliament confirmed as at 8 July 2026.

    Authority: Department for Business, Innovation, Science and Trade · Verified · Official text
Claims and evidence (9)

  • On 21 April 2026 the FCA announced the second cohort of firms admitted to its AI Live Testing sandbox programme.

    Confidence: Probable · As of 21 Apr 2026 · evidenced
    Evidence and sources
    • FCA announces second cohort for AI Live Testing T1 · retrieved · retrieved 8 Oct 2026 · FCA press release (opening paragraph)Speaking at UK FinTech Week, Jessica Rusu, chief data, information and intelligence officer at the FCA, has confirmed the second group of firms selected to join AI Live Testing.

  • The government announced on 8 July 2026 that it will seek cross-sector sandbox powers in a Regulating for Growth Bill to allow temporary modification or disapplication of legislation blocking innovation, including for AI.

    Confidence: Probable · As of 8 Jul 2026 · evidenced
    Evidence and sources
    • Regulatory sandboxes: what businesses can expect T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphThe government will seek transformational new cross-sector powers in the Regulating for Growth Bill to support businesses willing to innovate and test new ideas. These sandbox powers would allow government to temporarily modify or disapply legislation that is acting as a blocker to innovation and growth.

  • DSIT launched the AI Growth Lab call for evidence on 21 October 2025, seeking views on a cross-economy sandbox to oversee deployment of AI-enabled products and services that current regulation hinders.

    Confidence: Probable · As of 21 Oct 2025 · evidenced
    Evidence and sources
    • AI Growth Lab: call for evidence T1 · retrieved · retrieved 8 Oct 2026 · AI Growth Lab call for evidenceWe are seeking evidence on a pioneering cross-economy sandbox, that would oversee the deployment of AI-enabled products and services that current regulation hinders.

  • Derived: Probable The Regulating for Growth Bill, creating cross-sector regulatory sandbox powers, was announced with the 2026 King's Speech on 13 May 2026.

    Confidence: Probable · As of 13 May 2026 · evidenced
    Evidence and sources

  • Derived: Probable The Government says it will seek sandbox powers in the Regulating for Growth Bill that would let it temporarily modify or disapply legislation that blocks innovation.

    Confidence: Probable · As of 13 May 2026 · evidenced
    Evidence and sources

  • Derived: Probable On 8 July 2026 the Government said it will seek transformational cross-sector sandbox powers in the Regulating for Growth Bill, allowing it to temporarily modify or disapply legislation blocking innovation.

    Confidence: Probable · As of 8 Jul 2026 · evidenced
    Evidence and sources
    • Regulatory sandboxes: what businesses can expect T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphThe government will seek transformational new cross-sector powers in the Regulating for Growth Bill to support businesses willing to innovate and test new ideas. These sandbox powers would allow government to temporarily modify or disapply legislation that is acting as a blocker to innovation and growth.
    • UK to become world's fastest market to commercialise innovation with regulatory shake-up T1 · retrieved · retrieved 8 Oct 2026 · Quotation of the Business and Trade SecretaryThe Regulating for Growth Bill changes that, giving businesses a faster route from idea to market and ensuring every part of government — from investment and procurement to skills, infrastructure and
    • Regulatory sandboxes: what businesses can expect T1 · retrieved · retrieved 8 Oct 2026 · Page headerRegulatory sandboxes: what businesses can expect Published 8 July 2026 ## Contents 1. What is a 'r

  • GOV.UK lists the AI Growth Lab, bringing multiple regulators together to test cross-cutting AI-enabled products and services, among the sectors in which the Regulating for Growth Bill sandbox powers could be used.

    Confidence: Probable · As of 8 Jul 2026 · evidenced
    Evidence and sources
    • Regulatory sandboxes: what businesses can expect T1 · retrieved · retrieved 8 Oct 2026 · Sectors list: cross-economy AIcross-economy AI: the AI Growth Lab will bring multiple regulators together to test cross-cutting AI-enabled products and services to support safe AI adoption and innovation

  • The FCA stated on 8 June 2026 that it will not introduce new AI-specific regulation and will rely on existing frameworks including the Consumer Duty and SM&CR, and on 21 April 2026 announced a second AI Live Testing cohort.

    Confidence: Probable · As of 8 Jun 2026 · evidenced
    Evidence and sources

  • The legal services advisory AI Growth Lab gives innovators and adopters coordinated access to regulators; its applications window closed at 11:59pm on 27 September 2026.

