AI governance has moved from a theoretical discussion topic to a mandatory compliance requirement. The EU AI Act has been progressively coming into force since early 2025, the UK is developing its own principles-based regulatory approach, and international standards such as ISO/IEC 42001 provide certifiable frameworks for responsible AI management. If your business uses AI — whether building models from scratch, deploying third-party AI tools, or automating decisions — governance is now inseparable from compliance.
This guide covers the current state of AI regulation affecting UK businesses, the specific obligations that apply, and the practical steps organisations should take to establish a defensible AI governance programme.
The EU AI Act: What UK Businesses Need to Know
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It adopts a risk-based approach, classifying AI systems into four categories with escalating obligations:
- Unacceptable risk — AI systems that pose a clear threat to safety, livelihoods, or rights are banned. This includes social scoring systems, real-time biometric surveillance in public spaces (with limited exceptions), and AI systems that exploit vulnerabilities of specific groups. Prohibitions have been in effect since February 2025.
- High risk — AI systems that pose significant risk to health, safety, or fundamental rights face the most extensive obligations. This category includes AI used in critical infrastructure, education, employment, essential services, law enforcement, migration, and justice administration. High-risk AI systems must comply with requirements covering risk management, data governance, transparency, human oversight, accuracy, and robustness. Organisations deploying high-risk AI must also conduct a fundamental rights impact assessment.
- Limited risk — AI systems that interact with humans (such as chatbots) or generate content (such as deepfakes) have transparency obligations. Users must be informed they are interacting with an AI system, and AI-generated content must be labelled.
- Minimal risk — AI systems in the lowest risk tier (such as AI-enabled spam filters or AI-powered games) are not subject to specific obligations under the Act, though general safety and data protection laws still apply.
Does the EU AI Act apply to UK businesses? Yes — in the same way that EU GDPR applied to UK businesses before the UK's post-Brexit adequacy decision. The Act has extraterritorial effect: it applies to any organisation that deploys AI systems in the EU, or whose AI systems affect individuals located in the EU. A UK-based SaaS company whose AI-powered recruitment tool is used by an EU-based client is in scope. A UK healthcare technology company whose AI diagnostic system processes data from EU patients is in scope. UK businesses serving EU markets must comply with the EU AI Act — it is not optional.
Compliance Timeline
The EU AI Act is being phased in over a staggered timeline:
- February 2025 — prohibitions on unacceptable risk AI systems took effect
- August 2025 — rules for general-purpose AI models (such as foundation models and large language models) became applicable, including transparency, copyright, and risk mitigation obligations
- August 2026 — the majority of obligations for high-risk AI systems will apply, including compliance with Annex III requirements
- August 2027 — the full framework will be enforceable, including obligations for high-risk AI systems listed in Annex I (existing regulated products)
The August 2026 deadline is the most immediately relevant for most UK businesses. If your AI system could be classified as high-risk under Annex III, you have until August 2026 to achieve compliance. Our consultants estimate that a typical high-risk AI compliance programme requires 6–12 months of preparation, meaning organisations should start now if they have not already.
UK AI Regulation: A Different Path
The UK has taken a different approach from the EU, opting for a principles-based, sector-led regulatory model rather than a single AI Act. The key elements of the UK's AI regulatory framework in 2026 include:
- Sector regulators lead — the ICO (data protection), Ofcom (communications), the FCA (financial services), the MHRA (medical devices), the Equality and Human Rights Commission (discrimination), and the Competition and Markets Authority (competition) each have responsibility for AI oversight within their existing remits. There is no single AI regulator.
- Five cross-cutting principles — the government's AI White Paper established five principles that all regulators must consider: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.
- The Data (Use and Access) Act 2025 — this Act includes provisions relevant to AI governance, including enabling digital verification services and creating a framework for Smart Data schemes. It also strengthens the Information Commission's ability to regulate AI from a data protection perspective.
