---
title: "United Kingdom — Sectoral & Public-Sector AI | Global AI Monitor"
canonical: https://artificial-intelligence.gi/jurisdictions/united-kingdom/sectoral-and-public-sector-ai/
source_html: /jurisdictions/united-kingdom/sectoral-and-public-sector-ai/index.html
description: "United Kingdom — Sectoral & Public-Sector AI: 07 Sectoral & Public-Sector AI Active Under review ▾ # AI Action Plan for Justice: one year on (Ministry of Justice, 24 September 2026) (Published 2026-09-24): Ministry of Justice"
generated_at: 2026-10-25T22:24:54Z
content_sha256: 315944ffdc059221a3a027e388d07d3e56c5d6c92a1a93f1e12b1a0f7540f8bc
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Sectoral & Public-Sector AI | Global AI Monitor

### 07Sectoral & Public-Sector AIActive Derived: Probable▾#

AI Action Plan for Justice: one year on (Ministry of Justice, 24 September 2026) (Published 2026-09-24): Ministry of Justice progress report published 24 September 2026 introducing a fourth strategic priority to strengthen the response to emerging AI risks in the justice system.

24 instruments · 12 obligations · 56 claims · Next: 31 Dec 2026 (First regulations (social media for under-16s) to be laid before Parliament "by the end of the year"; AI chatbot measures later by regulations)

24 instruments (24 current) · 12 obligations · 56 claims · 9 milestones

Instruments

- AI Action Plan for Justice: one year on (Ministry of Justice, 24 September 2026) Published 2026-09-24Ministry of Justice progress report published 24 September 2026 introducing a fourth strategic priority to strengthen the response to emerging AI risks in the justice system.Non-binding · Authority: Ministry of Justice · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/ai-action-plan-for-justice-one-year-on/ai-action-plan-for-justice-one-year-on)
- AI Opportunities Action Plan Published 2026-01-29; valid from 2025-01-01Government plan launched in January 2025; the January 2026 update reports that commitments on 38 of 50 actions have been met.Non-binding · Authority: Department for Science, Innovation and Technology · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/ai-opportunities-action-plan-one-year-on)
- AI Risk Management Toolkit (DSIT guidance, 8 September 2026) Published 2026-09-08DSIT guidance and workbook to help anyone involved in AI projects understand, assess and manage risks when designing, procuring or delivering AI products; aligned with the Orange Book risk management framework.Non-binding · Authority: Department for Science, Innovation and Technology · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/ai-risk-management-toolkit)
- Algorithmic Transparency Recording Standard (ATRS) mandatory scope and exemptions policy Published 2024-12-17; entry into force not recordedNon-statutory cross-government policy requiring central government organisations to complete ATRS records for in-scope algorithmic tools. Mandated across government departments on 6 February 2024.Binding · Authority: Cabinet Office · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy)
- Artificial Intelligence (AI) Guidance for Judicial Office Holders (October 2025) Published 2025-10-31Judiciary guidance for judicial office holders, clerks and support staff on responsible use of AI in courts and tribunals, replacing earlier versions; requires AI use to be consistent with protecting the integrity of the administration of justice.Non-binding · Authority: Courts and Tribunals Judiciary · Verified 8 Oct 2026 · [Official text](https://www.judiciary.uk/guidance-and-resources/artificial-intelligence-ai-judicial-guidance-october-2025/)
- Automated Vehicles Act 2024 In force since 2026-07-01Act on authorisation and use of self-driving vehicles in Great Britain; s.1 sets the self-driving test; s.79 (Part 4) makes it an offence to communicate in a way likely to confuse end-users about autonomous capability, commencing 7 January 2027 under SI 2026/731.Binding · Authority: UK Parliament · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2024/10)
- Bank of England response to Treasury Committee report on AI in financial services (1 April 2026) Published 2026-04-01Letter of 1 April 2026 from Sarah Breeden to the Treasury Committee Chair rejecting the Committee's characterisation that the Bank takes a "wait and see" approach to AI and responding to its call for AI-specific stress testing.Non-binding · Authority: Bank of England · Verified 8 Oct 2026 · [Official text](https://www.bankofengland.co.uk/-/media/boe/files/letter/2026/response-to-tsc-inquiry-report-on-ai-in-financial-services)
- Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience Published 2026-05-15Joint statement of 15 May 2026 saying that, in line with operational resilience rules, regulated firms and financial market infrastructures need to act on frontier-AI cyber risk across governance, vulnerability management, third-party risk, protection, and response and recovery.Regulatory expectation · Authority: Bank of England, Financial Conduct Authority · Verified 8 Oct 2026 · [Official text](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience)
- Children's Wellbeing and Schools Act 2026 In force since 2026-04-29Act of 29 April 2026 whose Part 3 inserts a power into the Online Safety Act 2023 (s.214A) for the Secretary of State to require providers of internet services to prevent or restrict access by children to services or features. The Government says it will use these powers for under-16 social media limits and, in July 2026, for measures on AI chatbots.Binding · Authority: Office of Communications (Ofcom) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2026/21)
- CMA guidance: Complying with consumer law when using AI agents Published 2026-03-09CMA guidance of 9 March 2026 telling businesses that they are responsible for what an AI agent does as for an employee, that they should consider labelling AI agents, and that they should train, monitor and quickly refine agents, with a human in the loop. It sits alongside CMA research on agentic AI and consumers.Non-binding · Authority: Competition and Markets Authority · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents)
- Crime and Policing Act 2026 In force since 2026-04-29Creates an offence of making AI models optimised for CSA images (s.72, uncommenced), an offence of supplying purported-intimate-image generators (s.99, in force 29 June 2026), and a power to extend Online Safety Act duties to AI services (s.248, in force at Royal Assent).Binding · Authority: Office of Communications (Ofcom) · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2026/20)
- Cyber Security and Resilience (Network and Information Systems) Bill Draft, no legal forceGovernment Bill reforming the NIS Regulations 2018, bringing managed service providers, data centres and other critical suppliers into scope; AI relevance is indirect (data-centre infrastructure that hosts AI).Authority: UK Parliament · Verified 8 Oct 2026 · [Official text](https://api.parliament.uk/bill-papers/bills/4035)
- Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime) In force since 2025-04-06Act whose consumer protection provisions prohibit unfair commercial practices and let the CMA decide infringements directly and impose penalties of up to the greater of £300,000 or 10% of turnover. The consumer regime has applied since 6 April 2025, and CMA guidance of 9 March 2026 says it governs AI agents used with consumers.Binding · Authority: Competition and Markets Authority · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/ukpga/2024/13)
- FCA approach to AI: no new AI-specific rules and AI Live Testing Published 2026-06-08FCA position that it will not introduce new regulations for AI and will rely on existing frameworks such as the Consumer Duty and SM&CR, supported by an AI Live Testing programme whose second cohort was announced on 21 April 2026.Non-binding · Authority: Financial Conduct Authority · Verified 8 Oct 2026 · [Official text](https://www.fca.org.uk/news/blogs/ai-financial-services-approach)
- FCA Mills Review: impact of AI on retail financial services (6 July 2026) Published 2026-07-06FCA-commissioned review led by executive director Sheldon Mills, published 6 July 2026, on how AI could reshape retail financial services; makes 7 recommendations for the FCA Board and Executive to consider, including adapting the regulatory perimeter. Advisory; the FCA has not adopted the recommendations in the sources read.Non-binding · Authority: Financial Conduct Authority · Verified 8 Oct 2026 · [Official text](https://www.fca.org.uk/news/press-releases/fca-publishes-landmark-review-impact-ai-retail-financial-services)
- FCA multi-firm review: Frontier AI and cyber resilience (September 2026) Published 2026-09-02FCA publication of 2 September 2026 summarising what firms reported about using, testing and preparing for frontier AI models with cyber capabilities; it states that it does not introduce new rules, guidance or regulatory expectations.Non-binding · Authority: Financial Conduct Authority · Verified 8 Oct 2026 · [Official text](https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience)
- Financial Policy Committee judgement on frontier AI and financial stability (July 2026) Published 2026-07-07In July 2026 the Financial Policy Committee judged that rapid progress in frontier AI capabilities significantly increases financial stability risks from cyber and operational vulnerabilities, and urged firms to act on the May 2026 joint statement.Non-binding · Authority: Financial Policy Committee (Bank of England) · Verified 8 Oct 2026 · [Official text](https://www.bankofengland.co.uk/financial-stability-report/2026/july-2026)
- Growing up in the online world: government response (July 2026), AI chatbot measures Published 2026-07-15Government response of 15 July 2026 to a national consultation on children's online safety. It commits to require AI chatbots to introduce mandatory breaks for under-18s, to stop under-18s accessing chatbot services that primarily offer sexualised content, and to consider banning children from certain chatbots, using powers in the Children's Wellbeing and Schools Act 2026; definitions will follow in regulations.Non-binding · Authority: Office of Communications (Ofcom) · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026)
- JSP 936: Dependable Artificial Intelligence (AI) in defence (part 1: directive) Published 2024-11-13MOD policy framework for the safe and responsible use of AI in defence, with directives on governance, development and assurance across the AI lifecycle.Legal force not established · Authority: Ministry of Defence · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/jsp-936-dependable-artificial-intelligence-ai-in-defence-part-1-directive)
- National Commission into the Regulation of AI in Healthcare: recommendations and Government response Published 2026-10-06The National Commission's 44 recommendations on regulating AI in healthcare were published on 10 September 2026, and on 6 October 2026 the Government said it accepts all of them. The MHRA is to consult on classification and then use secondary legislation to update the medical device definition.Non-binding · Authority: Medicines and Healthcare products Regulatory Agency · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare)
- PRA Supervisory Statement SS1/23: Model risk management principles for banks Published 2023-05-17; valid from 2024-05-17PRA supervisory statement setting five model risk management principles for banks, including managing risks from AI and machine learning models. Current version published and effective from 23 April 2026.Regulatory expectation · Authority: Prudential Regulation Authority (Bank of England) · Verified 8 Oct 2026 · [Official text](https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss)
- SRA warning notice: misuse of AI Published 2026-08-17Warning notice on misuse of AI in legal services, including false citations; states reliance on AI output is not a defence and existing professional standards still apply. The SRA reports 42 AI-misuse reports from July 2025 to July 2026 and ongoing investigations.Non-binding · Authority: Solicitors Regulation Authority · Verified 8 Oct 2026 · [Official text](https://www.sra.org.uk/solicitors/guidance/misuse-ai/)
- The Medical Devices Regulations 2002 Date not recordedUK medical devices regulations whose definition of medical device expressly includes software intended for diagnosis or therapy. The Government has accepted proposals to update the definition and classification for AI-enabled devices by secondary legislation.Binding · Authority: Medicines and Healthcare products Regulatory Agency · Verified 8 Oct 2026 · [Official text](https://www.legislation.gov.uk/uksi/2002/618)
- UK Government and Google DeepMind Memorandum of Understanding on AI opportunities and security Published 2025-12-11Voluntary, non-binding memorandum between DSIT and Google DeepMind to collaborate on public services, scientific discovery and AI security. Published on 11 December 2025.Non-binding · Authority: Department for Science, Innovation and Technology · Verified 8 Oct 2026 · [Official text](https://www.gov.uk/government/publications/memorandum-of-understanding-between-the-uk-and-google-deepmind-on-ai-opportunities-and-security/memorandum-of-understanding-between-the-uk-and-google-deepmind-on-ai-opportunities-and-security)

