No AI Act: how the UK actually regulates AI
The UK deliberately chose not to copy the EU's single-statute model. Instead of one AI law, organisations navigate five overlapping regimes:
- UK GDPR and the Data Protection Act 2018, enforced by the ICO — the anchor whenever AI touches personal data, from training to inference;
- The Data (Use and Access) Act 2025 (DUAA), which rewrote the rules on automated decision-making (more on that below);
- Cross-sector AI principles — safety, transparency, fairness, accountability, contestability — applied by existing regulators rather than a new AI authority;
- Sector rules: FCA expectations (including Consumer Duty) for financial services, MHRA for medical devices, SRA for legal services, EHRC for equality impacts;
- The EU AI Act, which reaches UK firms through its extraterritorial scope.
Priority sectors flagged for regulatory sandboxes through 2026–2027 include healthcare, professional services, transport and advanced manufacturing. The signal is consistent: no comprehensive statute is coming — the compliance work happens inside these existing frameworks, and the ICO's AI guidance hub at ico.org.uk is the reference to bookmark.
What's moving in 2026: DUAA, the ICO code and ADM guidance
Three developments define the 2026 compliance agenda for anyone automating decisions:
DUAA 2025 rewrote the ADM rules
Solely automated significant decisions are no longer prohibited by default for most personal data — but only lawful with safeguards: informing people, enabling representations, providing meaningful human intervention and a route to contest. Stricter limits remain for special category data.
A statutory ICO code of practice on AI
Regulations now place the Information Commissioner under a duty to prepare a code covering the development and use of AI, with a mandatory children's-data component. The code is still being drafted — but its direction follows existing ICO AI guidance.
Updated ICO guidance on ADM and profiling
The ICO consulted on updated automated-decision-making guidance between 31 March and 29 May 2026; final guidance is expected over the summer. If your workflows score, rank or route people, this is the document to align with.
Build for safeguards, not for a statute
Whatever final wording lands, the safeguards are stable: tell people, let them respond, keep a human able to intervene, and keep evidence. Processes designed around those four verbs won't need redesigning.
Note the philosophical difference from the EU: the UK regime attaches duties to decisions and data, not to a risk classification of the AI system itself. That makes your process design — where automation ends and human judgement begins — the primary compliance artefact.
Brexit didn't opt you out: the EU AI Act's reach
The EU AI Act applies extraterritorially: it covers providers placing AI systems on the EU market and cases where the output of an AI system is used in the EU — wherever the operator sits. For a UK company that means:
- Selling AI-enabled products or services into the EU brings provider or deployer duties under the Act;
- Running workflows whose AI-driven decisions affect people in the EU — an EU subsidiary's hiring pipeline, credit decisions for EU customers — pulls those processes into scope;
- The key milestone is 2 August 2026, when the bulk of the high-risk obligations becomes applicable. We unpack them in our EU AI Act and process automation guide.
The efficient strategy is one governance layer serving both regimes. The EU asks for human oversight, logging and transparency on high-risk systems; the UK asks for meaningful human involvement, contestability and evidence on significant decisions. Build the stricter superset once, and both boxes tick.
Turning UK requirements into governed workflows
Reread the safeguards above: inform, allow representations, human intervention, contestability, evidence. These are process properties — and a low-code BPM with governed AI agents builds them into the flow natively:
| UK requirement | Dokuflex answer (BPM) |
|---|---|
| Meaningful human intervention | Human-in-the-loop approval tasks at the decision points that matter: the AI scores and recommends, a named approver decides, and the decision is timestamped. |
| Contestability and representations | Appeal and review steps are just workflow branches: a contested outcome re-enters the process with a different reviewer, and the full history travels with it. |
| Transparency | A per-process inventory of where AI intervenes, with purpose and role — the always-current source for privacy notices and DPIA updates. |
| Accountability and evidence | A complete audit trail: flow version, AI suggestion, human correction, approver — exactly what an ICO enquiry or an FCA review asks to see. |
| Data protection by design | Each process declares the data it uses and why; LLM and RAG run governed on your own document base, with data residency under your control. |
And because the UK framework will keep evolving guidance-first — the ICO code, sector sandboxes, updated ADM guidance — the low-code advantage compounds: adding a review step or a notice to an existing flow is a visual change, not an IT project. The same logic underpins good workflow automation generally.
