Reviewed
Command Paper 815
Britain regulates artificial intelligence through the regulators it already has.
There is no cross-sector artificial intelligence statute in force in the United Kingdom. Five non-statutory principles are applied by existing sector regulators inside their own remits, and the Department for Science, Innovation and Technology (DSIT) sets direction without enforcing against firms.
- Cross-sector statute
- None in force
- Policy basis
- Command Paper 815
- Published
- March 2023
- Principles
- Five, non-statutory
- Named regulators
- 6
- DUAA s.80 in force
- 5 February 2026
Section I The principles
Five principles, no statute behind them.
The March 2023 White Paper A pro-innovation approach to AI regulation, published as Command Paper 815, set out a framework built on five principles. Regulators are expected to apply them within their existing remits and existing powers.
They are not enforceable in themselves. A firm cannot be sanctioned for breaching a principle; it can be sanctioned for breaching the sectoral rule the principle informs.
- 01 Safety, security and robustness
- 02 Appropriate transparency and explainability
- 03 Fairness
- 04 Accountability and governance
- 05 Contestability and redress
Section II Who enforces what
Six bodies, six remits.
Application is distributed. The regulator with jurisdiction over an artificial intelligence system is the one that already had jurisdiction over the activity the system performs.
- ICO Information Commissioner’s Office
- Data protection and information rights. Source
- FCA Financial Conduct Authority
- Conduct regulation in financial services. Source
- PRA Prudential Regulation Authority
- Prudential regulation of banks and insurers, including model risk management under Supervisory Statement SS1/23. Source
- MHRA Medicines and Healthcare products Regulatory Agency
- Medical devices and medical technologies, including software as a medical device. Source
- CMA Competition and Markets Authority
- Competition and consumer fairness. Source
- EHRC Equality and Human Rights Commission
- Equality law, including algorithmic discrimination. Source
Section III Automated decisions
The rules on automated decision-making changed on 5 February 2026.
Section 80 of the Data (Use and Access) Act 2025 came into force on that date, replacing Article 22 of the UK GDPR. The general prohibition on decisions taken solely by automated means now bites only where the processing relies on special category data.
For other personal data, a controller may rely on legitimate interests as the lawful basis for a solely automated decision, provided suitable safeguards are in place. The Secretary of State holds powers to make further regulations in this area.
A decision driven by financial information, rather than by special category data, is therefore outside the general prohibition that applied before that date.
- 01 Information about the decision taken in relation to the data subject
- 02 The ability to make representations about that decision
- 03 Human intervention on the part of the controller
- 04 The ability to contest the decision
Section IV Legislation in progress
One Bill on artificial intelligence has reached a second reading, and it is not a Government Bill.
The Artificial Intelligence (Regulation) Bill [HL] was introduced by Lord Holmes of Richmond in March 2025. It is a Private Member’s Bill. It received a second reading in the House of Lords and was still under debate in June 2026, without completing committee, report and third reading.
Its central proposal is an AI Authority with a remit across existing regulators and legislation, placing the five principles on a statutory footing and working with regulators on sandboxes.
A Government artificial intelligence Bill has been signalled for this Parliament but is not before it. Until one is enacted, the framework described on this page is the framework that applies.
Section V Where AIPIA fits
A British practitioner has domestic oversight and no European affiliation.
The framework above is competent, distributed and domestic. What it does not provide is a professional affiliation aligned to the European regime that governs work sold into the European Union.
The Associazione Italiana Professionisti dell’Intelligenza Artificiale (AIPIA) is constituted under Italian Law 4/2013 and accredited to the European AI Alliance. Membership sits alongside domestic regulation rather than in place of it, and the page below states exactly where the association’s standing begins and ends.