Obligations

- Medical Devices Regulations 2002 reg 11A person must not affix a UK marking to a general medical device unless the relevant requirements of other applicable product safety legislation are also satisfied.conformity assessment · Applies to: product manufacturer · The Medical Devices Regulations 2002
- ATRS policy sections 2-3Central government departments and in-scope arm's-length bodies must complete ATRS records for in-scope algorithmic tools.transparency disclosure · Applies to: deployer · Algorithmic Transparency Recording Standard (ATRS) mandatory scope and exemptions policy
- SS1/23 Principles 1-5PRA expects banks to maintain a model risk management framework under five principles, including identifying and managing risks from AI and machine learning models.risk management · Applies to: deployer · PRA Supervisory Statement SS1/23: Model risk management principles for banks
- BoE/FCA/HMT joint statement, 15 May 2026Regulated firms and financial market infrastructures must plan for and mitigate cybersecurity risks posed by frontier AI, consistent with existing operational resilience rules and expectations.risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
- DMCCA s.225(1) (Part 4 Chapter 1)Traders must not engage in unfair commercial practices; the prohibition applies whether the practice is carried out by a person or by a system acting for the trader (CMA guidance applies it to AI agents).prohibition · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
- DMCCA s.226(1) (misleading actions)A commercial practice involving false or misleading information, or an overall presentation likely to deceive the average consumer, is a misleading action and is an unfair commercial practice.transparency disclosure · Applies to: other · Digital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
- Guidance section "Tell your customers if you use an AI agent"Businesses using AI agents with customers should consider labelling them so customers are not misled into thinking a real person provides the service, and should not overstate the role of AI.transparency disclosure · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
- Guidance sections "Train", "Monitor" and "Refine"Businesses should train AI agents to comply with consumer law, monitor them with a human in the loop, and refine them quickly if problems arise; the business remains responsible for what the agent does.human oversight · Applies to: deployer · CMA guidance: Complying with consumer law when using AI agents
- Statement section "What this means for regulated firms"Regulated firms and financial market infrastructures need to take action to plan for and mitigate cybersecurity risks posed by frontier AI, including board understanding, faster vulnerability remediation and automated defences.risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
- Statement domain "Managing risks from third parties"Firms should manage frontier-AI cyber risks from third parties and supply chains, including open-source software, and be able to identify, monitor and manage external applications, libraries and services.risk management · Applies to: deployer · Bank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
- Online Safety Act 2023 s.214A (inserted by CWSA 2026 s.70)The Secretary of State may by regulations require providers of specified internet services to prevent or restrict access by children of specified ages to services or features, including time-of-day and daily-time limits; the Act itself imposes no duty until regulations are made.other · Applies to: provider · Children's Wellbeing and Schools Act 2026
- Automated Vehicles Act 2024 s.79 (Part 4)It is an offence to make, in the course of business, a communication about a product or service likely to confuse end-users in Great Britain as to whether a vehicle that is not an authorised automated vehicle can travel autonomously, safely and legally; due-diligence defences apply.transparency disclosure · Applies to: provider · Automated Vehicles Act 2024

