UK AI Compliance
Resources for people who build, sell, audit or run AI systems in the United Kingdom. The pages map UK laws, guidance and standards to the wiki's control library. The GCC and EU sections cover their regions in more depth and hold the general templates.
Verification required. Everything in this section about UK law was compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read. Article, clause and section numbers are left blank unless a source showed them; fill them in from the primary text. Check the primary text before relying on any claim. This is not legal advice.
The UK's position in one line
The UK has no AI Act. AI is governed through existing law and sector regulators under a principles-based approach. UK GDPR, as amended by the Data (Use and Access) Act 2025, does most of the binding work [Reported].
What is in this section
| Page | For | What it holds |
|---|---|---|
| UK AI Regulatory Hub | Everyone | Instrument register, timeline, categories and roles, mapping to wiki controls, wiki coverage, verification checklist and sources |
| UK: Role Guide | Practitioners, product companies, auditors, implementors | One guide with a part for each role |
| UK-T1 | All | Automated decision-making safeguards record |
| UK-T2 | FCA and PRA regulated firms | Regulated-firm AI checklist |
| UK-T3 | Public bodies | Public-sector algorithmic transparency record |
| UK Regulatory Crosswalk | GRC tooling | Instrument-to-control map with verification status, also as a CSV file |
How claims are tagged
| Tag | Meaning |
|---|---|
| [Reported] | Stated by secondary web sources found on 7 October 2026 (law-firm notes, vendor blogs, research notes). Not read in the primary text. |
| [Recalled] | Stated from memory of the law or guidance and not re-checked. Verify before citing it. |
| [Conflict] | Secondary sources disagree. Resolve from the primary text. |
| [Unverified] | Single source, marketing-grade source, or not researched. |
The templates are working documents, not regulator-approved forms.
Common templates to reuse
The GCC and EU sections contain working templates that are not tied to a region. Reuse them and adapt the regional lines.
| Need | Reuse | Adapt |
|---|---|---|
| System intake and tiering | GCC T01 or EU T01 | Replace the tier names with this region's categories (section 3 of the hub) |
| Inventory | GCC T09 or EU T09 | Add the regional columns listed in this section's templates |
| Audit checklist | GCC T08 or EU T08 | Replace the criteria with this region's instruments |
| Supplier due diligence | GCC T03 or EU T03 | Replace the regional questions |
| Incident workflow | GCC T05 or EU T05 | Fill in this region's authority matrix |
| Bias testing record | GCC T10 | Use as it is |
| Risk register | GCC T12 | Use as it is |
Keeping this section current
Re-check every quarter: commencement of the Data (Use and Access) Act changes, updates to ICO guidance, and any government announcement of an AI bill.