---
title: "United Kingdom — Authorities & Enforcement | Global AI Monitor"
canonical: https://artificial-intelligence.gi/jurisdictions/united-kingdom/authorities-and-enforcement/
source_html: /jurisdictions/united-kingdom/authorities-and-enforcement/index.html
description: "United Kingdom — Authorities & Enforcement: 10 Authorities & Enforcement Active Under review ▾ # Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience (Published 2026-05-15): Joint s"
generated_at: 2026-10-25T22:24:54Z
content_sha256: 197ed15af5eaddf3707ea91b1d3b1f8e450645ffdc0341f5fe60703431ad100f
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Authorities & Enforcement | Global AI Monitor

### 10Authorities & EnforcementActive Derived: Probable▾#

Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience (Published 2026-05-15): Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.

9 instruments · 4 obligations · 28 claims · Next: 6 Nov 2026 (Ofcom evidence request on protections for women and girls closes)

9 instruments (9 current) · 4 obligations · 28 claims · 9 milestones

Instruments

- Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience Published 2026-05-15Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.Regulatory expectation · Authority: Bank of England, Financial Conduct Authority · Verified 8 Oct 2026 · [Official text](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience)
- CMA publisher conduct requirement on Google general search (generative AI controls) Published 2026-06-03; entry into force not recordedConduct requirement imposed by the CMA on Google requiring publisher controls over use of search content in generative AI, clear information, engagement metrics and attribution.Binding · Authority: Competition and Markets Authority · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/find-digital-markets-measures/google-search-publisher-conduct-requirement)
- Crime and Policing Act 2026 In force since 2026-04-29Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).Binding · Authority: Office of Communications (Ofcom) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2026/20)
- Data (Use and Access) Act 2025 In force since 2025-08-20Act amending UK data protection law; for AI governance it creates the s.138 purported-intimate-image offences, the ss.135-137 copyright-and-AI reporting duties, and establishes the Information Commission.Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2025/18)
- Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 In force since 2026-05-12Requires the Information Commissioner to prepare a statutory code of practice on AI development/use and automated decision-making, including children's data.Binding · Authority: Information Commission (successor to the Information Commissioner's Office) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/uksi/2026/425/made)
- Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime) In force since 2025-04-06Act whose consumer protection provisions prohibit unfair commercial practices and let the CMA decide infringements directly and impose penalties of up to the greater of £300,000 or 10% of turnover. The consumer regime has applied since 6 April 2025, and CMA guidance of 9 March 2026 says it governs AI agents used with consumers.Binding · Authority: Competition and Markets Authority · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2024/13)
- Joint Committee on Human Rights report on human rights and the regulation of AI (HC 160) Date not recordedCommittee report calling for a dedicated AI Bill and a new single AI regulator, finding AISI engages with developers voluntarily and has no statutory power. Not binding; Government is expected to respond.Non-binding · Authority: Joint Committee on Human Rights · Verified 8 Oct 2026 · [Official text](https://publications.parliament.uk/pa/jt5902/jtselect/jtrights/160/report.html)
- Online Safety Act 2023 Date not recordedAct imposing illegal-content risk assessment and safety duties on regulated user-to-user and search services, enforced by Ofcom with penalties of up to the greater of £18 million or 10% of qualifying worldwide revenue. Ofcom has said it applies to generative AI chatbots and platforms.Binding · Authority: Office of Communications (Ofcom) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2023/50)
- SRA warning notice: misuse of AI Published 2026-08-17Warning notice on misuse of AI in legal services, including false citations; states reliance on AI output is not a defence and existing professional standards still apply. The SRA reports 42 AI-misuse reports from July 2025 to July 2026 and ongoing investigations.Non-binding · Authority: Solicitors Regulation Authority · Verified 8 Oct 2026 · [Official text](https://www.sra.org.uk/solicitors/guidance/misuse-ai/)

Obligations

- Regulation 2(1)-(2)The Information Commissioner must prepare a code of practice on good practice in processing personal data when developing and using AI and in automated decision-making, including children's data.documentation · Applies to: other · Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
- Publisher conduct requirement (final decision and notice)Google must provide publishers with effective controls over use of their search content in generative AI and related transparency, metrics and attribution measures.transparency disclosure · Applies to: provider · CMA publisher conduct requirement on Google general search (generative AI controls)
- CMA guidance: Complying with consumer law when using AI agentsA business is responsible for the acts of an AI agent it uses towards customers to the same extent as for a human employee or agent, including compliance with consumer protection law.other · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
- DMCCA s.225(1) (Part 4 Chapter 1)Traders must not engage in unfair commercial practices; the prohibition applies whether the practice is carried out by a person or by a system acting for the trader (CMA guidance applies it to AI agents).prohibition · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)