Milestones

- 6 Apr 2025DMCCA consumer enforcement regime (unfair commercial practices; CMA direct enforcement) in force MetDigital Markets, Competition and Consumers Act 2024 (consumer enforcement regime)
- 9 Mar 2026CMA guidance on complying with consumer law when using AI agents published MetCMA guidance: Complying with consumer law when using AI agents
- 23 Apr 2026Current version of SS1/23 published and effective MetPRA Supervisory Statement SS1/23: Model risk management principles for banks
- 29 Apr 2026Section 248 power to extend Online Safety Act duties to AI services in force at Royal Assent MetCrime and Policing Act 2026
- 15 May 2026Joint statement on frontier AI models and cyber resilience published MetBank of England, FCA and HM Treasury joint statement on frontier AI models and cyber resilience
- 29 Jun 2026Section 99 (purported intimate image generators) and ss.100-101 in force MetCrime and Policing Act 2026
- 14 Jul 2026Lords second reading (tracker) MetCyber Security and Resilience (Network and Information Systems) Bill
- 31 Dec 2026 (year)First regulations (social media for under-16s) to be laid before Parliament "by the end of the year"; AI chatbot measures later by regulations UpcomingGrowing up in the online world: government response (July 2026), AI chatbot measures
- 7 Jan 2027Part 4 (marketing restrictions, incl. s.79 offence) in force UpcomingAutomated Vehicles Act 2024

Claims and evidence (56)
- Section 248 of the Crime and Policing Act 2026, in force at Royal Assent (29 April 2026), gives the Secretary of State a power to amend the Online Safety Act 2023 to address risks of harm from AI services.Confidence: Confirmed · As of 29 Apr 2026 · evidencedEvidence and sources[Crime and Policing Act 2026, section 248 (Power to amend Online Safety Act 2023: AI)](https://www.legislation.gov.uk/ukpga/2026/20/section/248) T1 · retrieved · retrieved 8 Oct 2026 · s.248 (inserting OSA s.216A)the Secretary of State may by regulations amend any provision of this Act for or in connection with the purposes of minimising or mitigating the risks of harm to individuals in the United Kingdom presented by—
- [Crime and Policing Act 2026, section 248 (Power to amend Online Safety Act 2023: AI)](https://www.legislation.gov.uk/ukpga/2026/20/section/248) T1 · retrieved · retrieved 8 Oct 2026 · s.248 commencement informationS. 248 in force at Royal Assent, see s. 255(2)(k)
- [Crime and Policing Act 2026, section 248 (Power to amend Online Safety Act 2023: AI)](https://www.legislation.gov.uk/ukpga/2026/20/section/248) T1 · retrieved · retrieved 8 Oct 2026 · s.248 (OSA s.216A definitions)“AI service” means an internet service that is capable (or part of which is capable) of generating AI-generated content (no matter what proportion of content on the service is AI-generated).

- The Bank of England, FCA and HM Treasury issued a joint statement on 15 May 2026 setting expectations that regulated firms plan for and mitigate cybersecurity risks posed by frontier AI.Confidence: Probable · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "What this means for regulated firms"In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures (FMIs) (referred to as 'firms'), need to take action to plan for and mitigate cybersecurity risks posed by frontier AI.
- [The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatement from the Bank of England, Financial Conduct Authority and HM Treasury Published on 15 May 2026 ## Statement ### Why frontier AI

- The PRA's SS1/23 model risk management principles for banks, confirmed as technology-neutral and covering AI models, remained the Bank of England's primary AI model-risk supervisory expectation as at April 2026.Confidence: Probable · As of 1 Apr 2026 · evidencedEvidence and sources[Bank of England letter: Response to TSC inquiry report on AI in financial services](https://www.bankofengland.co.uk/-/media/boe/files/letter/2026/response-to-tsc-inquiry-report-on-ai-in-financial-services) T1 · retrieved · retrieved 8 Oct 2026 · BoE letter to Treasury Committee (AI approach)issued new Model Risk Management Principles for banks, which are technology-
- [SS1/23 - Model risk management principles for banks](https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss) T1 · retrieved · retrieved 8 Oct 2026 · SS1/23 introductionThe expectations are in the form of five principles considered key to implement a robust MRM framework and to manage the risk effectively across all model and risk types. The principles are intended to support firms to strengthen their policies, proc

- The CMA published guidance on 9 March 2026 stating that a business is responsible under consumer law for what an AI agent does, as it would be for an employee, even where a third party designed or provides the agent.Confidence: Probable · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu

- Regulation 2 of the Medical Devices Regulations 2002 defines a medical device to include software intended by the manufacturer to be used specifically for diagnosis or therapeutic purposes.Confidence: Probable · evidencedEvidence and sources[The Medical Devices Regulations 2002, regulation 2](https://www.legislation.gov.uk/uksi/2002/618/regulation/2) T1 · retrieved · retrieved 8 Oct 2026 · MDR 2002 reg 2(1) "medical device"any instrument, apparatus, appliance, software, material or other article, whether used alone or in combination, together with any accessories, including the software intended by its manufacturer to be used specifically for diagnosis or therapeutic p

- The FCA has said it will not introduce new AI-specific regulation and will instead rely on existing frameworks such as the Consumer Duty and SM&CR.Confidence: Probable · As of 8 Jun 2026 · evidencedEvidence and sources[AI in financial services: shaping our approach through industry engagement](https://www.fca.org.uk/news/blogs/ai-financial-services-approach) T1 · retrieved · retrieved 8 Oct 2026 · FCA blog, paragraph 2We have been clear that we are not going to introduce new regulations for AI. Instead, we'll rely on existing frameworks, including the Consumer Duty,

- The PRA's SS1/23 model risk management principles for banks are technology-neutral and the Bank of England has confirmed they apply to AI models.Confidence: Probable · As of 17 May 2023 · evidencedEvidence and sources[Bank of England letter: Response to TSC inquiry report on AI in financial services](https://www.bankofengland.co.uk/-/media/boe/files/letter/2026/response-to-tsc-inquiry-report-on-ai-in-financial-services) T1 · retrieved · retrieved 8 Oct 2026 · BoE letter to Treasury Committee (AI approach)issued new Model Risk Management Principles for banks, which are technology-
- [SS1/23 - Model risk management principles for banks](https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss) T1 · retrieved · retrieved 8 Oct 2026 · SS1/23 introductionThe expectations are in the form of five principles considered key to implement a robust MRM framework and to manage the risk effectively across all model and risk types. The principles are intended to support firms to strengthen their policies, proc

- The Bank of England, FCA and HM Treasury jointly stated on 15 May 2026 that frontier AI poses cyber and operational risks firms must manage under existing operational resilience rules.Confidence: Confirmed · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatement from the Bank of England, Financial Conduct Authority and HM Treasury Published on 15 May 2026 ## Statement ### Why frontier AI
- [FCA, Bank of England and Treasury joint statement on frontier AI models and cyber resilience](https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatements First published: 15/05/2026 Last updated: 15/05/2026

