AI laws in the UK are spread across several Acts rather than one. The UK has no comprehensive AI legislation and, as of November 2026, no AI bill before Parliament: the King’s Speech in May 2026 included none. Instead, the UK government relies on existing regulators applying their own rules to AI, and on targeted changes to laws on online safety, data and crime. Several of those changes, made in 2025 and 2026, were written with AI in mind.
This guide covers the rules most people need to know, each linked to its entry in our UK AI law tracker, where we record status, key dates and official sources.
AI laws in the UK: the short answer
- Everyone: in England and Wales, creating a sexual deepfake of a real adult without consent has been a crime since 6 February 2026, even if you never share it.
- App makers: in England and Wales, making or supplying “nudification” tools has been a crime since 29 June 2026.
- Platforms: the Online Safety Act requires you to tackle illegal content, including intimate-image deepfakes, protect children and remove reported intimate images within 48 hours.
- Organisations using AI for decisions: automated decisions are now broadly allowed, but people must be told and able to challenge them.
The UK model: a pro-innovation approach to AI regulation
Since 2023 the UK has said it will not create a single AI regulator. Instead, existing regulators, among them the Information Commissioner’s Office (data protection), Ofcom (online safety), the Medicines and Healthcare products Regulatory Agency (medical devices), the Financial Conduct Authority and the Competition and Markets Authority, apply their own rules to AI in their sectors. Several coordinate through the Digital Regulation Cooperation Forum. The government’s AI Security Institute tests advanced models but has no power to approve or block them.
The UK’s approach to artificial intelligence regulation comes from a white paper of March 2023, A pro-innovation approach to AI regulation, from DSIT, the Department for Science, Innovation and Technology. It set five principles to guide responsible AI development and use: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. None is set out in legislation. Each regulator applies the UK’s AI regulatory principles within its existing powers, and several have published guidance on AI.
Later AI policy has focused on AI growth. The AI Opportunities Action Plan is about AI adoption and AI innovation across the UK economy rather than new rules.
Under this regulatory approach, most AI questions in the UK are answered by asking which existing law applies: data protection for decisions about people, online safety for platforms, criminal law for abuse, and consumer and competition law for products. That is a different regulatory framework from the EU AI Act, which classifies AI systems by risk and sets detailed rules for high-risk AI.
Online Safety Act 2023
Ofcom has enforced duties on illegal content since March 2025 and on protecting children since 25 July 2025. Services where users share content and search services must assess the risk of illegal content and act to reduce it, and pornography providers must use strong age checks. Sharing intimate images without consent, including deepfakes, is a priority offence that services must work to prevent.
Generative AI chatbots are covered only in some cases: when they are part of a service where users share content, when they search across many sites or databases, or when they can generate pornography. A standalone chatbot that does none of these is currently outside the Act. In 2026 Parliament gave ministers a power to bring more AI chatbots into scope, but no regulations have been made yet.
In January 2026 Ofcom opened an investigation into X over sexual deepfakes generated with its Grok chatbot. News reports say Ofcom narrowed the investigation in October 2026; it had not announced an outcome as of 5 November 2026. Fines under the Act can reach £18 million or, if higher, 10% of qualifying worldwide revenue. Read the tracker entry.
Data (Use and Access) Act 2025 and data protection
This Act changed two things that matter for AI.
First, from 5 February 2026, it replaced Article 22 of the UK GDPR, which sits alongside the Data Protection Act 2018 and had restricted decisions made solely by automated means. This matters for any AI system that decides about people. Solely automated significant decisions are now generally allowed, as long as safeguards are in place: people must be told about the decision, be able to make representations, get human intervention and contest it. Stricter conditions apply where special category data, such as health information, is involved.
Second, from 6 February 2026, it became an offence in England and Wales to create, or ask someone else to create, a purported intimate image of another adult without consent. Before this, only sharing such images was a crime. Read the tracker entry.
Crime and Policing Act 2026
Since 29 June 2026 it has been an offence to make, adapt or supply a tool designed to generate intimate images of real people, with a maximum of three years in prison. The offence applies in England and Wales only. The same commencement brought in a duty to remove reported intimate images within 48 hours.
The Act also creates an offence of making, adapting, possessing or supplying AI models designed to generate child sexual abuse material, with a maximum of five years. That part has been passed but is not yet in force. Read the tracker entry.
Copyright and artificial intelligence
Whether AI companies may train on copyrighted work without permission has been one of the UK’s most heated AI debates. In March 2026 the government published its report on copyright and AI. It dropped an earlier proposal to let AI developers mine works unless rights holders opted out, backed no single option, and proposed no new legislation on AI training for now. For now, existing copyright law continues to apply to AI training and outputs.
What UK AI regulation means for you
Creators and everyday users
- Never make or share intimate images of a real person without consent: in England and Wales, making one is now a crime in itself.
- Avoid face-swap and “undress” apps: supplying them is illegal, and using them on real people can be too.
- Keep using platform AI labels for realistic synthetic content, even though UK law does not yet require them.
UK businesses
- If AI makes significant decisions about customers or staff without a human, tell them and give them a clear route to a person who can review it.
- Check your data protection impact assessments cover your use of AI.
- For basic AI governance, match each AI use case to its regulator and read that regulator’s practical guidance.
- If you sell abroad, check whether the EU AI Act also applies.
Platform owners
- Make sure your Online Safety Act risk assessments cover AI technologies, generated images and deepfakes.
- Make intimate images easy to report and remove them within 48 hours.
- Watch for new AI regulations that bring chatbots into scope.
Key dates
- 25 July 2025: Online Safety Act children’s safety duties apply.
- 5 and 6 February 2026: new automated-decision rules and the offence of creating intimate deepfakes take effect.
- 29 June 2026: the nudification-tool offence and 48-hour takedown duty take effect.
- Still to come: the offence covering AI child-abuse image generators, and any regulations bringing chatbots under the Online Safety Act.
Common questions about AI regulation in the UK
Is there a UK AI Act?
No. The UK has no general AI law, and the government did not announce one in the May 2026 King’s Speech. AI is covered by existing laws on data protection, online safety, consumer protection and crime, applied by the relevant regulators.
Do I have to label AI-generated content in the UK?
There is no general legal duty to label AI content in the UK. Platforms may require it under their own rules, and misleading people with AI content can still break consumer or advertising rules. Labelling realistic synthetic content is good practice.
Is it legal to use AI tools like ChatGPT at work?
Yes, but data protection laws still apply. Do not paste personal or confidential information into tools that may use it for training, and check your employer’s policy.
Who regulates AI in the UK?
No single body. Each of the UK regulators covers AI in its own area: the ICO for personal data, Ofcom for online services, the FCA for financial services, the CMA for competition and consumer law, and the MHRA for medical devices. The AI Security Institute tests advanced models for AI risks but is not a regulator.
Can the EU AI Act apply to a UK company?
It can. The EU AI Act covers providers that place AI systems on the EU market, and those whose AI output is used in the EU, wherever they are based. A UK company selling an AI product there should check its duties.
Last checked: 5 November 2026. This guide explains the law in plain English; it is not legal advice. Laws change quickly, so check the tracker entries and their official sources before you rely on them. Spotted an error? Tell us, and see how we check facts.
