UK AI regulation framework: requirements, deadlines and compliance actions
A pro-innovation approach to AI regulation (white paper and government response)
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 10 sections
In brief
The UK AI regulation framework is a non-binding policy of the United Kingdom, issued by the Department for Science, Innovation and Technology. Its current status is guidance. Applies to UK regulators and, through them, to organisations developing or using AI in regulated activities in the UK. 5 obligations are recorded against it, each with its source reference.
- Jurisdiction
- United Kingdom
- Instrument type
- Policy
- Status
- Guidance
- Legal force
- Non-binding (guidance, strategy or standard)
- Issuing body
- Department for Science, Innovation and Technology
- Adopted
- 29 March 2023
- Published
- 29 March 2023
- Obligations recorded
- 5
- Source reference
- CP 815; government response 6 February 2024
- Official source
- A pro-innovation approach to AI regulation
- Verification
- Verified against the official source 26 Sep 2026
What is the UK AI regulation framework?
The UK white paper sets out a principles-based, context-specific approach to regulating AI. Instead of a single AI law, it asks existing regulators to interpret and apply five cross-cutting principles within their remits: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Central government provides coordination, monitoring and guidance.
Status note: Non-statutory framework implemented by existing regulators. The government response of 6 February 2024 confirmed the approach and asked regulators to publish their AI plans; a reviewer should confirm no statutory duty on regulators has since been introduced.
Who does it apply to?
Applies to UK regulators and, through them, to organisations developing or using AI in regulated activities in the UK. It creates no direct legal obligations on businesses; obligations arise from the existing laws each regulator enforces.
UK regulators (primary audience), and indirectly any organisation whose AI use falls within a regulator's remit.
When do the requirements apply?
White paper published 29 March 2023; consultation closed 21 June 2023; government response published 6 February 2024, with regulators asked to publish their AI strategies by 30 April 2024.
| Date | Milestone | Source reference | Status |
|---|---|---|---|
| Consultation closed End of the white paper consultation period. |
— | Passed | |
| Government response published Confirmed the principles-based approach and asked regulators to publish AI plans. |
— | Passed |
What must organisations do?
Map your AI uses to the regulators that cover them, read those regulators' AI guidance, and evidence how you meet the five principles through your existing compliance programmes (data protection, equality, consumer, sector).
Each duty is one line: open it for the summary, practical action and evidence, or go to its own page.
Voluntary Ensure AI systems are safe, secure and robust throughout their lifecycle Provider / developer, Deployer / user organisation
Regulators are asked to ensure AI systems function in a robust, secure and safe way, with risks continually identified, assessed and managed. In practice this is enforced through existing safety, security and data-protection law rather than a new duty.
Practical action: Run lifecycle risk assessments and keep security testing evidence that you can show a regulator.
Evidence examples: AI risk assessment
Framework mapping (original, editorial): NIST AI RMF 1.0 MEASURE 2.5–2.7; ISO/IEC 42001:2023 Clause 6.1 and Annex A risk controls
Open the obligation page →Principle 1, Part 3 Source-linked (a factual check against the official source, not a legal review)
Voluntary Provide appropriate transparency and explainability Provider / developer, Deployer / user organisation
Organisations should communicate when and how AI is used and provide explanations proportionate to the risk, so that people can understand decisions affecting them. For personal data, UK GDPR transparency and automated decision-making rights make this binding in practice.
Practical action: Publish AI use notices and keep explainability documentation for decisions about individuals.
Evidence examples: AI transparency notice
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 4.x, MAP 1.x
Open the obligation page →Principle 2, Part 3 Source-linked (a factual check against the official source, not a legal review)
Voluntary Use AI in ways that are fair and do not discriminate unlawfully Provider / developer, Deployer / user organisation
AI systems should not undermine legal rights, discriminate unfairly or create unfair market outcomes. The Equality Act 2010 and UK GDPR fairness principle make key parts of this binding.
Practical action: Test for disparate outcomes across protected characteristics before and after deployment.