- The FCA stated on 8 June 2026 that it will not introduce new AI-specific regulation and will rely on existing frameworks including the Consumer Duty and SM&CR, and on 21 April 2026 announced a second AI Live Testing cohort.Confidence: Probable · As of 8 Jun 2026 · evidencedEvidence and sources[AI in financial services: shaping our approach through industry engagement](https://www.fca.org.uk/news/blogs/ai-financial-services-approach) T1 · retrieved · retrieved 8 Oct 2026 · FCA blog, paragraph 2We have been clear that we are not going to introduce new regulations for AI. Instead, we'll rely on existing frameworks, including the Consumer Duty,
- [AI in financial services: shaping our approach through industry engagement](https://www.fca.org.uk/news/blogs/ai-financial-services-approach) T1 · retrieved · retrieved 8 Oct 2026 · FCA blog, paragraph 2Instead, we’ll rely on existing frameworks, including the Consumer Duty, the Senior Managers and Certification Regime (SM&CR), and our expectations on governance and controls.
- [FCA announces second cohort for AI Live Testing](https://www.fca.org.uk/news/press-releases/fca-announces-second-cohort-ai-live-testing) T1 · retrieved · retrieved 8 Oct 2026 · FCA press release (opening paragraph)Speaking at UK FinTech Week, Jessica Rusu, chief data, information and intelligence officer at the FCA, has confirmed the second group of firms selected to join AI Live Testing.

- JSP 936 (part 1: directive) is the MOD's principal policy framework governing safe and responsible use of AI in defence.Confidence: Probable · As of 13 Nov 2024 · evidencedEvidence and sources[JSP 936: Dependable Artificial Intelligence (AI) in defence (part 1: directive)](https://www.gov.uk/government/publications/jsp-936-dependable-artificial-intelligence-ai-in-defence-part-1-directive) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK publication summaryJSP 936 (part 1: directive) is the principal policy framework governing the safe and responsible adoption of AI in MOD.

- The AI Opportunities Action Plan One Year On update, dated 29 January 2026, reports the Government has met its commitments on 38 of the plan's 50 actions.Confidence: Probable · As of 29 Jan 2026 · evidencedEvidence and sources[AI Opportunities Action Plan: One Year On](https://www.gov.uk/government/publications/ai-opportunities-action-plan-one-year-on) T1 · retrieved · retrieved 8 Oct 2026 · Action Plan One Year On (introduction)Since then, the government has met its commitments on 38 of the plan’s 50 actions.

- On 6 October 2026 the Government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare; the MHRA will consult on classification of software and AI-enabled devices before using secondary legislation to update the medical device definition.Confidence: Confirmed · As of 6 Oct 2026 · evidencedEvidence and sources[Government backs recommendations of NHS doctors-led AI Commission](https://www.gov.uk/government/news/government-backs-recommendations-of-nhs-doctors-led-ai-commission) T1 · retrieved · retrieved 8 Oct 2026 · GOV.UK news story (opening paragraph)The government has today, 6 October 2026, confirmed it will accept all 44 recommendations made by the National Commission into the Regulation of AI in Healthcare, published 10 September, and has set out how they will be delivered across the UK. Alongside the response, the MHRA is opening the call fo
- [Government Response to the National Commission's Recommendations on the Regulation of AI in Healthcare](https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare) T1 · retrieved · retrieved 8 Oct 2026 · Government response, ministerial forewordintends to accept all of the recommendations it put forward. Delivering the full benefits of AI in healthcare should be viewed as a shared endeavour a
- [Government Response to the National Commission's Recommendations on the Regulation of AI in Healthcare](https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare) T1 · retrieved · retrieved 8 Oct 2026 · Government response, Recommendation 1 (Modernising the Regulation)launch a consultation on a new, proportionate approach to classification and qualification for software and AI-enabled devices. The MHRA will then use secondary legislation to introduce: - An upda
- [Government Response to the National Commission's Recommendations on the Regulation of AI in Healthcare](https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcare) T1 · retrieved · retrieved 8 Oct 2026 · Government response, Recommendation 1 (Modernising the Regulation)The MHRA will then use secondary legislation to introduce: - An updated definition of a medical device that builds u

- The Digital Markets, Competition and Consumers Act 2024 (c. 13) contains the UK consumer-enforcement regime in Part 3 Chapters 3-4 and Part 4 Chapter 1.Confidence: Probable · As of 24 May 2024 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 3 (public enforcement of consumer protection law: court proceedings)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/3) T1 · retrieved · retrieved 8 Oct 2026 · Part 3 Chapter 3, status bannerThere are currently no known outstanding effects for the Digital Markets, Competition and Consumers Act 2024, Chapter 3.
- [Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices)](https://www.legislation.gov.uk/ukpga/2024/13/part/4/chapter/1) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.225(1)-(2)(1)Unfair commercial practices are prohibited. (2)The promotion of unfair commercial practices in, or in connection with, a code of conduct by— (a)a person responsible for the content of a code of c

- Section 225 prohibits unfair commercial practices and section 226 defines misleading actions, which cover the provision of false or misleading information about a product, trader or other matter relevant to a transactional decision.Confidence: Probable · As of 6 Apr 2025 · evidencedEvidence and sources[Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices)](https://www.legislation.gov.uk/ukpga/2024/13/part/4/chapter/1) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.225(1)-(2)(1)Unfair commercial practices are prohibited. (2)The promotion of unfair commercial practices in, or in connection with, a code of conduct by— (a)a person responsible for the content of a code of c
- [Digital Markets, Competition and Consumers Act 2024, Part 4 Chapter 1 (unfair commercial practices)](https://www.legislation.gov.uk/ukpga/2024/13/part/4/chapter/1) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.226(1)(1)For the purposes of this Chapter, a commercial practice involves a misleading action if the practice involves— (a)the provision of false or misleading information relating to a product, a trader or any other matter relevant to a transactional decision, (b

- The CMA published its guidance "Complying with consumer law when using AI agents" and the research paper "Agentic AI and consumers" on 9 March 2026.Confidence: Confirmed · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Page headerComplying with consumer law when using AI agents Published 9 March 2026 ## Contents 1. When it comes to dealing with y
- [Agentic AI and consumers (CMA research and analysis)](https://www.gov.uk/government/publications/agentic-ai-and-consumers/agentic-ai-and-consumers) T1 · retrieved · retrieved 8 Oct 2026 · Page headerAgentic AI and consumers Published 9 March 2026 ## Contents 1. Executive summa
- [Using AI agents: complying with consumer law (CMA guidance landing page)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Landing page summaryGuidance from the Competition and Markets Authority (CMA) on how your business can benefit from agentic AI, while still meeting legal obligations.

- Derived: Probable The CMA guidance explains how businesses can use agentic AI with customers while complying with consumer law; it is guidance and not itself legislation.Confidence: Probable · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · IntroductionThis page provides guidance on how your business can use agentic AI to engage with its customers, while staying on the right side of the law and doing right by them.
- [Using AI agents: complying with consumer law (CMA guidance landing page)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Landing page summaryGuidance from the Competition and Markets Authority (CMA) on how your business can benefit from agentic AI, while still meeting legal obligations.

