Global AI Monitor
Preview

United Kingdom (UK) · Module Detail

United Kingdom: Authorities & Enforcement

#

Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience (Published 2026-05-15): Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

9 instruments · 4 obligations · 28 claims · Next: (Ofcom evidence request on protections for women and girls closes)

9 instruments (9 current) · 4 obligations · 28 claims · 9 milestones

Instruments

  • Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience Published 2026-05-15

    Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

    Regulatory expectation · Authority: Bank of England, Financial Conduct Authority · Verified · Official text
  • CMA publisher conduct requirement on Google general search (generative AI controls) Published 2026-06-03; entry into force not recorded

    Conduct requirement imposed by the CMA on Google requiring publisher controls over use of search content in generative AI, clear information, engagement metrics and attribution.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • Crime and Policing Act 2026 In force since 2026-04-29

    Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • Data (Use and Access) Act 2025 In force since 2025-08-20

    Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 In force since 2026-05-12

    Requires the Information Commissioner to prepare a statutory code of practice on AI development/use and automated decision-making, including children's data.

    Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified · Official text
  • Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime) In force since 2025-04-06

    Act whose consumer protection provisions prohibit unfair commercial practices and let the CMA decide infringements directly and impose penalties of up to the greater of £300,000 or 10% of turnover. The consumer regime has applied since 6 April 2025, and CMA guidance of 9 March 2026 says it governs AI agents used with consumers.

    Binding · Authority: Competition and Markets Authority · Verified · Official text
  • Joint Committee on Human Rights report on human rights and the regulation of AI (HC 160) Date not recorded

    Committee report calling for a dedicated AI Bill and a new single AI regulator, finding AISI engages with developers voluntarily and has no statutory power. Not binding; Government is expected to respond.

    Non-binding · Authority: Joint Committee on Human Rights · Verified · Official text
  • Online Safety Act 2023 Date not recorded

    Act imposing illegal-content risk assessment and safety duties on regulated user-to-user and search services, enforced by Ofcom with penalties of up to the greater of £18 million or 10% of qualifying worldwide revenue. Ofcom has said it applies to generative AI chatbots and platforms.

    Binding · Authority: Office of Communications (Ofcom) · Verified · Official text
  • SRA warning notice: misuse of AI Published 2026-08-17

    Warning notice on misuse of AI in legal services, including false citations; states reliance on AI output is not a defence and existing professional standards still apply. The SRA reports 42 AI-misuse reports from July 2025 to July 2026 and ongoing investigations.

    Non-binding · Authority: Solicitors Regulation Authority · Verified · Official text

Obligations

  • Regulation 2(1)-(2)

    The Information Commissioner must prepare a code of practice on good practice in processing personal data when developing and using AI and in automated decision-making, including children's data.

    documentation · Applies to: other · Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
  • Publisher conduct requirement (final decision and notice)

    Google must provide publishers with effective controls over use of their search content in generative AI and related transparency, metrics and attribution measures.

    transparency disclosure · Applies to: provider · CMA publisher conduct requirement on Google general search (generative AI controls)
  • CMA guidance: Complying with consumer law when using AI agents

    A business is responsible for the acts of an AI agent it uses towards customers to the same extent as for a human employee or agent, including compliance with consumer protection law.

    other · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
  • DMCCA s.225(1) (Part 4 Chapter 1)

    Traders must not engage in unfair commercial practices; the prohibition applies whether the practice is carried out by a person or by a system acting for the trader (CMA guidance applies it to AI agents).

    prohibition · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)

Milestones

  • DMCCA consumer enforcement regime (unfair commercial practices; CMA direct enforcement) in force Met
    Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
  • Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force Met
    Data (Use and Access) Act 2025
  • Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 Met
    Data (Use and Access) Act 2025
  • Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent Met
    Crime and Policing Act 2026
  • Regulations in force; Information Commissioner to prepare AI and ADM code of practice Met
    Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
  • Joint statement on frontier AI models and cyber resilience published Met
    Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
  • Section 99 (purported intimate image generators) and ss.100-101 in force Met
    Crime and Policing Act 2026
  • Ofcom expectation that platforms have hash-matching for illegal intimate images and deepfakes in place Status not recorded
    Online Safety Act 2023
  • Ofcom evidence request on protections for women and girls closes Upcoming
    Online Safety Act 2023
Claims and evidence (28)