Milestones

- 6 Apr 2025DMCCA consumer enforcement regime (unfair commercial practices; CMA direct enforcement) in force MetDigital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
- 6 Feb 2026Sexual Offences Act 2003 ss.66E-66F (purported intimate image offences) in force MetData (Use and Access) Act 2025
- 18 Mar 2026Section 136 report on copyright works and AI due within nine months of 19 June 2025; report published 18 March 2026 MetData (Use and Access) Act 2025
- 29 Apr 2026Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent MetCrime and Policing Act 2026
- 12 May 2026Regulations in force; Information Commissioner to prepare AI and ADM code of practice MetData Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026
- 15 May 2026Joint statement on frontier AI models and cyber resilience published MetBank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
- 29 Jun 2026Section 99 (purported intimate image generators) and ss.100-101 in force MetCrime and Policing Act 2026
- 30 Sep 2026Ofcom expectation that platforms have hash-matching for illegal intimate images and deepfakes in place Status not recordedOnline Safety Act 2023
- 6 Nov 2026Ofcom evidence request on protections for women and girls closes UpcomingOnline Safety Act 2023

Claims and evidence (28)
- The Information Commission, established under the Data (Use and Access) Act 2025, took over the ICO's functions on 30 September 2026.Confidence: Probable · As of 30 Sep 2026 · evidencedEvidence and sources[Information Commission succeeds the ICO as UK's data protection regulator](https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK news story (standfirst)From today, the new Information Commission takes over the ICO's functions, modernising the regulator's governance while maintaining its independent oversight and existing powers to protect people's personal data.
- [Information Commission succeeds the ICO as UK's data protection regulator](https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK news storyThe Commission will be led by the interim Chief Executive, Paul Arnold, alongside seven newly appointed non-executive members.

- SI 2026/425, requiring the Information Commissioner to prepare a code of practice on AI and automated decision-making, came into force on 12 May 2026.Confidence: Probable · As of 12 May 2026 · evidencedEvidence and sources[The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), as made](https://www.legislation.gov.uk/uksi/2026/425/made) T1 · retrieved · retrieved 8 Oct 2026 · Header (Made / Laid / Coming into force)Made 16th April 2026 Laid before Parliament 21st April 2026 Coming into force 12th May 2026 The Secretary of State
- [The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), as made](https://www.legislation.gov.uk/uksi/2026/425/made) T1 · retrieved · retrieved 8 Oct 2026 · reg 1(2)These Regulations come into force 21 days after the day on which they are laid.

- Regulation 2(2) of SI 2026/425 requires the AI and automated decision-making code of practice to include guidance on children's personal data.Confidence: Probable · As of 12 May 2026 · evidencedEvidence and sources[The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), as made](https://www.legislation.gov.uk/uksi/2026/425/made) T1 · retrieved · retrieved 8 Oct 2026 · reg 2(1)The Commissioner must prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data under the relevant data protection legislation in relation to—
- [The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425), as made](https://www.legislation.gov.uk/uksi/2026/425/made) T1 · retrieved · retrieved 8 Oct 2026 · reg 2(2)The code of practice must include guidance as to good practice in the processing of children’s personal data.

- Kanishka Narayan was appointed Minister of State (Minister for Artificial Intelligence), jointly in the Cabinet Office and the Department for Business, Innovation, Science and Trade, on 20 July 2026.Confidence: Probable · As of 20 Jul 2026 · evidencedEvidence and sources[The Rt Hon Kanishka Narayan MP (Minister of State, Minister for Artificial Intelligence)](https://www.gov.uk/government/people/kanishka-narayan) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK ministerial biographyKanishka Narayan was appointed Minister of State (Minister for Artificial Intelligence) jointly in the Cabinet Office and the Department for Business, Innovation, Science and Trade on 20 July 2026.