- The CMA says a business is responsible for what an AI agent does in the same way as for an employee, even where someone else designed or provides the agent.Confidence: Confirmed · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu
- [Agentic AI and consumers (CMA research and analysis)](https://www.gov.uk/government/publications/agentic-ai-and-consumers/agentic-ai-and-consumers) T1 · retrieved · retrieved 8 Oct 2026 · Section on AI and pricing / collusionBusinesses remain responsible for the outcomes of pricing and commercial decisions shaped by AI systems, and must take proactive steps to understand, test and govern the technologies they deploy. As AI systems become more autonomous, ensuring that they are designed, monitored and constrained in ways

- Derived: Probable The CMA warns that a business that breaks consumer protection law, including through an AI agent, could face enforcement action, be fined up to 10% of its worldwide turnover and be forced to compensate affected consumers.Confidence: Confirmed · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Same section, second paragraphIf you break consumer protection law, you could face action by enforcement authorities (including the CMA). You could be fined up to 10% of your worldwide turnover, and possibly forced to compensate affected consumers.
- [Digital Markets, Competition and Consumers Act 2024, Part 3 Chapter 4 (CMA direct enforcement: infringement notices)](https://www.legislation.gov.uk/ukpga/2024/13/part/3/chapter/4) T1 · retrieved · retrieved 8 Oct 2026 · DMCCA s.182(6) (CMA final infringement notice)The amount of a monetary penalty imposed under subsection (4)(b) must be a fixed amount not exceeding £300,000 or, if higher, 10% of the total value of the turnover (if any) of the respondent.

- The guidance says businesses should consider labelling AI agents so they do not mislead customers into thinking they deal with a real person, and should keep a human in the loop checking the agent's decisions.Confidence: Probable · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Section "Tell your customers if you use an AI agent"If you use an AI agent, consider whether you need to label it so you do not mislead customers into thinking that a service is being provided by a real person – if the fact they are dealing with AI rather than a person might affect people's decisions then you should tell them. Do not overstate the ro
- [Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Section "Monitor how your AI agents are performing"Make sure there is a human in the loop, actively checking that the AI agent is making correct decisions and generating expected results. Regular human oversight is important to catch mistakes and ensure that AI agents are completing tasks in a legally complian

- The guidance applies the DMCCA to AI agents running marketing campaigns, processing refunds, answering customer queries and providing comparison services, including accurate pricing, labelled paid endorsements and genuine offers.Confidence: Probable · As of 9 Mar 2026 · evidencedEvidence and sources[Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Example: using an AI agent to run your latest marketing campaignThink about the requirements of the Digital Markets, Competition and Consumers Act 2024 when you design and train the AI. For example:
- [Complying with consumer law when using AI agents (CMA guidance)](https://www.gov.uk/government/publications/complying-with-consumer-law-when-using-ai-agents/complying-with-consumer-law-when-using-ai-agents) T1 · retrieved · retrieved 8 Oct 2026 · Section "When it comes to dealing with your customers, the same rules apply whether using AI or human agents"It's important to remember that you are responsible for what an AI agent does in the same way you are responsible for what an employee does. This is true even if someone else designed or provides the AI agent on your behalf - so make sure you think about compliance with consumer law if you are procu

- The Bank of England, the FCA and HM Treasury published their joint statement on frontier AI models and cyber resilience on 15 May 2026.Confidence: Confirmed · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatement from the Bank of England, Financial Conduct Authority and HM Treasury Published on 15 May 2026 ## Statement ### Why frontier AI
- [FCA, Bank of England and Treasury joint statement on frontier AI models and cyber resilience](https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Statement headerStatements First published: 15/05/2026 Last updated: 15/05/2026

- Derived: Probable The joint statement says firms need to act to mitigate frontier-AI cyber risk "in line with our operational resilience rules and expectations", and that the authorities judge firms should take active steps across five domains; it sets no new rule.Confidence: Probable · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "What this means for regulated firms"In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures (FMIs) (referred to as 'firms'), need to take action to plan for and mitigate cybersecurity risks posed by frontier AI.
- [FCA, Bank of England and Treasury joint statement on frontier AI models and cyber resilience](https://www.fca.org.uk/news/statements/fca-boe-treasury-joint-statement-frontier-ai-models-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "What this means for regulated firms"The Government and UK financial authorities judge that firms should be taking active steps across several domains.*

- The authorities say firms should ensure board understanding of frontier AI risks, remediate vulnerabilities faster and at scale, manage third-party and open-source risk, adopt automated defences and be able to respond and recover quickly.Confidence: Confirmed · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Domain "Governance and strategy"Firms should ensure their boards and senior management have sufficient understanding of frontier AI risks. This is important to set strategi
- [The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Domain "Identification and risk management of vulnerabilities"Firms should be able to triage, prioritise, risk assess, and remediate vulnerabilities more quickly, more frequently, and at scale, including through automation where appropriate, while mitigating the
- [The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Domain "Managing risks from third parties"Firms should effectively manage frontier AI cyber risks from third parties and supply chains, including open-source software. This means firms should have the c
- [The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "What this means for regulated firms"In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures (FMIs) (referred to as 'firms'), need to take action to plan for and mitigate cybersecurity risks posed by frontier AI.

- The statement says the cyber capabilities of current frontier AI models already exceed what a skilled practitioner could achieve, at higher speed, greater scale and lower cost, which amplifies threats to firms and financial stability if used maliciously.Confidence: Probable · As of 15 May 2026 · evidencedEvidence and sources[The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience](https://www.bankofengland.co.uk/news/2026/may/boe-fca-and-hm-treasury-joint-statement-on-frontier-ai-models-and-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "Why frontier AI matters for firms"The cyber capabilities of current frontier AI models are already exceeding what a skilled practitioner could achieve, and at a significantly higher speed, greater scale, and lower cost. These capabilities, if used maliciously, amplify cyber threats to firms' s

- The Bank of England published the July 2026 Financial Stability Report and the FPC record, including the frontier AI judgement, on 7 July 2026.Confidence: Confirmed · As of 7 Jul 2026 · evidencedEvidence and sources[Financial Policy Committee Record - July 2026](https://www.bankofengland.co.uk/financial-policy-committee-record/2026/july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Page headerFinancial Stability Report - July 2026 Published on 07 July 2026 Financial Policy Committee Record - July 2026 (PDF 0.
- [Financial Stability Report - July 2026](https://www.bankofengland.co.uk/financial-stability-report/2026/july-2026) T1 · retrieved · retrieved 8 Oct 2026 · FSR July 2026 headline summaryRapid advances in and differing access to AI capabilities have increased cyber and operational resilience risks

- The FPC judged that rapid progress in frontier AI capabilities since the December Financial Stability Report presents a significant increase in financial stability risks from cyber and operational vulnerabilities.Confidence: Confirmed · As of 7 Jul 2026 · evidencedEvidence and sources[Financial Policy Committee Record - July 2026](https://www.bankofengland.co.uk/financial-policy-committee-record/2026/july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Headline judgements, "Developments in frontier AI"Rapid progress in frontier AI capabilities since the December FSR present a significant increase in the risks to financial stability from cyber and operational vulnerabilities. ** Frontier AI models are increasingly capa
- [Financial Stability Report - July 2026](https://www.bankofengland.co.uk/financial-stability-report/2026/july-2026) T1 · retrieved · retrieved 8 Oct 2026 · FSR July 2026 headline summaryRapid advances in and differing access to AI capabilities have increased cyber and operational resilience risks

