In the UK, AI rules are applied by the regulators that already oversee the sector concerned, under existing law and regulator guidance, rather than by a single AI regulator. The Information Commissioner oversees data protection, the Financial Conduct Authority oversees financial services, the Medicines and Healthcare products Regulatory Agency oversees medical devices, Ofcom oversees online safety and communications, the Competition and Markets Authority oversees competition and consumer protection, and the Equality and Human Rights Commission oversees equality. Each regulator has published, or is publishing, its own approach to AI within its remit, and each approach must be checked on that regulator site. This guide gives the remits in outline and does not reproduce any regulator guidance.
What does the Information Commissioner do for AI?
The Information Commissioner, or ICO, is the UK data protection regulator. Its AI work is centred on UK GDPR and the Data Protection Act 2018, including fairness, transparency, data minimisation, purpose limitation, security, data subject rights, data protection impact assessments and automated decision making. The ICO has published guidance on AI and data protection, including guidance on automated decision making, and it consulted on draft automated decision making guidance in 2026 after the Data (Use and Access) Act 2025 changed the automated decision provisions. A UK organisation that uses AI to process personal data should check the current ICO guidance for its use, including the guidance on AI, on automated decision making, on data protection impact assessments and on the lawful basis for processing. The ICO guidance is not a statute, but it shows how the regulator will interpret and enforce the law, and it should be treated as the primary checking route for data protection questions. The ICO also participates in the Digital Regulation Cooperation Forum, which coordinates the digital regulators, and its AI work should be read alongside the work of the other regulators where a use crosses remits.
What do the FCA and MHRA do for AI?
The Financial Conduct Authority, or FCA, oversees financial services in the UK, including the use of AI in lending, insurance, advice, trading and customer service. Its AI work is framed through existing financial services duties, including the Consumer Duty, governance, risk management, model risk and fair treatment of customers, rather than through a standalone AI rulebook. A financial firm that uses AI should check the FCA approach, the Prudential Regulation Authority material where relevant, and the sector guidance on model risk and on outsourcing. The Medicines and Healthcare products Regulatory Agency, or MHRA, oversees medical devices in the UK, including software as a medical device and AI as a medical device. Its AI work is framed through the medical device framework, including the UK medical device regulations, the MHRA guidance on software and AI as a medical device, and the change control and post market surveillance arrangements for devices. A manufacturer or deployer of a medical AI product in the UK should check the current MHRA guidance and the device regulations, and should not assume that EU device or AI Act compliance satisfies UK device duties. Each regulator guidance must be checked on its own site, on the date of the decision.
For the broader regulatory framework, see non-EU and international overview.
What do Ofcom, the CMA and the EHRC do for AI?
Ofcom oversees online safety and communications in the UK, including the Online Safety Act 2023 duties for regulated services, the use of AI in content moderation, recommender systems and safety measures, and the communications and broadcasting remits that can touch AI uses. A provider of a regulated online service should check the Ofcom codes, guidance and enforcement approach for AI related safety duties. The Competition and Markets Authority, or CMA, oversees competition and consumer protection, including the use of AI in pricing, in recommender systems, in foundation model markets and in consumer facing practices. Its AI work includes market studies, guidance on consumer protection and competition enforcement, and it should be checked where AI affects markets or consumers. The Equality and Human Rights Commission, or EHRC, oversees equality law, including the Equality Act 2010 duties that can be engaged where AI systems discriminate or produce discriminatory outcomes in employment, services or education. An organisation that uses AI to make decisions about people should check the EHRC guidance and the equality duties alongside the data protection and sector duties. The three regulators illustrate the breadth of UK AI oversight: no single regulator covers every AI use, and a use that crosses sectors can engage several regulators at once.
How do regulators coordinate?
The main digital regulators coordinate through the Digital Regulation Cooperation Forum, which brings together the ICO, Ofcom, the CMA and the FCA to coordinate on digital regulation, including AI. Coordination does not create a single AI regulator, and it does not merge the legal bases or the enforcement powers of the participating regulators. A company that is regulated by more than one regulator should engage with each regulator on the matters within its remit, and should not assume that engagement with one regulator satisfies another. Coordination can help where a use raises cross cutting questions, for example where a recommender system raises data protection, competition and online safety questions at the same time, but the company must still meet each regulator duties separately. The Forum publications and the individual regulator publications should both be checked, with the individual regulator guidance taking the lead for the specific duty. A record of regulator engagement should state the regulator, the contact, the date, the question asked and the answer received, so that the engagement can be followed up and evidenced.
What guidance should a UK company check first?
A UK company should check guidance in the order of its activity. It should start with the regulator that oversees its sector, then check the ICO guidance where personal data is processed, then check the equality, consumer and competition guidance where decisions about people, markets or consumers are involved. It should check the government policy documents, including the 2023 White Paper, the government response and the October 2025 Blueprint, for the policy direction, and should check the parliamentary record for any legislation that has been introduced. It should check the regulator sites on the date of the decision, because guidance is updated, consultations open and close, and enforcement positions develop. It should record the guidance checked, the version and the date, in the same way as it records the legal text checked for the AI Act. A company that relies on a summary of regulator guidance, without checking the guidance itself, will miss the conditions, the examples and the limits that the regulator has set out. Regulator guidance is the checking route for UK AI questions in the same way that the consolidated AI Act text is the checking route for EU questions.
Continue with UK AI regulation and no AI Act.
What does this guide not decide?
This guide does not decide whether any named UK activity is lawful, does not reproduce any regulator guidance, and does not state the current position of any regulator beyond the remit outline that must be rechecked. Regulator remits, guidance and enforcement priorities change, and the position must be checked on each regulator site on the date of the decision. A UK company with a specific activity should obtain UK legal advice and, where appropriate, engage with the relevant regulator through its published channels. This guide explains the regulator map, not the outcome for a named activity.
Frequently asked questions
Is there a single UK AI regulator to contact?
No. There is no dedicated AI regulator in the UK. A company should contact the regulator that oversees its sector and activity, and the ICO where personal data is processed. The Digital Regulation Cooperation Forum coordinates the digital regulators, but it does not replace them or merge their powers.
Does ICO guidance have the force of law?
No. ICO guidance shows how the regulator interprets and will enforce data protection law, but the law itself is in UK GDPR and the Data Protection Act 2018 as amended. Guidance should be checked on the ICO site, with the statute and any case law, and specific questions should be confirmed with a legal adviser.
Do financial and medical AI have separate UK rules?
They have separate sector frameworks. Financial AI is governed through FCA and PRA duties including Consumer Duty and model risk, and medical AI is governed through the MHRA device framework. Each framework must be checked on its regulator site, and EU compliance does not by itself satisfy UK sector duties.
Should a UK company check equality law for AI decisions?
Yes, where AI is used to make decisions about people. The Equality Act 2010 and EHRC guidance can be engaged where AI produces discriminatory outcomes in employment, services or education. Equality, data protection and sector duties should be checked together for decision making systems.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