- Henry de Zoete is the Director of the AI Security Institute, succeeding interim director Adam Beaumont, who returned to GCHQ.Confidence: Confirmed · As of 21 Aug 2026 · evidencedEvidence and sources[AI Security Institute adds new executives to top team](https://www.uktech.news/ai/ai-security-institute-adds-new-executives-to-top-team-20260821) T2 · retrieved · retrieved 8 Oct 2026 · UKTN articleHenry de Zoete, a long-term AI, technology and investment advisor to the government, has been named as the director of the AI Security Institute. As an experienced AI government advisor, de Zoete played a key role in the initial establishment of the
- [AI Security Institute adds new executives to top team](https://www.uktech.news/ai/ai-security-institute-adds-new-executives-to-top-team-20260821) T2 · retrieved · retrieved 8 Oct 2026 · UKTN articleThe onboarding of de Zoete follows the departure of interim director Adam Beaumont, who is returning to a previous position at GCHQ.
- [Henry De Zoete (GOV.UK profile)](https://www.gov.uk/government/people/henry-de-zoete) T1 · retrieved · retrieved 8 Oct 2026 · Biography, first sentenceHenry de Zoete is the Director of the UK's AI Security Institute. He has worked
- [About - The AI Security Institute (AISI)](https://www.aisi.gov.uk/about) T1 · retrieved · retrieved 8 Oct 2026 · AISI About page, leadership listOur Director Henry de Zoete OBE was formerly the Prime Minister's AI Advisor and a UK Government Investment and AI Adviser, and brin

- Machinery-of-government changes announced on 22 July 2026 moved responsibility for AI strategy, public sector AI adoption and the AI Security Institute from DSIT to the Cabinet Office.Confidence: Confirmed · As of 22 Jul 2026 · evidencedEvidence and sources[Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Office for the Prime Minister and Cabinet"To deliver this step change, responsibility for AI strategy, public sector AI adoption and the AI Security Institute will move to the Cabinet Office.
- [Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Redistribution of the responsibilities of DSIT"The functions of the Department for Science, Innovation and Technology (DSIT) will be redistributed to align with the Government's core economic and social agenda embedded as vital engines of growth exactly where they can have the most direct impact.
- [Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Department for Digital, Culture, Media, and Sport"it will provide coherent and strategic oversight, across telecoms, media and online safety to maintain the UK's world-leading strengths in those sectors.

- The ICO opened formal investigations on 3 February 2026 into X Internet Unlimited Company and X.AI LLC over the Grok AI system's potential to produce harmful sexualised image and video content.Confidence: Probable · As of 3 Feb 2026 · evidencedEvidence and sources[ICO announces investigation into Grok](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/) T1 · retrieved · retrieved 8 Oct 2026 · ICO statement (opening paragraph)The Information Commissioner's Office (ICO) has opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI) covering their processing of personal data in relation to the Grok artificial intelligence system and its potential to produce harmful sexualised image and video

- Derived: Probable Ofcom opened a formal investigation into X on 12 January 2026 under the Online Safety Act over illegal content generated by the Grok chatbot, and the investigation remained open as at its 15 January 2026 update.Confidence: Probable · As of 12 Jan 2026 · evidencedEvidence and sources[Ofcom launches investigation into X over Grok sexualised imagery (Ofcom notice, Internet Archive copy)](https://web.archive.org/web/2026/https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-launches-investigation-into-x-over-grok-sexualised-imagery) T1 · retrieved · retrieved 8 Oct 2026 · Original release, 12 January 2026The UK's independent online safety watchdog, Ofcom, has today opened a formal investigation into X under the UK's Online Safety Act, to determine whether it has complied with its duties to protect people in the UK from content that is illegal in the UK.

- Derived: Probable The maximum penalty Ofcom can impose under the Online Safety Act is the greater of £18 million or 10% of qualifying worldwide revenue.Confidence: Confirmed · evidencedEvidence and sources[Online Safety Act 2023, Schedule 13 (OFCOM's powers to impose penalties: maximum penalty)](https://www.legislation.gov.uk/ukpga/2023/50/schedule/13) T1 · retrieved · retrieved 8 Oct 2026 · OSA Sch 13 para 4(1)the maximum amount of the penalty for which the person is liable is whichever is the greater of—
- [Online Safety Act 2023, Schedule 13 (OFCOM's powers to impose penalties: maximum penalty)](https://www.legislation.gov.uk/ukpga/2023/50/schedule/13) T1 · retrieved · retrieved 8 Oct 2026 · OSA Sch 13 para 4(1)(b)(b)10% of the person's qualifying worldwide revenue for the person's most recent complete accounting period (subject to sub-paragraph (5)).
- [Ofcom to crack down on spread of illegal intimate images and deepfakes, boosting protections for women and girls online](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-to-crack-down-on-spread-of-illegal-intimate-images-and-deepfakes-boosting-protections-for-women-and-girls-online) T1 · retrieved · retrieved 8 Oct 2026 · Ofcom NCII enforcement announcementfines of up to 10% of their global annual revenue.
- [Ofcom launches investigation into X over Grok sexualised imagery (Ofcom notice, Internet Archive copy)](https://web.archive.org/web/2026/https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-launches-investigation-into-x-over-grok-sexualised-imagery) T1 · retrieved · retrieved 8 Oct 2026 · Section "Enforcement powers"We can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

