The 2026 UK AI compliance checklist for businesses

What is UK AI compliance in 2026?

UK AI compliance is the set of regulatory obligations a UK business must meet when deploying AI systems, covering data protection, sector-specific rules, cybersecurity, and cross-border obligations. There is no single "UK AI Act" yet. Instead, UK businesses sit at the intersection of multiple overlapping frameworks: UK GDPR and the Data (Use and Access) Act 2025 (DUAA), the EU AI Act for businesses with EU exposure, sector rules from the FCA, ICO, MHRA, and CQC, the April 2026 DSIT and Cabinet Office cyber letter and NCSC guidance, and the voluntary ISO 42001 management system standard. The fragmentation is the problem. In the Bank of England and FCA’s 2024 survey, 84% of AI-using respondents had an accountable person for their AI framework. This is a survey result, not a current census of all regulated firms or other UK businesses.

This guide is a structured checklist. Section by section, it maps each regulatory framework to the obligations that apply, gives the documents that should be on file, and identifies the questions a senior leader should be able to answer if a client, auditor, or regulator asks. It is not a substitute for legal advice on any specific deployment, but it is the minimum baseline a UK business should hold before deploying AI in 2026.

The regulatory landscape in one page

The table below summarises which framework applies to whom and what the core obligation is. UK businesses are typically in scope of three or more rows simultaneously.

Framework	Applies to	Core obligation
UK GDPR + Data (Use and Access) Act 2025 (DUAA)	All UK businesses processing personal data	Lawful basis, DPIA for high-risk AI, transparency
EU AI Act	UK businesses with EU exposure (customers, staff, market)	AI literacy (Article 4), high-risk system obligations, data governance (Article 10)
FCA Consumer Duty (PRIN 2A)	FCA-regulated firms	Outcomes for retail customers, including products and services, fair value, understanding and support
ICO guidance	All UK businesses processing personal data	Transparency, DPIA, subject rights including Articles 22A to 22D
Government cyber letter and NCSC guidance	All UK businesses deploying AI	Cyber Essentials baseline, supply chain security, prompt injection mitigation
ISO 42001	Voluntary; relevant for enterprise buyers	AI management system certification

The Data (Use and Access) Act 2025 (DUAA) is the most recent UK addition. It revises parts of UK GDPR and introduces specific provisions on automated decision-making and on data sharing across the public sector. For most UK SMEs, DUAA does not change the underlying obligations on AI but does change the language used in the privacy notice and the lawful basis register.

Checklist 1: UK GDPR and DUAA compliance for AI

The first compliance layer applies to every UK business that processes personal data through any AI tool, regardless of sector. Six items, each of which should produce a written artefact.

1. Identify every AI system processing personal data. Maintain a register that lists each tool, the data categories it processes, and the lawful basis. ChatGPT Enterprise, Claude Team, Microsoft 365 Copilot, embedded AI in CRM and accounting platforms, and any custom builds all belong on this register.
2. Confirm lawful basis for each. Legitimate interests, consent, contract, or legal obligation under Article 6 UK GDPR. For special category data, an Article 9 condition is also required.
3. Complete a DPIA for any high-risk AI processing. UK GDPR Article 35 requires a DPIA for personal-data processing likely to result in a high risk to people. Assess the nature, scope, context and purposes, including systematic evaluation with significant effects and large-scale special-category processing. The ICO expects most AI processing to meet the high-risk test; document the decision in each case.
4. Update privacy notices to disclose AI use where material. Where AI processes personal data in a way that is not obvious to the data subject, transparency requires it to be disclosed. Boilerplate AI clauses are often insufficient; the disclosure should describe what the AI does in plain English.
5. Map subject rights to each AI system. Right of access, erasure, rectification, and (importantly for AI) the Article 22C safeguards for solely automated significant decisions: information, representations, human intervention and contesting the decision.
6. Document automated decision-making. UK GDPR Articles 22A to 22D govern solely automated decisions with legal or similarly significant effects. Article 22C requires information, representations, human intervention and a way to contest the decision. Article 22B adds restrictions for special-category data and excludes reliance on recognised legitimate interests under Article 6(1)(ea). Document the threshold assessment and any meaningful human involvement.

Checklist 2: EU AI Act exposure

Assess scope under Article 2 by role, EU establishment, placing systems or models on the EU market, and use of system outputs in the Union. Customer nationality or a UK billing address alone is not a reliable scope test. Separate current obligations from preparation for later high-risk duties.

1. AI literacy measures (Article 4). Article 4, as amended by Regulation (EU) 2026/1744, requires providers and deployers in scope to take measures supporting the development of AI literacy among staff and others using AI on their behalf. Measures must reflect their knowledge, experience, training, the use context and affected people. It does not require a guaranteed individual literacy level or prescribe a fixed course length.
2. Risk classification per AI system. Each deployed AI system should be classified as prohibited, high-risk, limited-risk, or minimal. Most UK SME deployments are limited-risk (chatbots, content generation) or minimal, but the classification should be on file.
3. High-risk duties and timing. Regulation (EU) 2026/1744 deferred Chapter III Sections 1, 2 and 3, except Article 6(5), to 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. Article 50 generally applies from 2 August 2026; Article 111(4) gives providers of relevant systems already on the market before that date until 2 December 2026 for Article 50(2) machine-readable marking only. Map provider and deployer responsibilities separately.
4. Conformity assessment planning. Identify whether the organisation is the provider responsible for assessment, and obtain advice on the applicable route, transitional provisions and dates.

For most UK SMEs, the practical takeaway is the literacy training obligation under Article 4 and the limited-risk transparency requirement that customer-facing chatbots disclose AI status to users.

