The UK AI governance landscape for small businesses
The UK has not passed a dedicated AI Act. Your obligations come from existing regulators — ICO (data protection), FCA (financial services), CMA (consumer protection). These are enforceable obligations, not aspirational standards.
UK GDPR: your core obligation
If your AI tools process personal data, UK GDPR applies regardless of your size. Key requirements: every AI use of personal data needs a documented lawful basis; your privacy policy must explain how AI uses personal data; data minimisation means AI tools should only receive data actually necessary; and if AI makes decisions that significantly affect individuals, you need to be able to provide an explanation and allow human review. The ICO's small business guidance at ico.org.uk provides practical templates.
Practical starting point
List every AI tool you use commercially. Identify which process personal data. Check your privacy policy covers these uses. Review whether AI-assisted decisions affect individuals in legally significant ways. Document your lawful basis for each AI use involving personal data. This AI register is what ICO investigators ask for first.