- Ofcom enforces the Online Safety Act and has opened an enforcement programme on hash-matching for illegal intimate images and deepfakes.Confidence: Probable · evidencedEvidence and sources[Ofcom to crack down on spread of illegal intimate images and deepfakes, boosting protections for women and girls online](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-to-crack-down-on-spread-of-illegal-intimate-images-and-deepfakes-boosting-protections-for-women-and-girls-online) T1 · retrieved · retrieved 8 Oct 2026 · Ofcom NCII enforcement announcementToday the regulator is opening an enforcement programme to monitor their efforts to crack down on the spread of such images. By 30 September, online platforms should have automated technology in place
- [Ofcom to crack down on spread of illegal intimate images and deepfakes, boosting protections for women and girls online](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-to-crack-down-on-spread-of-illegal-intimate-images-and-deepfakes-boosting-protections-for-women-and-girls-online) T1 · retrieved · retrieved 8 Oct 2026 · Ofcom NCII enforcement announcementBy 30 September, online platforms should have automated technology in place known as 'hash matching' to detect and prevent the sharing of illegal intimate images, including explicit AI-generated deepfakes.

- The CMA imposed a publisher conduct requirement on Google's general search service, with documents dated 3 June 2026.Confidence: Confirmed · As of 3 Jun 2026 · evidencedEvidence and sources[Google search publisher conduct requirement (CMA)](https://www.gov.uk/find-digital-markets-measures/google-search-publisher-conduct-requirement) T1 · retrieved · retrieved 8 Oct 2026 · CMA page summaryThe Competition and Markets Authority (CMA) has imposed a conduct requirement on Google, in relation to its general search services.
- [Google search publisher conduct requirement (CMA)](https://www.gov.uk/find-digital-markets-measures/google-search-publisher-conduct-requirement) T1 · retrieved · retrieved 8 Oct 2026 · CMA page document listPublisher CR final decision (PDF, 966KB) (3.6.26)
- [CMA secures fairer deal for publishers and improves Google search services in UK](https://www.gov.uk/government/news/cma-secures-fairer-deal-for-publishers-and-improves-google-search-services-in-uk) T1 · retrieved · retrieved 8 Oct 2026 · CMA press release sub-headingConduct requirement introduced today gives publishers more control and stronger bargaining power over the use of their content.

- The CMA imposed and enforces the publisher conduct requirement on Google.Confidence: Probable · As of 3 Jun 2026 · evidencedEvidence and sources[Google search publisher conduct requirement (CMA)](https://www.gov.uk/find-digital-markets-measures/google-search-publisher-conduct-requirement) T1 · retrieved · retrieved 8 Oct 2026 · CMA page summaryThe Competition and Markets Authority (CMA) has imposed a conduct requirement on Google, in relation to its general search services.

- The AI Safety Institute was renamed the AI Security Institute by written ministerial statement of 24 February 2025.Confidence: Confirmed · As of 24 Feb 2025 · evidencedEvidence and sources[Written Ministerial Statement: AI Security Institute (renaming of the AI Safety Institute)](https://questions-statements.parliament.uk/written-statements/detail/2025-02-24/hlws454) T1 · retrieved · retrieved 8 Oct 2026 · Written Ministerial Statement HLWS454That is why I am renaming our AI Safety Institute as the AI Security Institute.
- [AI Safety Institute (now AI Security Institute) - GOV.UK organisation page](https://www.gov.uk/government/organisations/ai-safety-institute) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK organisation pageAI Safety Institute is now called AI Security Institute

