UK Regulatory Crosswalk
Verification required. Claims on this page about UK law were compiled on 7 October 2026 from secondary web sources and from memory of the law. No primary legal text was read, and each claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text before relying on any of them. This is not legal advice.
One row per instrument in the UK AI Regulatory Hub, with the wiki controls that relate to it and its verification status. The last column is empty until a row has been confirmed against the primary text; record the primary URL and the date you retrieved it there.
The same data is available as a CSV file for GRC tooling: crosswalk.csv.
Legal force sorts each row under one of seven labels, so that law is not mistaken for guidance or for a voluntary framework. The label is this wiki's reading of the sources and carries the same verification caveat as the rest of the row.
| Label | Meaning |
|---|---|
| Binding law | Enacted law or regulation that applies generally in the jurisdiction, including provisions that start on a later date. |
| Binding in scope | Binding only on a sector, a free zone, a state or province, or public bodies. |
| Guidance | Published by a government or regulator, and not binding in itself. |
| Voluntary | A standard, code or framework that an organization chooses to adopt. |
| Proposed | A bill, draft or consultation, or a proposal that lapsed. It is not law. |
| Context | A policy, authority, programme or summary row that sets no rule. |
| Unclear | The sources used do not settle whether it binds. |
| ID | Instrument | Legal force | Type / status | Wiki controls | Verification tag | To verify | Primary URL and retrieval date |
|---|---|---|---|---|---|---|---|
| UK1 | UK approach: five principles (safety and robustness; transparency; fairness; accountability; contestability and redress) | Guidance | Non-statutory; from the March 2023 White Paper | AI-CTRL-012; AI-CTRL-039; AI-CTRL-041 | Reported | Current government position; source says 'as of 2025' | |
| UK2 | UK GDPR and Data Protection Act 2018 | Binding law | Binding | AI-CTRL-013; AI-CTRL-007; AI-CTRL-017; AI-CTRL-035 | Recalled | Articles | |
| UK3 | Data (Use and Access) Act 2025: new Arts 22A to 22D | Binding law | Binding; commencement dates unverified | AI-CTRL-013; AI-CTRL-023; AI-CTRL-041 | Reported | Commencement; ICO guidance | |
| UK4 | ICO guidance on AI and data protection | Guidance | Regulator guidance | AI-CTRL-013; AI-CTRL-041 | Recalled | Current versions; any AI and biometrics strategy | |
| UK5 | FCA approach (principles, Consumer Duty, SM&CR) | Binding in scope | Regulatory framework | AI-CTRL-012; AI-CTRL-023; AI-CTRL-037 | Recalled | Current FCA statements | |
| UK6 | PRA SS1/23 model risk management | Guidance | Supervisory statement for banks | AI-CTRL-011; AI-CTRL-037; AI-CTRL-038 | Recalled | Applicability and date | |
| UK7 | CMA and Ofcom roles (competition; online safety) | Context | Regulators | AI-CTRL-039 | Reported | Scope for AI services | |
| UK8 | Copyright and AI training | Context | No statutory TDM exception; proposal reportedly abandoned | AI-CTRL-029 | Reported | Status; litigation | |
| UK9 | AI (Regulation) private member's bill | Proposed | Not law | None | Reported | Parliamentary status | |
| UK10 | NCSC and DSIT guidance on secure AI (guidelines for secure AI system development; AI cyber security code of practice) | Voluntary | Voluntary guidance | AI-CTRL-005; AI-CTRL-008 | Unverified | Existence, titles, standard status | |
| UK11 | Algorithmic Transparency Recording Standard | Unclear | Public-sector standard | AI-CTRL-039; AI-CTRL-011 | Recalled | Whether mandatory for your body | |
| UK12 | Equality Act 2010 | Binding law | Binding | AI-CTRL-041 | Recalled | Application to your use case |