UK AI Regulation: What the ICO and Other Regulators Expect Today
By Jora Gill · · 6 min read
The UK has chosen not to pass a single AI law like the EU's. That does not mean AI is unregulated. Existing regulators apply existing laws to it, and they expect organisations to show their AI is safe, fair and accountable.
The UK approach
The government's approach asks sector regulators to apply five principles to AI within their existing powers: safety, security and robustness; transparency and explainability; fairness; accountability and governance; and contestability and redress.
Data protection: the ICO
If your AI processes personal data, UK GDPR applies. The ICO expects a data protection impact assessment for high-risk processing, fairness and transparency towards the people affected, and safeguards where significant decisions are automated. The Data (Use and Access) Act 2025 reformed the rules on automated decision-making, so check the ICO's current guidance rather than older advice.
Sector regulators
- FCA: firms remain responsible for outcomes under existing rules, including the Consumer Duty, whatever technology they use.
- CMA: AI that misleads consumers or distorts competition is covered by consumer and competition law.
- Equality law: the Equality Act 2010 applies to decisions made by systems as well as people.
What evidence to keep
- An inventory of AI systems, with owners and purposes.
- Impact assessments for systems that use personal data or affect people's outcomes.
- Test results for accuracy, security and fairness, repeated after changes.
- Records of human oversight and how people can challenge decisions.
None of this is new. What is new is that regulators now expect it for AI specifically, and they expect it to be evidence rather than intent.
Find out what your AI will get wrong, before anyone else does.
FireBreak independently tests AI for security, reliability, fairness and governance. We never assess systems we built, and we never sell fixes for what we find.