- From 22 July 2026, responsibility for AI strategy, public sector AI adoption and the AI Security Institute moved from DSIT to the Cabinet Office.Confidence: Confirmed · As of 22 Jul 2026 · evidencedEvidence and sources[Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Office for the Prime Minister and Cabinet"To deliver this step change, responsibility for AI strategy, public sector AI adoption and the AI Security Institute will move to the Cabinet Office.
- [AI Security Institute (GOV.UK organisation page)](https://www.gov.uk/government/organisations/ai-security-institute) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK organisation pageWe conduct research and develop and test mitigations. AISI is part of the Cabinet Office. ## Documents ### Guidance a
- [Minister of State (Minister for Artificial Intelligence) (GOV.UK)](https://www.gov.uk/government/ministers/minister-of-state-minister-for-artificial-intelligence) T1 · retrieved · retrieved 8 Oct 2026 · ResponsibilitiesCabinet Office portfolio: - AI Strategy - AI Taskforce - AI Security Institute - AI Economics Insti

- Ofcom opened a formal investigation into X on 12 January 2026 under the Online Safety Act 2023 concerning Grok-generated sexualised imagery; the investigation was still open as at 15 January 2026.Confidence: Confirmed · As of 12 Jan 2026 · evidencedEvidence and sources[Ofcom launches investigation into X over Grok sexualised imagery (Ofcom notice, Internet Archive copy)](https://web.archive.org/web/2026/https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-launches-investigation-into-x-over-grok-sexualised-imagery) T1 · retrieved · retrieved 8 Oct 2026 · Original release, 12 January 2026The UK's independent online safety watchdog, Ofcom, has today opened a formal investigation into X under the UK's Online Safety Act, to determine whether it has complied with its duties to protect people in the UK from content that is illegal in the UK.
- [Our approach to online safety supervision and compliance](https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/our-approach-to-online-safety-supervision-and-compliance) T1 · retrieved · retrieved 8 Oct 2026 · Ofcom supervision approach pagewhen the Grok AI chatbot account on X was being used to create and share undressed images of people earlier this year. We quickly determine the appropriate course of action to take, considering factors such as the severity and scale of the harm, whet

- On 3 February 2026 the ICO opened formal investigations into X Internet Unlimited Company and X.AI LLC covering their processing of personal data in relation to the Grok AI system.Confidence: Confirmed · As of 3 Feb 2026 · evidencedEvidence and sources[ICO announces investigation into Grok](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/) T1 · retrieved · retrieved 8 Oct 2026 · ICO statement (opening paragraph)The Information Commissioner's Office (ICO) has opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI) covering their processing of personal data in relation to the Grok artificial intelligence system and its potential to produce harmful sexualised image and video

- From 22 July 2026, responsibility for AI strategy, public-sector AI adoption and the renamed AI Security Institute moved from DSIT to the Cabinet Office, alongside the appointment of a joint Minister for Artificial Intelligence and a new Institute Director.Confidence: Confirmed · As of 22 Jul 2026 · evidencedEvidence and sources[Written Ministerial Statement: AI Security Institute (renaming of the AI Safety Institute)](https://questions-statements.parliament.uk/written-statements/detail/2025-02-24/hlws454) T1 · retrieved · retrieved 8 Oct 2026 · Written Ministerial Statement HLWS454That is why I am renaming our AI Safety Institute as the AI Security Institute.
- [AI Safety Institute (now AI Security Institute) - GOV.UK organisation page](https://www.gov.uk/government/organisations/ai-safety-institute) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK organisation pageAI Safety Institute is now called AI Security Institute
- [Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Office for the Prime Minister and Cabinet"To deliver this step change, responsibility for AI strategy, public sector AI adoption and the AI Security Institute will move to the Cabinet Office.
- [Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Redistribution of the responsibilities of DSIT"The functions of the Department for Science, Innovation and Technology (DSIT) will be redistributed to align with the Government's core economic and social agenda embedded as vital engines of growth exactly where they can have the most direct impact.
- [Machinery of Government changes: Fact Sheet (Cabinet Office)](https://www.gov.uk/government/news/machinery-of-government-changes-fact-sheet) T1 · retrieved · retrieved 8 Oct 2026 · Section "Department for Digital, Culture, Media, and Sport"it will provide coherent and strategic oversight, across telecoms, media and online safety to maintain the UK's world-leading strengths in those sectors.
- [AI Security Institute (GOV.UK organisation page)](https://www.gov.uk/government/organisations/ai-security-institute) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK organisation pageWe conduct research and develop and test mitigations. AISI is part of the Cabinet Office. ## Documents ### Guidance a
- [Minister of State (Minister for Artificial Intelligence) (GOV.UK)](https://www.gov.uk/government/ministers/minister-of-state-minister-for-artificial-intelligence) T1 · retrieved · retrieved 8 Oct 2026 · ResponsibilitiesCabinet Office portfolio: - AI Strategy - AI Taskforce - AI Security Institute - AI Economics Insti

