Loading
The UK chose a pro-innovation, sector-based approach instead of a comprehensive AI law. Six regulators with relevant powers, each applying their domain expertise to AI. Plus, UK companies still face the EU AI Act where they place AI on the EU market or its output is used there.
Six regulators, each applying domain expertise, not a single AI law.
Explaining Decisions Made with AI guidance; enforcement of UK GDPR Articles 22A-22D (replacing Article 22 from 5 February 2026), the safeguards regime for solely automated decisions affecting individuals
Joint discussion paper with the Bank of England and PRA on AI and machine learning (DP5/22, October 2022; feedback statement FS23/6, October 2023); Consumer Duty outcomes framework applies to AI-driven products
Foundation model review 2023-24; ongoing work on algorithmic collusion and AI-enabled anti-competitive practices
AI medical devices regulation; Software and AI as a Medical Device guidance; UKCA marking for post-Brexit medical devices
Online Safety Act implementation; AI-generated content moderation; algorithmic recommender system oversight
Evaluation of frontier AI systems; international AI safety cooperation through the Hiroshima AI Process and GPAI
Brexit removed UK organisations from the EU's direct regulatory sphere, but it did not remove them from the EU AI Act's extraterritorial reach. A UK organisation is within scope of the EU AI Act where it places an AI system on the EU market or puts it into service there, where it deploys AI from an establishment in the EU, or where, from outside the EU, the output of its AI system is used in the EU. Selling into the EU usually engages the first of these, because supplying an AI system on the Union market is placing it on that market. Customer location is not itself the test. UK financial institutions with European branches, UK technology companies with European customers, and UK software companies whose AI is used by EU organisations all face EU AI Act obligations in addition to UK regulatory expectations. The practical result is that many UK organisations need to manage two parallel AI governance frameworks: UK GDPR and sector regulators for domestic activities, EU AI Act for EU-facing activities.
Lloyd’s pioneered the shift from silent to explicit cover, and London syndicates and coverholders now underpin much of the world’s specialist AI cover, with assurance increasingly tied to insurability. See how the coverage gap works.
Sector-specific obligations under the UK's pro-innovation approach.