The UK doesn't have
an AI law.
It has about a dozen.

Yes, extensively — just not by anything called an AI Act. The UK chose a pro-innovation, principles-based approach: no new statute and no new regulator, with five cross-cutting principles for existing regulators to apply in their own domains.

In practice your AI is reached by the UK GDPR and Data Protection Act 2018, the Equality Act 2010, the Online Safety Act 2023, consumer and product liability law, the Sexual Offences Act 2003 as amended, and whatever your sector regulator already expects. The regulation is real. It is just scattered, which is a different problem.

In England and Wales, yes — and since 6 February 2026 it has been an offence even if you never share the result. Section 138 of the Data (Use and Access) Act 2025 inserted new sections 66E to 66H into the Sexual Offences Act 2003, criminalising creating, or requesting the creation of, a purported intimate image of an adult without their consent or a reasonable belief in it.

Two features matter. The offence is complete at the request — you commit it by asking, whether or not an image is ever produced. And “purported” means it catches images that merely appear to depict a real, identifiable person, however synthetic the pixels are. Sharing or threatening to share was already an offence under sections 66A and 66B, inserted by the Online Safety Act 2023.

Using one to create a non-consensual intimate image of an adult is an offence. Supplying the tool is the subject of the Crime and Policing Bill, which would create a new offence aimed at companies providing tools designed to produce such images — targeting the problem at source rather than at the user.

At the time of writing that is a Bill, not an Act. A Bill creates no offences and binds nobody until Royal Assent and commencement. Check Parliament's Bills tracker rather than the announcement.

It bans the product rather than prosecuting the person. The Digital Omnibus adds AI systems generating non-consensual intimate imagery and child sexual abuse material to Article 5 of the AI Act — the list of prohibited practices — applying from 2 December 2026. It catches providers placing such systems on the market and deployers using them for those purposes.

That contrast is the whole difference in miniature. The UK amends criminal law and prosecutes an individual; the EU amends product regulation and removes the tool from the market. Same harm, two architectures — and if you operate in both, you are subject to both.

There is no government Bill for a comprehensive AI act, and the stated approach remains principles-based and regulator-led. Private members' bills have been introduced and have not progressed. Targeted intervention where a specific gap appears — as with deepfakes — has been the pattern, and it is a deliberate one.

Planning on the basis that a UK AI Act will arrive and tell you what to do is a poor bet. Planning on the basis that your existing regulator will ask you to evidence responsible AI is a very good one.

Frequently. Article 2 catches providers placing AI systems on the Union market or putting them into service there, irrespective of establishment — and, more sharply, providers and deployers outside the Union where the output produced by the system is used in the Union.

A UK company with no EU entity and no EU contract can be in scope because of where its output is read. Even outside direct scope, EU customers push the Act's requirements down their supply chains by contract, usually well before their own deadlines.

Article 22 governs decisions based solely on automated processing that produce legal or similarly significant effects. The Data (Use and Access) Act 2025 reworked this area substantially, easing the general prohibition for most data while keeping tighter controls for special category data, and putting weight on safeguards — meaningful information, human intervention, and the ability to contest.

Two practical points survive whatever the drafting. “Solely” is doing enormous work: a human who rubber-stamps is not meaningful intervention. And the ability to explain a decision is not optional just because your model is complex.

Yes, and this is the most underrated exposure in British AI law. The Equality Act 2010 does not care whether a human or a model made the decision, and indirect discrimination requires no intent at all — a neutral practice that puts a protected group at a disadvantage is unlawful unless it is a proportionate means of achieving a legitimate aim.

A model trained on historical decisions learns historical discrimination. Nobody has to have wanted that for it to be unlawful, “the algorithm did it” is not a defence, and discrimination awards in the employment tribunal are uncapped.

Whichever one already regulates you. That is the design, not an oversight. The ICO for anything touching personal data — which is nearly everything. Ofcom for online safety. The FCA and PRA in financial services, through the Consumer Duty and the Senior Managers regime rather than an AI rulebook. The MHRA where AI is a medical device. The EHRC for equality. Plus every sector regulator you already report to.

There is no AI regulator to ring and no single AI licence. This disorients people, and it is why the standards route matters so much in the UK.

They carry more weight here than in the EU, not less — which is counterintuitive until you see why. In the EU, Article 40 makes a harmonised standard a formal presumption of conformity with a statute. In the UK there is no statute to be presumed conformant with, so a standard becomes the only shared, checkable reference a regulator can accept and a buyer can test you against.

In practice that means ISO/IEC 42001. It is the certifiable AI management system standard, and it is the usual British answer to “prove your AI is governed”. Our ISO/IEC 42001 guide ›

Almost none, and the exception is instructive: the Automated Vehicles Act 2024, which builds an authorisation and liability regime around self-driving vehicles. It is narrow, sector-specific and product-shaped — much closer to the European style than anything else on the British statute book.

That is the pattern. Where the UK does legislate for AI, it legislates for one use of it, not for the technology.

legislation.gov.uk, free and authoritative. Two habits will save you: check commencement rather than Royal Assent, because a great deal of British legislation sits unstarted waiting for a commencement order; and search the amended Act rather than the amending one, because UK AI law works largely by inserting sections into older statutes.

For the EU, EUR-Lex. For what a regulator expects of you in practice, the regulator's own guidance — which is free, and better written than most commentary about it.