- Existing laws apply — AI systems operating in the UK are subject to existing legislation, including UK GDPR, the Data Protection Act 2018, the Equality Act 2010, the Consumer Protection from Unfair Trading Regulations, and sector-specific regulations. There is no "AI exemption" from any existing law.
The UK government has indicated it will issue a formal AI Regulation Bill when parliamentary time allows, though no specific timeline has been confirmed as of mid-2026. In the meantime, organisations should comply with applicable sector regulations and existing laws, as the ICO, FCA, and other regulators are actively enforcing against AI-related harms within their existing powers.
ISO/IEC 42001: The AI Management System Standard
ISO/IEC 42001 provides a certifiable framework for AI management systems. Like ISO 27001 for information security, it establishes requirements for AI governance, risk management, and continuous improvement. The standard covers:
- AI governance — establishing policies, responsibilities, and oversight for AI systems
- Risk management — identifying, assessing, and treating AI-specific risks, including bias, fairness, safety, transparency, and security
- AI system lifecycle — requirements spanning data acquisition, model development, testing, deployment, monitoring, and decommissioning
- Impact assessment — evaluating the potential impacts of AI systems on individuals, society, and the environment
- Documentation and transparency — maintaining records of AI system purpose, data sources, model architecture, testing results, and performance metrics
Early adopters are already pursuing ISO/IEC 42001 certification. Organisations that already have ISO 27001 will find significant structural alignment between the two standards, making the transition to ISO/IEC 42001 more manageable. Certification is becoming a differentiator in procurement processes, particularly for AI vendors selling into regulated sectors.
Practical Steps for UK Businesses
- Inventory your AI systems — conduct a comprehensive audit of all AI and ML systems used across the organisation, including third-party AI tools embedded in SaaS products, code assistance tools, and generative AI platforms used by employees. Many organisations are surprised at the extent of AI use they discover.
- Classify by risk — map each AI system against the EU AI Act risk categories (particularly if serving EU markets) and the UK's five cross-cutting principles. Pay particular attention to AI systems involved in employment decisions, creditworthiness assessments, customer communications, and access to essential services.
- Document AI use — maintain a record of each AI system's purpose, data sources, training methodology, known limitations, and the controls in place to ensure responsible operation. This documentation is essential for demonstrating compliance under both the EU AI Act and UK frameworks.
- Update privacy notices — the ICO's guidance on AI and data protection requires organisations to inform individuals when they are interacting with an AI system or when AI is used to make or significantly inform decisions about them.
- Implement human oversight — for high-risk AI systems, ensure meaningful human oversight is designed into the process. This means a human reviewer has the authority and capability to override or challenge AI-generated outcomes.
- Establish an AI governance framework — define policies, assign responsibilities, create a risk assessment process, and establish monitoring and reporting mechanisms. ISO/IEC 42001 provides a structured framework for this.
- Train your team — employees who develop, deploy, or use AI systems need appropriate training on AI ethics, bias detection, regulatory obligations, and the organisation's AI governance policies.
Common Pitfalls
- Assuming UK non-EU status means exemption — UK businesses serving EU markets, processing EU data, or using AI systems whose outputs affect EU individuals are within scope of the EU AI Act.
- Overlooking third-party AI — an AI tool embedded in your CRM, HR platform, or analytics suite is still "your" AI from a regulatory perspective if it processes your data or makes decisions affecting your customers or employees. You need to understand how your vendors have governed their AI.
- Treating AI compliance as a one-off project — AI systems evolve through retraining, fine-tuning, and deployment changes. Governance must be continuous, with periodic reviews and updates.
How Our Consultants Support AI Governance
Our team delivers AI governance work covering EU AI Act compliance assessment, ISO/IEC 42001 readiness, AI risk assessment frameworks, AI policy development, and board-level AI governance reporting. Combined with our fractional vCISO service, we help organisations integrate AI governance into their broader information security and compliance programmes.