Checklist 3: Sector-specific overlays

Each named sector adds an overlay on top of the cross-sector frameworks above. The list below covers the four sectors with the heaviest overlay in 2026.

Financial services (FCA)

The FCA applies existing rules to AI, including the Consumer Duty for retail customer outcomes and the SM&CR accountability regime. PRA operational resilience and model-risk requirements depend on the firm and activity in scope. In the Bank of England and FCA’s 2024 survey of 118 responding firms, 75% used AI; 84% of AI-using respondents had an accountable person for their AI framework. These are survey results, not a census of all FCA-regulated firms.

Healthcare and dental

Medical-device requirements depend on a tool’s intended purpose and classification, not simply its use in a clinical workflow. Check the MHRA software guidance. The NHS Digital Technology Assessment Criteria (DTAC) provides an assurance framework for digital health technologies. Health data also requires an Article 6 lawful basis and an Article 9 condition under UK GDPR. Assess the relevant professional obligations for the intended clinical or administrative use.

Legal and accountancy

The SRA’s 17 August 2026 warning notice covers inaccurate citations, supervision and confidential information entered into AI without suitable safeguards. Its technology guidance says clients should know when they are interfacing with AI. The Bar Standards Board’s guidance, valid from 18 May 2026, treats AI use as outsourcing and retains the barrister’s responsibility for the work. The FRC has published AI-in-audit guidance in June 2025 and March 2026.

Public sector and education

The government's AI Playbook applies to central government bodies and is widely referenced by the wider public sector. Heightened transparency and fairness obligations sit on top of UK GDPR for public-sector deployments. Education-sector deployments touching pupil data add safeguarding considerations.

Checklist 4: AI cybersecurity baseline

The 15 April 2026 DSIT and Cabinet Office letter asks business leaders to own cyber risk at board level, adopt Cyber Essentials across their supply chains, and follow NCSC advice including its Early Warning service. The six items below are The AI Consultancy's practical checklist, not a list quoted from that letter or a universal legal requirement. Tailor them to the deployment and its risks.

1. Cyber Essentials certification current. Certified within the last 12 months, ideally Cyber Essentials Plus.
2. Approved AI tool list in place. A documented list of AI tools sanctioned for use, along with the tier (free vs enterprise) and the data categories permitted.
3. Multi-factor authentication on all AI tool accounts. No exceptions, including for executives.
4. Phishing training updated for AI-generated threats. Voice cloning, deepfake video, and AI-drafted phishing emails require an updated training module.
5. Prompt injection mitigations for customer-facing AI. Any chatbot or agent exposed to user input must treat retrieved or user-supplied content as untrusted and resist injected instructions.
6. Out-of-band verification for financial instructions. Verbal callback or second-channel verification for any payment, payee change, or financial instruction received via AI-mediated channels.

For the deeper threat model and mitigation patterns that sit underneath this baseline, see our AI security risks guide for UK businesses.

Documentation that should be on file

Compliance is demonstrated through documentation. The following artefacts are the minimum a UK business should be able to produce on demand. If any of these does not exist, it is the first thing to build.

• Current AI acceptable use policy. See our AI acceptable use policy guide for UK SMEs.
• Approved AI tool list, with tier, data categories permitted, and review date.
• DPIA register for AI systems, with the screening assessment and full DPIAs where required.
• Evidence of context-specific AI literacy measures, for example role objectives, guidance, training and review records. Article 4 does not prescribe this exact record format.
• Vendor Data Processing Agreements signed and on file, including the no-training clause for each enterprise tier.
• Risk register entries for each deployed AI system, with named owner.
• Privacy notice that discloses AI processing in plain English where material.
• Incident response plan that anticipates AI-specific incidents (data leakage to a vendor's training corpus, prompt injection, hallucinated outputs causing customer harm).

For the procurement-side controls that produce many of these artefacts, see our AI vendor selection and due diligence checklist.

ISO 42001: when is it worth it?

ISO 42001, published in 2023, is the international standard for AI management systems. It is voluntary and certification is not required by any UK regulator. The case for pursuing it in 2026 is commercial rather than regulatory: enterprise buyers, particularly in financial services, healthcare, and the public sector, increasingly require ISO 42001 certification (or equivalent) from AI vendors and from internal AI deployments that affect their data. For a UK SME selling AI-enabled services to enterprise clients, certification is moving from optional to expected over a 12 to 24 month horizon. For a UK SME using AI internally without selling AI-enabled services, the same outcomes can usually be achieved through ISO 27001 alignment plus the documentation list above, without the cost of formal ISO 42001 certification.

Who should be accountable?

The single most important compliance step is to name a person. The pattern that has worked in regulated UK financial services (84% of AI-using respondents in the Bank of England and FCA’s 2024 survey had an accountable person for their AI framework) is generalisable to other sectors. The role does not need to be a new hire. In most UK SMEs, the natural owner is the existing data protection lead, the COO, or the head of IT. What matters is that responsibility is named, documented, and known to the senior team. A "shared" accountability across multiple functions is, in practice, no accountability at all.

Where to start

If your business does not yet have an AI compliance baseline, the priority order is: (1) name an accountable individual; (2) build the AI tool register; (3) write or update the AI acceptable use policy; (4) complete a DPIA screening for each tool on the register; (5) confirm vendor DPAs and no-training clauses are in place; (6) deliver AI literacy training and document it. Six steps, achievable in a quarter for a UK SME of typical size. For a structured assessment, see our AI strategy service. For broader strategy resources, see the AI strategy section of the Knowledge Hub. For the EU AI Act-specific obligations, see our EU AI Act guide for UK SMEs.