AI Regulation UK 2026: What’s Changing and How to Prepare

AI regulation has moved from theory into phased application. For UK businesses, the most significant development is the EU AI Act, which applies extraterritorially, meaning it can reach a UK business that has no EU establishment. Whether it reaches yours depends on your AI use and your EU exposure.

Here’s what’s changing and how to prepare.

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive AI law. It was passed in 2024 and sets binding rules for how AI can be developed, deployed, and used across the EU and EEA.

The UK is not subject to EU law post-Brexit, but the AI Act’s extraterritorial provisions mean it applies to any business whose AI outputs are used inside the EU, or who places AI systems on the EU market. In practice, most UK businesses with EU customers, EU staff, or EU facing digital products are in scope.

The Act applies in stages rather than all at once. Where a stage has landed, it applies to businesses within the scope of the Act:

• Since 2 February 2025, the prohibited practice rules and the Article 4 AI literacy duty have applied.
• Since 2 August 2025, the rules for general purpose AI model providers have applied.
• Since 2 August 2026, Article 50 transparency duties have applied to specified AI interactions and content. The exact disclosure duty depends on the system, the content and whether the business is acting as provider or deployer; it is not a blanket rule requiring every AI assisted output to be labelled.
• From 2 December 2027, Annex III high-risk obligations apply, covering uses such as recruitment, credit and essential services.
• From 2 August 2028, Annex I high-risk obligations apply to AI built into regulated products.
• Fines can reach €35 million or 7% of global turnover for prohibited practices, with lower ceilings for other breaches.

The UK government has taken a lighter-touch, pro-innovation approach to AI regulation. Rather than passing its own equivalent of the EU AI Act, the UK has issued guidance through existing regulators, the ICO, FCA, EHRC, and CMA, and published a voluntary AI Code of Practice.

This means UK businesses currently face no equivalent domestic AI law. However, if you serve EU customers, the EU AI Act still applies to you regardless.

1. Step 1: Establish your risk tier. Understand whether your use of AI falls into minimal, limited, high-risk, or prohibited categories under the Act.
2. Step 2: Document your AI use. Where the Act applies to you, an AI Acceptable Use Policy and evidence of staff AI literacy are the baseline, and both are sensible governance for any business using AI.
3. Step 3: Get sector specific advice. If you operate in recruitment, healthcare, finance, or education, your obligations are significantly more extensive.
4. Step 4, get your pack in place. Every pack includes a Year 1 Annual Update Subscription, with your first renewal at 50% off, so when guidance changes your documents are updated for you.

Not sure where to start? Our free compliance risk check tells you exactly what you need in under two minutes at clausely.co.uk/compliance-checker.

Ready to put your governance documentation in place? Our tailored packs are generated within the hour, ready for your review and implementation. See our compliance packs at clausely.co.uk/pricing.