Evidence examples: Bias and fairness testing report
Framework mapping (original, editorial): NIST AI RMF 1.0 MEASURE 2.11
Open the obligation page →Principle 3, Part 3 Source-linked (a factual check against the official source, not a legal review)
Voluntary Establish accountability and governance for AI Provider / developer, Deployer / user organisation
Governance measures should ensure effective oversight of AI supply and use with clear lines of accountability across the lifecycle.
Practical action: Name an accountable owner for each AI system and record decisions in a governance log.
Evidence examples: AI governance policy and RACI
Framework mapping (original, editorial): ISO/IEC 42001:2023 Clause 5 Leadership; NIST AI RMF 1.0 GOVERN 2.1
Open the obligation page →Principle 4, Part 3 Source-linked (a factual check against the official source, not a legal review)
Voluntary Provide routes to contest AI outcomes and seek redress Deployer / user organisation, Public authority / government body
Affected people should be able to contest harmful AI decisions or outcomes and obtain redress, through existing complaint routes and regulators.
Practical action: Add an AI-decision challenge route to customer complaint procedures.
Evidence examples: Contest and redress procedure
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 5.1, MANAGE 4.x
Open the obligation page →Principle 5, Part 3 Source-linked (a factual check against the official source, not a legal review)
What are the penalties?
None directly; penalties arise under the underlying laws enforced by each regulator.
Key sections and articles
| Reference | Title | Summary |
|---|---|---|
| Part 3 | Framework principles | The five cross-cutting principles for regulators. |
| Part 4 | Central functions | Monitoring, risk assessment, coordination and sandbox support from central government. |
Official sources
-
A pro-innovation approach to AI regulation (white paper, CP 815)
Department for Science, Innovation and Technology · 29 Mar 2023 · Tier 1 source
-
A pro-innovation approach to AI regulation: government response
Department for Science, Innovation and Technology · 6 Feb 2024 · Tier 1 source
Cite this record
AIPolicyTracker (2026). “UK AI regulation framework” [AIPT-POL-0201, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0201 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0201: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: A pro-innovation approach to AI regulation, UK Government, Department for Science, Innovation and Technology, https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach.
BibTeX
@misc{aipolicytracker2026_ukairegulationframework,
author = {{AIPolicyTracker}},
title = {{UK AI regulation framework}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/uk-ai-regulation-white-paper}},
url = {https://aipolicytracker.org/policies/uk-ai-regulation-white-paper},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0201)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0201"><img src="https://aipolicytracker.org/badges/uk-ai-regulation-white-paper.svg" alt="AIPolicyTracker: A pro-innovation approach to AI regulation (white paper and government response), Guidance · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Initial structured record. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the UK AI white paper legally binding?
No. It is a policy framework for regulators. Legal obligations on businesses continue to come from existing laws such as UK GDPR, the Equality Act 2010 and sector regulation.
Is the UK AI regulation framework in force?
The UK AI regulation framework has the status "guidance"; it is not a binding law in force.
Is the UK AI regulation framework legally binding?
No. The UK AI regulation framework is a policy; it sets expectations rather than legal requirements, unless another instrument gives it force.
Who does the UK AI regulation framework apply to?
Applies to UK regulators and, through them, to organisations developing or using AI in regulated activities in the UK. It creates no direct legal obligations on businesses; obligations arise from the existing laws each regulator enforces.
When does the UK AI regulation framework apply?
White paper published 29 March 2023; consultation closed 21 June 2023; government response published 6 February 2024, with regulators asked to publish their AI strategies by 30 April 2024.
What must organisations do under the UK AI regulation framework?
Map your AI uses to the regulators that cover them, read those regulators' AI guidance, and evidence how you meet the five principles through your existing compliance programmes (data protection, equality, consumer, sector).
What are the penalties under the UK AI regulation framework?
None directly; penalties arise under the underlying laws enforced by each regulator.
Where is the official text of the UK AI regulation framework?
The official text is published by UK Government, Department for Science, Innovation and Technology at https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach (A pro-innovation approach to AI regulation). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.