- The Digital Markets, Competition and Consumers Act 2024 (c. 13) contains the UK consumer-enforcement regime in Part 3 Chapters 3-4 and Part 4 Chapter 1.Confidence: Probable · As of 24 May 2024 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 3 (public enforcement of consumer protection law: court proceedings)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/3) T1 · retrieved · retrieved 8 Oct 2026 · Part 3 Chapter 3, status bannerThere are currently no known outstanding effects for the Digital Markets, Competition and Consumers Act 2024, Chapter 3.
- [Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices)](https://www.legislation.gov.uk/ukpga/2024/13/part/4/chapter/1) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.225(1)-(2)(1)Unfair commercial practices are prohibited. (2)The promotion of unfair commercial practices in, or in connection with, a code of conduct by— (a)a person responsible for the content of a code of c

- Derived: Probable The DMCCA consumer-enforcement provisions, including the prohibition of unfair commercial practices (s.225) and the CMA infringement-notice powers (ss.181-182), came into force on 6 April 2025.Confidence: Confirmed · As of 6 Apr 2025 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices)](https://www.legislation.gov.uk/ukpga/2024/13/part/4/chapter/1) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.225 commencement noteS. 225 in force at 6.4.2025 by S.I. 2025/272, reg. 2(1)(3)
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182 commencement noteS. 182 in force at 6.4.2025 by S.I. 2025/272, reg. 2(1)(2)
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.181 commencement noteS. 181 in force at 6.4.2025 by S.I. 2025/272, reg. 2(1)(2)
- [CMA to boost consumer and business confidence as new consumer protection regime comes into force](https://www.gov.uk/government/news/cma-to-boost-consumer-and-business-confidence-as-new-consumer-protection-regime-comes-into-force) T1 · retrieved · retrieved 8 Oct 2026 · CMA press release 7 April 2025, opening paragraphLandmark new consumer protection provisions are now in force under the Digital Markets, Competition and Consumers Act 2024 (DMCCA), giving the Competition and Markets Authority (CMA) the ability to deliver more effective consumer protection.

- Derived: Probable A CMA final infringement notice may require a monetary penalty of a fixed amount not exceeding £300,000 or, if higher, 10% of the respondent's turnover.Confidence: Confirmed · As of 6 Apr 2025 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182(6) (CMA final infringement notice)The amount of a monetary penalty imposed under subsection (4)(b) must be a fixed amount not exceeding £300,000 or, if higher, 10% of the total value of the turnover (if any) of the respondent.
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182(4)(4)A final infringement notice may impose on the respondent a requirement to do either or both of the following- (a)a requirement to comply with such directions as the CMA considers appropriate for or in connection with the purpose of securing that the respondent complies with section 181(5) (which may include directions to take enhanced consumer measures in accordance with section 183); (b)subj
- [CMA to boost consumer and business confidence as new consumer protection regime comes into force](https://www.gov.uk/government/news/cma-to-boost-consumer-and-business-confidence-as-new-consumer-protection-regime-comes-into-force) T1 · retrieved · retrieved 8 Oct 2026 · CMA press release 7 April 2025, Notes to editors 1Under the new consumer regime, if a company infringes consumer protection law, the CMA can fine them up to 10% of their global turnover. If a company breaches undertakings it has given the CMA, it cou

- Derived: Probable A court enforcement order made on an application by a public designated enforcer may include a monetary penalty of a fixed amount not exceeding £300,000 or, if higher, 10% of the respondent's turnover.Confidence: Probable · As of 6 Apr 2025 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 3 (public enforcement of consumer protection law: court proceedings)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/3) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.158(5) (court-ordered monetary penalty)The amount of a monetary penalty must be a fixed amount not exceeding £300,000 or, if higher, 10% of the total value of the turnover (if any) of the respondent.
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 3 (public enforcement of consumer protection law: court proceedings)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/3) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.158 commencement noteS. 158 in force at 6.4.2025 by S.I. 2025/272,

