The UK's Approach to AI Regulation

The March 2023 white paper set out five principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They were not put into law. Instead, regulators were asked to apply them within their existing powers, supported by central functions to monitor risks and coordinate across sectors. In its February 2024 response, the government committed £10 million to build regulators' AI capabilities and asked key regulators to publish their strategic approaches to AI, which many did that spring. The main regulators each cover part of the picture. The Information Commissioner's Office (ICO) enforces UK data protection law, including rules on automated decision-making, and has published extensive guidance on AI and data protection. The Competition and Markets Authority (CMA) reviewed foundation models in 2023 and has powers under the Digital Markets, Competition and Consumers Act 2024 to designate firms with strategic market status. The Financial Conduct Authority (FCA) applies consumer protection rules to AI in financial services. Ofcom oversees online platforms under the Online Safety Act. The Digital Regulation Cooperation Forum brings together the ICO, CMA, Ofcom and FCA to coordinate. Separately, the UK created the AI Safety Institute after the November 2023 Bletchley Park summit to evaluate advanced models, and renamed it the AI Security Institute in 2025. It tests models, often with developers' voluntary cooperation, but it is not a regulator. The debate centers on frontier models. Critics argue that general-purpose models cut across sectors and can fall between regulators. Labour's 2024 manifesto promised binding regulation for developers of the most powerful models, but a government bill has been repeatedly delayed. The UK is not without AI rules: existing laws apply to AI, but there is no AI-specific statute.