AIRiskAware
UK Sector Guides Europe
๐Ÿ‡ฌ๐Ÿ‡งICOFCACMAMHRAOfcomAISI

AI governance in the United Kingdom.

The UK chose a pro-innovation, sector-based approach instead of a comprehensive AI law. Six regulators with relevant powers, each applying their domain expertise to AI. Plus โ€” UK companies with EU customers still face the EU AI Act.

UK regulators with AI powers

Six regulators, each applying domain expertise โ€” not a single AI law.

ICO
Information Commissioner's Office
Focus: UK GDPR, automated decision-making, AI and data protection

Explaining Decisions Made with AI guidance; enforcement of UK GDPR Article 22 for automated decisions affecting individuals

FCA
Financial Conduct Authority
Focus: AI in financial services, Consumer Duty, algorithmic trading

Joint paper with BoE/PRA/PSR on AI in financial services; Consumer Duty outcomes framework applies to AI-driven products

CMA
Competition and Markets Authority
Focus: AI foundation models, algorithmic pricing, digital markets

Foundation model review 2023-24; ongoing work on algorithmic collusion and AI-enabled anti-competitive practices

MHRA
Medicines and Healthcare products Regulatory Agency
Focus: AI medical devices, Software as a Medical Device

AI medical devices regulation; Software and AI as a Medical Device guidance; UKCA marking for post-Brexit medical devices

Ofcom
Ofcom
Focus: AI in media, online safety, recommender systems

Online Safety Act implementation; AI-generated content moderation; algorithmic recommender system oversight

AISI
AI Safety Institute
Focus: Frontier AI safety evaluation, international cooperation

Evaluation of frontier AI systems; international AI safety cooperation through the Hiroshima AI Process and GPAI

UK AI governance articles

The post-Brexit complication: EU AI Act still applies

Brexit removed UK organisations from the EU's direct regulatory sphere โ€” but it did not remove them from the EU AI Act's extraterritorial reach. Any UK organisation whose AI affects EU citizens โ€” through products sold in the EU, services provided to EU customers, or AI systems that process EU personal data โ€” is within scope of the EU AI Act. UK financial institutions with European branches, UK technology companies with European customers, and UK software companies whose AI is used by EU organisations all face EU AI Act obligations in addition to UK regulatory expectations. The practical result is that many UK organisations need to manage two parallel AI governance frameworks: UK GDPR and sector regulators for domestic activities, EU AI Act for EU-facing activities.

Stay ahead of AI governance

Regulatory updates, practical frameworks, and analysis. No spam, unsubscribe anytime.

No spam. Unsubscribe anytime. We'll never share your email.