    Confidence: Probable · evidenced
    Evidence and sources

#

UK Government and Google DeepMind Memorandum of Understanding on AI opportunities and security (Published 2025-12-11): Voluntary, non-binding memorandum between DSIT and Google DeepMind to collaborate on public services, scientific discovery and AI security.

1 instrument · 0 obligations · 0 claims

1 instrument (1 current) · 0 obligations · 0 claims · 0 milestones

Instruments

  • UK Government and Google DeepMind Memorandum of Understanding on AI opportunities and security Published 2025-12-11

    Voluntary, non-binding memorandum between DSIT and Google DeepMind to collaborate on public services, scientific discovery and AI security. Published on 11 December 2025.

    Non-binding · Authority: Department for Science, Innovation and Technology · Verified · Official text
No modules match.

Filters combine as OR inside a group and AND across groups.

Authorities

AuthorityType
Information Commission (successor to the Information Commissioner's Office)data protection authority
Office of Communications (Ofcom)regulator
Cabinet Officeministry
AI Security Instituteother
Financial Conduct Authorityregulator
Prudential Regulation Authority (Bank of England)regulator
Bank of Englandregulator
Competition and Markets Authoritycompetition authority
High Court of Justice, Business and Property Courts of England and Wales (Intellectual Property List, Chancery Division)court
Joint Committee on Human Rightslegislature
BSI Group (British Standards Institution)standards body
European Telecommunications Standards Institutestandards body
HM Treasuryministry
Advertising Standards Authority and Committee of Advertising Practiceother
Department for Science, Innovation and Technologyministry
Medicines and Healthcare products Regulatory Agencyregulator
UK Parliamentlegislature
Department for Business, Innovation, Science and Tradeministry
Ministry of Defenceministry
Civil Justice Councilother
Financial Policy Committee (Bank of England)regulator
Solicitors Regulation Authorityregulator
Courts and Tribunals Judiciarycourt
Ministry of Justiceministry
Department for Digital, Culture, Media and Sportministry

Enforcement actions

DateRespondentActionAuthorityInstrumentAmount
X Corp / X Internet Unlimited CompanyprobeOffice of Communications (Ofcom)Online Safety Act 2023
X Internet Unlimited Company and X.AI LLCprobeInformation Commission (successor to the Information Commissioner's Office)Online Safety Act 2023
Online platforms in scope of the Online Safety ActprobeOffice of Communications (Ofcom)Online Safety Act 2023
Googlebinding guidanceCompetition and Markets AuthorityCMA publisher conduct requirement on Google general search (generative AI controls)
Regulated firms and individuals (unnamed)probeSolicitors Regulation AuthoritySRA warning notice: misuse of AI

Cases

CaseCourtStageIssue
Ayinde v London Borough of Haringey; Al-Haroun v Qatar National Bank [2025] EWHC 1383 (Admin)High Court of Justice, King's Bench Division, Divisional Court (Administrative Court)judgmentDivisional Court sitting under the Hamid jurisdiction on lawyers who put false citations, apparently generated by AI tools, before the court.
Getty Images (US) Inc and others v Stability AI LtdHigh Court of Justice, Business and Property Courts of England and Wales (Intellectual Property List, Chancery Division)judgmentSecondary copyright infringement and related claims concerning the training and operation of Stability AI's Stable Diffusion model on Getty's copyright works.

Consultations

ConsultationAuthorityStatusOpenedCloses
Copyright and Artificial Intelligence consultationDepartment for Science, Innovation and Technologyresponse published
Civil Justice Council consultation on use of AI in preparing court documentsCivil Justice Councilclosed
Data regulation in the age of AI and other data-intensive technologies (call for evidence)Department for Science, Innovation and Technologyclosed
Ofcom call for evidence on protecting women and girls onlineOffice of Communications (Ofcom)open
AI Growth Lab call for evidenceDepartment for Science, Innovation and Technologyclosed
Technical provenance

Provenance

Record schema artificial-intelligence-record-v2.8, research run aic-baseline-UK-2026-10-08. Regulator line from the research seed. Built by render_jid_aic_v13 from page model module-card-page-v1.

What this record does not yet establish is set out on the transparency register; its dated events are on the regulatory calendar.

Think something on this page is wrong? Report an error.