AI governance

The UK has no law written for AI alone, but UK data protection law applies whenever AI uses personal data. We searched UK legislation by title and found no Act on artificial intelligence. UK regulations made in 2026 require the UK's data protection regulator, the ICO, to write a code of practice on AI.

The ICO's guidance says that almost all uses of AI with personal data need a data protection impact assessment, or DPIA. This guidance is under review because of changes made by the UK's Data (Use and Access) Act 2025.

Since 5 February 2026, new UK GDPR rules cover significant decisions made by computer with no meaningful human involvement. The person affected must get four safeguards.

About two in five UK businesses that handle digital data use AI, and fewer than one in five of those have an AI policy or guidelines. In a UK government survey, 41% of these businesses said they used AI in 2025 to 2026. Of those, 17% had a policy or guidelines, and 5% had a formal written one.

If you are writing your first one, this guide to AI policies sets out the four things it covers.

The EU AI Act can reach a business in the UK or the US, even one with no office in the EU. The Act covers a business outside the EU that offers AI in the EU, or whose AI produces output used there.

A provider builds the AI and offers it under its own name. A deployer uses it at work.

Most AI gets no new rules. The European Commission says most AI now used in the EU, such as spam filters, is in its lowest risk group. The strict duties are for high-risk AI, such as software that sorts CVs for hiring.

ISO/IEC 42001 is an international standard for managing AI in a business. A UKAS accredited certificate means an outside body, itself checked by UKAS, the UK's national accreditation body, has audited how you manage AI. In January 2026, UKAS said BSI was the first body it had accredited to certify businesses to this standard.

UKAS lists the bodies accredited for ISO/IEC 42001, and its free CertCheck tool checks UKAS accredited certificates.

The standard is not a law, so certifying is a choice. A customer or a tender may still ask for it. An accredited body that certifies you is not allowed to also advise you on meeting the standard.

Help to prepare, if you want it, comes from a different firm. For how the process runs, see getting certified. Which bodies are accredited, and what it costs, are in our guide to ISO/IEC 42001 certification.

Yes, the US has a voluntary framework for AI, the NIST AI Risk Management Framework. NIST, part of the US Department of Commerce, released it on 26 January 2023, and is now revising it as part of the White House AI Action Plan.

The EU AI Act can also cover a US business, under the same test as a UK business.