- The FPC said the developments reinforce the importance of firms acting on the May 2026 Bank, FCA and HM Treasury joint statement and on existing cyber and operational resilience frameworks.Confidence: Probable · As of 7 Jul 2026 · evidencedEvidence and sources[Financial Policy Committee Record - July 2026](https://www.bankofengland.co.uk/financial-policy-committee-record/2026/july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Headline judgements, "Developments in frontier AI"These developments reinforce the importance of firms acting on the May 2026 joint statement from the Bank, Financial Conduct Authority (FCA) and HM Treasury on frontier models, and on existing cyber and operational resilience frameworks. UK authorities are providing further support through supervi

- The FCA published its multi-firm review "Frontier AI and cyber resilience" on 2 September 2026.Confidence: Probable · As of 2 Sep 2026 · evidencedEvidence and sources[Frontier AI and cyber resilience (FCA multi-firm review)](https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Publication headerMulti-firm reviews Published: 02/09/2026 Last updated: 02/09/2026

- The FCA says the review summarises observations reported by firms and does not introduce new rules, guidance or regulatory expectations.Confidence: Probable · As of 2 Sep 2026 · evidencedEvidence and sources[Frontier AI and cyber resilience (FCA multi-firm review)](https://www.fca.org.uk/publications/multi-firm-reviews/frontier-ai-cyber-resilience) T1 · retrieved · retrieved 8 Oct 2026 · Section "What we expect from firms"This publication summarises observations reported by firms during our engagement. It does not introduce new rules, guidance or regulatory expectations.

- The Children's Wellbeing and Schools Act 2026 (c. 21) received Royal Assent on 29 April 2026.Confidence: Confirmed · As of 29 Apr 2026 · evidencedEvidence and sources[Children's Wellbeing and Schools Act 2026 (whole Act)](https://www.legislation.gov.uk/ukpga/2026/21) T1 · retrieved · retrieved 8 Oct 2026 · Long title and enacting formula[29th April 2026] Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords S

- The Children's Wellbeing and Schools Act 2026 is an Act of Parliament; its Part 3 online safety power is in force.Confidence: Confirmed · As of 29 Apr 2026 · evidencedEvidence and sources[Children's Wellbeing and Schools Act 2026 (whole Act)](https://www.legislation.gov.uk/ukpga/2026/21) T1 · retrieved · retrieved 8 Oct 2026 · Long title and enacting formula[29th April 2026] Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords S
- [Children's Wellbeing and Schools Act 2026 (whole Act)](https://www.legislation.gov.uk/ukpga/2026/21) T1 · retrieved · retrieved 8 Oct 2026 · CWSA 2026 s.70 commencement noteS. 70 in force at Royal Assent, see s. 78(1)(b)

- Derived: Probable Section 70 (power to restrict children's access to internet services) came into force at Royal Assent on 29 April 2026.Confidence: Confirmed · As of 29 Apr 2026 · evidencedEvidence and sources[Children's Wellbeing and Schools Act 2026 (whole Act)](https://www.legislation.gov.uk/ukpga/2026/21) T1 · retrieved · retrieved 8 Oct 2026 · CWSA 2026 s.70 commencement noteS. 70 in force at Royal Assent, see s. 78(1)(b)
- [Children's Wellbeing and Schools Act 2026 (whole Act)](https://www.legislation.gov.uk/ukpga/2026/21) T1 · retrieved · retrieved 8 Oct 2026 · Long title and enacting formula[29th April 2026] Be it enacted by the King’s most Excellent Majesty, by and with the advice and consent of the Lords S

- Section 70 inserts Online Safety Act 2023 section 214A, which lets the Secretary of State make regulations requiring providers of specified internet services to prevent or restrict access by relevant children to services or features, including daily time limits; the Explanatory Notes list AI chatbots among emerging services the consultation covers.Confidence: Confirmed · As of 29 Apr 2026 · evidencedEvidence and sources[Children's Wellbeing and Schools Act 2026, Part 3 (as enacted)](https://www.legislation.gov.uk/ukpga/2026/21/part/3/enacted) T1 · retrieved · retrieved 8 Oct 2026 · CWSA 2026 s.70 inserting Online Safety Act 2023 s.214A(1)The Secretary of State may, for the purpose of protecting relevant children from a risk of harm (including harm presented by content), make provision by regulations requiring providers of specified internet services—
- [Children's Wellbeing and Schools Act 2026, Part 3 (as enacted)](https://www.legislation.gov.uk/ukpga/2026/21/part/3/enacted) T1 · retrieved · retrieved 8 Oct 2026 · OSA 2023 s.214A(4)(a)(a)limit the amount of time per day, or over the course of a specified period, for which relevant children may access the service or a specified functionality or other feature of the service;
- [Children's Wellbeing and Schools Act 2026, Explanatory Notes (Part 3, online safety)](https://www.legislation.gov.uk/ukpga/2026/21/notes/division/3/index.htm) T1 · retrieved · retrieved 8 Oct 2026 · Explanatory Notes, Part 3, "VPN Services and Social Media" (consultation scope)use of emerging services such as AI chatbots, and whether changes to the digital age of consent are appropriate.

- The Government published its response to the "Growing up in the online world" consultation on 15 July 2026.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: a national consultation (GOV.UK consultation page)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation) T1 · retrieved · retrieved 8 Oct 2026 · Updates to this page2. 7 August 2026 Added HTML version of the July consultation response. 3. 15 July 2026 Updated with the final gove

- The response announces policy and says definitions and detail will be set out in regulations; it creates no legal duty itself.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbotsThe detailed definitions of which chatbots are in scope of these measures will be set out in regulations in due course.
- [Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 1we will use the powers under the Children’s Wellbeing and Schools Act 2026 to do so.

- Derived: Probable The Government said it will require AI chatbots to introduce mandatory breaks for all children under 18, working with an expert panel on how frequent and how long breaks should be.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbotsWe will therefore require AI chatbots to introduce mandatory breaks for all children under-18.

- Derived: Probable The Government said it will prevent under-18s from accessing AI chatbot services that primarily offer sexualised content, and other chatbot services will not be able to offer children features enabling sexually explicit or sexual role-playing content.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 1, summary of measuresPrevent under-18s from accessing AI chatbot services that primarily offer sexualised content. Other AI chatbot services will not be able to offer children features that enable sexually explicit or sexual role-playing content

- Business and customer-service chatbots will be exempt from the chatbot measures, with detailed definitions of in-scope chatbots to be set out in regulations in due course.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbotsChatbots that are typically used in business or customer service settings will be exempt from the measures.
- [Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbotsThe detailed definitions of which chatbots are in scope of these measures will be set out in regulations in due course.