- The CMA is a public designated enforcer under the consumer provisions and can itself give provisional and final infringement notices (ss.181-182); other designated enforcers include the FCA, Ofcom and the Information Commissioner.Confidence: Probable · As of 6 Apr 2025 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 3 (public enforcement of consumer protection law: court proceedings)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/3) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.151(1)(1)Each of the following is a public designated enforcer for the purposes of this Chapter—
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182(4)(4)A final infringement notice may impose on the respondent a requirement to do either or both of the following- (a)a requirement to comply with such directions as the CMA considers appropriate for or in connection with the purpose of securing that the respondent complies with section 181(5) (which may include directions to take enhanced consumer measures in accordance with section 183); (b)subj

- Derived: Probable The CMA warns that a business that breaks consumer protection law, including through an AI agent, could face enforcement action, be fined up to 10% of its worldwide turnover and be forced to compensate affected consumers.Confidence: Confirmed · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Same section, second paragraphIf you break consumer protection law, you could face action by enforcement authorities (including the CMA). You could be fined up to 10% of your worldwide turnover, and possibly forced to compensate affected consumers.
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182(6) (CMA final infringement notice)The amount of a monetary penalty imposed under subsection (4)(b) must be a fixed amount not exceeding £300,000 or, if higher, 10% of the total value of the turnover (if any) of the respondent.

- The Bank of England, the FCA and HM Treasury published their joint statement on frontier AI models and cyber resilience on 15 May 2026.Confidence: Confirmed · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatement from the Bank of England, Financial Conduct Authority and HM Treasury Published on 15 May 2026 ## Statement ### Why frontier AI
- [FCA, Bank of England and Treasury joint statement on frontier AI models and cyber resilience](https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatements First published: 15/05/2026 Last updated: 15/05/2026

- The Committee found that the AI Security Institute has no regulatory authority and cannot demand access to foundation models before or after deployment, or prevent their release; model developers engage voluntarily.Confidence: Confirmed · evidencedEvidence and sources[Joint Committee on Human Rights, Human Rights and the Regulation of AI (HC/HL 160)](https://publications.parliament.uk/pa/jt5902/jtselect/jtrights/160/report.html) T1 · retrieved · retrieved 8 Oct 2026 · Conclusions on AI Security InstituteAISI has no regulatory authority and cannot, for example, demand access to foundation models either before or after their deployment or prevent them from being released.
- [Wide-ranging AI Bill needed to address severe human rights risks posed by AI (JCHR press release)](https://committees.parliament.uk/committee/93/human-rights-joint-committee/news/217859/wideranging-ai-bill-needed-to-address-severe-human-rights-risks-posed-by-ai) T1 · retrieved · retrieved 8 Oct 2026 · Press releaseModel developers engage with the AI Security Institute on a voluntary basis and it has no statutory power.

- The report was issued by the Joint Committee on Human Rights of the UK Parliament.Confidence: Confirmed · evidencedEvidence and sources[Wide-ranging AI Bill needed to address severe human rights risks posed by AI (JCHR press release)](https://committees.parliament.uk/committee/93/human-rights-joint-committee/news/217859/wideranging-ai-bill-needed-to-address-severe-human-rights-risks-posed-by-ai) T1 · retrieved · retrieved 8 Oct 2026 · Chair's commentNowhere in the world, including the UK, has a current legislative and regulatory approach to AI that is fit for purpose.

- The SRA says use of AI does not change the professional standards expected of solicitors and law firms, and reports 42 AI-misuse reports between July 2025 and July 2026 with ongoing investigations.Confidence: Confirmed · As of 17 Aug 2026 · evidencedEvidence and sources[SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodythe use of AI does not change the professional standards expected of solicitors and law firms.
- [SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodyThe SRA received 42 reports related to the potential misuse of AI between July 2025 and July 2026.
- [SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodyThere are a number of ongoing investigations relating to misuse of AI, including on issues relating to inaccurate legal citations, supervision and confidentiality.

- The Solicitors Regulation Authority is the regulator for firms and individuals within the warning notice.Confidence: Confirmed · As of 17 Aug 2026 · evidencedEvidence and sources[Misuse of AI: warning notice (Solicitors Regulation Authority)](https://www.sra.org.uk/solicitors/guidance/misuse-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Section "Who is this warning notice relevant to?"This warning notice is relevant to all firms and individuals we regulate.

Open evidence