A 6-step readiness checklist
Before the ICO's final ADM guidance and code arrive — and before 2 August 2026 if you trade with the EU — check your position:
- Inventory your AI systems. Including features embedded in SaaS, HR, CRM and finance tools: if they influence decisions about people, they're in scope.
- Classify your decisions. Which are "significant" in DUAA terms? Which touch special category data? Which affect people in the EU? Document the conclusions.
- Design the human role. Place approval tasks with named, trained reviewers where decisions are significant — intervention must be meaningful, not a rubber stamp.
- Wire up contestability. Give people a route to challenge automated outcomes and make the review path an explicit workflow branch.
- Keep evidence. Audit trails, flow versions, AI suggestions and human overrides — retention here is what turns a regulator letter into a short conversation.
- Update notices and DPIAs. Align privacy information with what your flows actually do, and refresh DPIAs where AI changes the risk picture.
Frequently asked questions
Is there a UK AI Act? +
No. Unlike the EU — and unlike Italy, which passed a national AI law in 2025 — the UK has chosen a principles-based, sector-led approach with no single AI statute. AI use is governed through existing regimes, led by UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, applied by existing regulators such as the ICO, the FCA and the MHRA under cross-sector AI principles.
What did the Data (Use and Access) Act 2025 change for automated decisions? +
The DUAA reshaped the UK rules on automated decision-making. Significant decisions based solely on automated processing are no longer prohibited by default for most personal data, but they are only lawful with safeguards: telling people a decision was automated, enabling them to make representations, and providing meaningful human intervention and the ability to contest the outcome. Stricter limits remain for special category data. The ICO consulted on updated ADM and profiling guidance in spring 2026, with final guidance expected over the summer.
What is the ICO's statutory AI code of practice? +
Regulations that came into force on 12 May 2026 place the Information Commissioner under a statutory duty to prepare a code of practice covering both the development and the use of AI, including a mandatory component on children's data. The code itself is still being prepared, but its direction is clear from the ICO's existing AI and data protection guidance: accountability, transparency, fairness, and meaningful human review of significant automated decisions.
Does the EU AI Act apply to UK companies? +
Often, yes. The EU AI Act has extraterritorial scope: it applies to providers placing AI systems on the EU market and to situations where the output of an AI system is used in the EU, regardless of where the operator is established. A UK company serving EU customers or running workflows whose AI-driven decisions affect people in the EU should therefore track the AI Act's milestones — most notably 2 August 2026, when the bulk of the high-risk obligations become applicable.
Which regulators should a UK automation team watch? +
Five regimes overlap for most organisations: UK GDPR enforced by the ICO; the cross-sector AI principles applied by existing regulators; sector rules from bodies such as the FCA (including Consumer Duty expectations around AI), the MHRA for medical products, the SRA for legal services and the EHRC for equality impacts; the Data (Use and Access) Act 2025; and, for anyone trading with the EU, the EU AI Act. The practical answer is to build one governance layer — inventory, human review, logging — that serves all of them.
How does a BPM help with UK AI compliance? +
UK requirements converge on process properties: meaningful human involvement in significant decisions, the ability to explain and contest outcomes, documented purposes, and audit evidence. A governed low-code BPM builds these into the workflow: AI classifies, extracts and recommends, while named approvers take the decisions that matter; every step is logged in an audit trail; each process declares where AI intervenes and why; and data residency stays under your control. When the ICO's code lands, adjusting a flow is a visual change, not a software project.
Make AI compliance a property of your processes
Let's book a guided 60-minute session to inventory where AI intervenes in your workflows, flag the decisions needing meaningful human review, and see how Dokuflex's low-code BPM builds approvals, audit trails and contestability into the flow.