- Derived: Probable The Government said it will work with regulators to act on chatbots that share harmful mental health advice and will consider all options, including banning children from certain chatbots where other mechanisms are not enough.Confidence: Probable · As of 15 Jul 2026 · evidencedEvidence and sources[Growing up in the online world: government response (July 2026)](https://www.gov.uk/government/consultations/growing-up-in-the-online-world-a-national-consultation/outcome/growing-up-in-the-online-world-government-response-july-2026) T1 · retrieved · retrieved 8 Oct 2026 · Chapter 3, AI chatbots, "What will change"We will work with regulators to take action on chatbots that share harmful mental health advice and will consider all options, including banning children from certain chatbots where other regulatory and safety mechanisms are not enough.

- The Automated Vehicles Act 2024 (c. 10) sets a self-driving test, under section 1, for authorising vehicles that travel autonomously in Great Britain.Confidence: Confirmed · evidencedEvidence and sources[Automated Vehicles Act 2024, section 1 (the self-driving test)](https://www.legislation.gov.uk/ukpga/2024/10/section/1) T1 · retrieved · retrieved 8 Oct 2026 · AVA 2024 s.1(2)(a)it is designed or adapted with the intention that a feature of the vehicle will allow it to travel autonomously, and
- [Automated Vehicles Act 2024, section 1 (the self-driving test)](https://www.legislation.gov.uk/ukpga/2024/10/section/1) T1 · retrieved · retrieved 8 Oct 2026 · AVA 2024 s.1(2)(b)it is capable of doing so, by means of that feature, safely and legally.

- The Automated Vehicles Act 2024 is an Act of Parliament commenced in stages by regulations; Part 4 commences on 7 January 2027.Confidence: Confirmed · evidencedEvidence and sources[The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)](https://www.legislation.gov.uk/uksi/2026/731/made) T1 · retrieved · retrieved 8 Oct 2026 · SI 2026/731 reg 2Part 4 of the Automated Vehicles Act 2024 (marketing restrictions), so far as not already in force, comes into force on 7th January 2027.
- [Automated Vehicles Act 2024 (whole Act)](https://www.legislation.gov.uk/ukpga/2024/10) T1 · retrieved · retrieved 8 Oct 2026 · AVA 2024 s.79(5)(c) and commencement note(c)on conviction on indictment, to imprisonment for a term not exceeding 2 years or a fine (or both). Commencement Information I82S. 79 not in force at Royal Assent, see s. 99(1) Prospective #

- Section 1 of the Act defines the self-driving test by reference to intended design, autonomous capability, and safe and lawful operation in the intended location and circumstances.Confidence: Confirmed · evidencedEvidence and sources[Automated Vehicles Act 2024, section 1 (the self-driving test)](https://www.legislation.gov.uk/ukpga/2024/10/section/1) T1 · retrieved · retrieved 8 Oct 2026 · AVA 2024 s.1(2)(a)it is designed or adapted with the intention that a feature of the vehicle will allow it to travel autonomously, and
- [Automated Vehicles Act 2024, section 1 (the self-driving test)](https://www.legislation.gov.uk/ukpga/2024/10/section/1) T1 · retrieved · retrieved 8 Oct 2026 · AVA 2024 s.1(2)(b)it is capable of doing so, by means of that feature, safely and legally.

- Derived: Probable Part 4 of the Act (marketing restrictions), so far as not already in force, comes into force on 7 January 2027 under SI 2026/731 made 1 July 2026.Confidence: Confirmed · As of 7 Jan 2027 · evidencedEvidence and sources[The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)](https://www.legislation.gov.uk/uksi/2026/731/made) T1 · retrieved · retrieved 8 Oct 2026 · SI 2026/731 reg 2Part 4 of the Automated Vehicles Act 2024 (marketing restrictions), so far as not already in force, comes into force on 7th January 2027.
- [The Automated Vehicles Act 2024 (Commencement No. 3) Regulations 2026 (SI 2026/731)](https://www.legislation.gov.uk/uksi/2026/731/made) T1 · retrieved · retrieved 8 Oct 2026 · SI 2026/731 explanatory noteThey bring into force Part 4 of the Act, so far as not already in force, on 7th January 2027. Part 4 of the Act makes provision for marketing restrictions in relation to automated vehicles. Section 78 of the Act came int

- The Cyber Security and Resilience (Network and Information Systems) Bill is a Government Bill that has passed the House of Commons and is before the House of Lords; it is not yet an Act.Confidence: Probable · evidencedEvidence and sources[Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Bill Papers)](https://api.parliament.uk/bill-papers/bills/4035) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Bill type:|Government Bill| |--|--| |Originating House:|House of Commons| |Current House:|House of Lords| |Originating session (b
- [Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Bill Papers)](https://api.parliament.uk/bill-papers/bills/4035) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Originating session (bill system ID):|Parliament 59 - Session 1 (2024-26)| |Is Act:|false| |Is with

- The Bill has no legal force while before Parliament.Confidence: Probable · evidencedEvidence and sources[Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Bill Papers)](https://api.parliament.uk/bill-papers/bills/4035) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Bill type:|Government Bill| |--|--| |Originating House:|House of Commons| |Current House:|House of Lords| |Originating session (b
- [Cyber Security and Resilience (Network and Information Systems) Bill (UK Parliament Bill Papers)](https://api.parliament.uk/bill-papers/bills/4035) T1 · retrieved · retrieved 8 Oct 2026 · Parliament bill page table|Originating session (bill system ID):|Parliament 59 - Session 1 (2024-26)| |Is Act:|false| |Is with

- The Government states the Bill will reform and add to the Network and Information Systems Regulations 2018, extending scope to managed service providers, data centres and supply chains.Confidence: Probable · evidencedEvidence and sources[Cyber Security and Resilience (Network and Information Systems) Bill: summary of the Bill](https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/summary-of-the-bill) T1 · retrieved · retrieved 8 Oct 2026 · Section "What are we going to do?"The Cyber Security and Resilience (Network and Information Systems) Bill will reform and add to the existing Network and Information Systems (NIS) Regulations 2018, to increase UK defences against cyber-attacks, better protecting the services the public rely on to go about their normal lives
- [Cyber Security and Resilience (Network and Information Systems) Bill: summary of the Bill](https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/summary-of-the-bill) T1 · retrieved · retrieved 8 Oct 2026 · Section "Why is reform needed?"cyber criminals are exploiting new routes – managed service providers, data centres and critical parts of supply chains – to threaten our way of life.

- A tracker reports the Bill was introduced to the Commons on 12 November 2025 and had its Lords second reading on 14 July 2026.Confidence: Uncertain · As of 12 Nov 2025 · evidencedEvidence and sources[Cyber Security and Resilience Bill: legislative timeline (tracker)](https://csrbill.co.uk/timeline/) T3 · retrieved · retrieved 8 Oct 2026 · Timeline table|Introduction to Parliament (First Reading)|12 November 2025|Done|The Bill was f
- [Cyber Security and Resilience Bill: legislative timeline (tracker)](https://csrbill.co.uk/timeline/) T3 · retrieved · retrieved 8 Oct 2026 · Timeline table|Lords stages|Second Reading 14 July 2026|In progress|The Bill is now before the

- The Solicitors Regulation Authority published a warning notice on misuse of AI, relevant to all firms and individuals it regulates, on 17 August 2026.Confidence: Confirmed · As of 17 Aug 2026 · evidencedEvidence and sources[Misuse of AI: warning notice (Solicitors Regulation Authority)](https://www.sra.org.uk/solicitors/guidance/misuse-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Section "Who is this warning notice relevant to?"This warning notice is relevant to all firms and individuals we regulate.

- The SRA says use of AI does not change the professional standards expected of solicitors and law firms, and reports 42 AI-misuse reports between July 2025 and July 2026 with ongoing investigations.Confidence: Confirmed · As of 17 Aug 2026 · evidencedEvidence and sources[SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodythe use of AI does not change the professional standards expected of solicitors and law firms.
- [SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodyThe SRA received 42 reports related to the potential misuse of AI between July 2025 and July 2026.
- [SRA cautions profession about safe and responsible use of AI in legal sector](https://www.sra.org.uk/news/news/releases/responsible-use-ai/) T1 · retrieved · retrieved 8 Oct 2026 · Press release bodyThere are a number of ongoing investigations relating to misuse of AI, including on issues relating to inaccurate legal citations, supervision and confidentiality.

- The Courts and Tribunals Judiciary issued refreshed AI guidance for judicial office holders dated 31 October 2025.Confidence: Confirmed · As of 31 Oct 2025 · evidencedEvidence and sources[Artificial Intelligence (AI) Guidance for Judicial Office Holders (31 October 2025)](https://www.judiciary.uk/wp-content/uploads/2025/10/Artificial-Intelligence-AI-Guidance-for-Judicial-Office-Holders-2.pdf) T1 · retrieved · retrieved 8 Oct 2026 · Section 1, IntroductionAny use of AI by or on behalf of the judiciary must be consistent with the judiciary's overarching obligation to protect the integrity of the administration of justice. This gu
- [Artificial Intelligence (AI) Judicial Guidance (October 2025)](https://www.judiciary.uk/guidance-and-resources/artificial-intelligence-ai-judicial-guidance-october-2025/) T1 · retrieved · retrieved 8 Oct 2026 · Foreword by Lord Justice BirssThe use of AI by the judiciary must be consistent with its overarching obligation to protect the integrity of the administration of justice and uphold the rule of law.

- The guidance states that any use of AI by or on behalf of the judiciary must be consistent with the judiciary's overarching obligation to protect the integrity of the administration of justice.Confidence: Confirmed · As of 31 Oct 2025 · evidencedEvidence and sources[Artificial Intelligence (AI) Guidance for Judicial Office Holders (31 October 2025)](https://www.judiciary.uk/wp-content/uploads/2025/10/Artificial-Intelligence-AI-Guidance-for-Judicial-Office-Holders-2.pdf) T1 · retrieved · retrieved 8 Oct 2026 · Section 1, IntroductionAny use of AI by or on behalf of the judiciary must be consistent with the judiciary's overarching obligation to protect the integrity of the administration of justice. This gu
- [Artificial Intelligence (AI) Judicial Guidance (October 2025)](https://www.judiciary.uk/guidance-and-resources/artificial-intelligence-ai-judicial-guidance-october-2025/) T1 · retrieved · retrieved 8 Oct 2026 · Foreword by Lord Justice BirssThe use of AI by the judiciary must be consistent with its overarching obligation to protect the integrity of the administration of justice and uphold the rule of law.

- The document is judicial guidance for office holders and does not create statutory duties.Confidence: Probable · As of 31 Oct 2025 · evidencedEvidence and sources[Artificial Intelligence (AI) Guidance for Judicial Office Holders (31 October 2025)](https://www.judiciary.uk/wp-content/uploads/2025/10/Artificial-Intelligence-AI-Guidance-for-Judicial-Office-Holders-2.pdf) T1 · retrieved · retrieved 8 Oct 2026 · Section 1, IntroductionAny use of AI by or on behalf of the judiciary must be consistent with the judiciary's overarching obligation to protect the integrity of the administration of justice. This gu

- DSIT published the AI Risk Management Toolkit on 8 September 2026 to help AI project teams understand, assess and manage risks when designing, procuring or delivering AI products.Confidence: Confirmed · As of 8 Sep 2026 · evidencedEvidence and sources[AI Risk Management Toolkit (DSIT)](https://www.gov.uk/government/publications/ai-risk-management-toolkit) T1 · retrieved · retrieved 8 Oct 2026 · Page summaryGuidance to help anyone involved in AI projects understand, assess and manage risks when designing, procuring or delivering AI products.
- [AI Risk Management Toolkit: guidance (DSIT)](https://www.gov.uk/government/publications/ai-risk-management-toolkit/ai-risk-management-toolkit-guidance) T1 · retrieved · retrieved 8 Oct 2026 · Guidance introductionThe AI Risk Management Toolkit is intended as a starting point for teams looking to implement good risk management practices.

- The Ministry of Justice's AI Action Plan for Justice one-year-on update, published 24 September 2026, adds a fourth strategic priority to strengthen the response to emerging AI risks.Confidence: Probable · As of 24 Sep 2026 · evidencedEvidence and sources[AI action plan for justice: one year on (Ministry of Justice)](https://www.gov.uk/government/publications/ai-action-plan-for-justice-one-year-on/ai-action-plan-for-justice-one-year-on) T1 · retrieved · retrieved 8 Oct 2026 · Introductiona new strategic priority to strengthen our response to emerging AI risks.

- The FCA-commissioned Mills Review, published 6 July 2026, sets out seven recommendations for the FCA Board and Executive, including adapting the regulatory perimeter and monitoring the transition to autonomous models.Confidence: Probable · As of 6 Jul 2026 · evidencedEvidence and sources[FCA publishes landmark review into impact of AI on retail financial services](https://www.fca.org.uk/news/press-releases/fca-publishes-landmark-review-impact-ai-retail-financial-services) T1 · retrieved · retrieved 8 Oct 2026 · Key recommendationsThe Mills Review also outlines 7 recommendations for the FCA Board and Executive to consider, which are as follows:

- The Bank of England told the Treasury Committee, in a letter dated 1 April 2026, that it does not agree it is taking a 'wait and see' approach to AI in financial services, and that it agrees stress testing and scenario analysis are valuable tools for understanding AI risks.Confidence: Probable · As of 1 Apr 2026 · evidencedEvidence and sources[Bank of England letter: Response to TSC inquiry report on AI in financial services](https://www.bankofengland.co.uk/-/media/boe/files/letter/2026/response-to-tsc-inquiry-report-on-ai-in-financial-services) T1 · retrieved · retrieved 8 Oct 2026 · Letter, general responsewe do not agree with the TSC's characterisation that the Bank is taking a 'wait and see' approach to the use of AI in financial services. The Bank (including the PRA) i
- [Bank of England letter: Response to TSC inquiry report on AI in financial services](https://www.bankofengland.co.uk/-/media/boe/files/letter/2026/response-to-tsc-inquiry-report-on-ai-in-financial-services) T1 · retrieved · retrieved 8 Oct 2026 · Letter, response to recommendation on stress testingfor AI-driven market shocks, the Bank of England and the Financial Conduct Authority must conduct AI-specific stress testing. As noted in

Open evidence