There is no UK AI Regulation and Safety Bill. No AI-specific bill sits before Parliament as of October 2026, and the government has not introduced one despite announcing in July 2024 that it intended to place requirements on developers of the most powerful models.
The names in circulation attach to different things. The Artificial Intelligence (Regulation) Bill was a Private Member’s Bill originating in the Lords in the 2024 to 2026 session, which did not progress. A UK AI Regulation Bill is recorded as withdrawn in 2025. A new Private Member’s Bill on prohibiting artificial superintelligence was introduced in the Commons with a second reading scheduled for 13 November 2026, and Private Members’ Bills rarely become law without government backing.
What the May 2026 King’s Speech did announce is a Regulating for Growth Bill carrying regulatory sandbox powers, with a draft expected around November 2026. It is not an AI statute.
The regulatory change that actually altered UK legal duties took effect on 5 February 2026, when the automated decision-making provisions of the Data (Use and Access) Act 2025 came into force. From 12 May 2026 the ICO carries a statutory duty to produce a code of practice on AI and automated decision-making.
For businesses placing AI products on the EU market, the binding framework is the EU AI Act, not anything in Westminster.
Key Definitions
| Term | Definition |
|---|---|
| Artificial Intelligence (Regulation) Bill [HL] | A Private Member’s Bill introduced in the House of Lords in the 2024 to 2026 session. Did not complete passage |
| Private Member’s Bill | A bill introduced by a backbench member rather than the government. Rarely becomes law without government support |
| Regulating for Growth Bill | A bill announced in the May 2026 King’s Speech, expected to carry regulatory sandbox powers. Not an AI-specific statute |
| DUAA | Data (Use and Access) Act 2025. Its automated decision-making provisions came into force on 5 February 2026 |
| Automated decision-making | A decision taken without meaningful human involvement, regulated under UK GDPR as amended by the DUAA |
| AI Growth Lab | A regulatory sandbox concept set out in DSIT’s October 2025 Blueprint for AI regulation |
| Pro-innovation framework | The approach set out in the 2023 White Paper: five cross-cutting principles applied by existing regulators within their existing remits, with no statutory force |
| DSIT | Department for Science, Innovation and Technology. Leads AI policy without being an AI regulator |
| EU AI Act | Regulation (EU) 2024/1689. The binding EU framework, which applies to UK businesses placing AI systems on the EU market |
Why People Search for a UK AI Regulation and Safety Bill
The search term exists because the expectation was reasonable. In July 2024 the incoming government announced that it would introduce narrow legislation placing requirements on developers of the most powerful AI models. Multiple commentators treated an AI bill as a matter of time.
It has not arrived. A bill did not materialise in 2025. Ministerial statements through 2025 and 2026 indicated no specific AI bill in the short to medium term.
The AI minister’s stated position has been that a range of existing rules already apply to AI systems, including data protection, competition, equality legislation and online safety.
Several things carry similar names and are frequently conflated.
| Instrument | What it is | Status |
|---|---|---|
| Artificial Intelligence (Regulation) Bill [HL] | Private Member’s Bill, Lords, 2024 to 2026 session | Did not complete passage |
| UK AI Regulation Bill | Tracked instrument | Withdrawn, 2025 |
| Private Member’s Bill on artificial superintelligence | Introduced in the Commons, prohibiting development of superintelligent AI | Second reading scheduled 13 November 2026. Unlikely to progress without government backing |
| Regulating for Growth Bill | Announced in the May 2026 King’s Speech, carrying sandbox powers | Draft expected around November 2026 |
| Cyber Security and Resilience Bill | Introduced 12 November 2025, updating the NIS Regulations | Progressing. Not an AI bill |
| Data (Use and Access) Act 2025 | In force. ADM provisions applied 5 February 2026 | In force |
The last two are the ones that have actually changed legal duties.
What Actually Regulates AI in the UK
The UK regulates AI by context rather than by technology. There is no single AI regulator and no horizontal statute. Obligations attach through whichever regime already governs the use case.
| Regime | What it covers for AI | Regulator |
|---|---|---|
| UK GDPR and Data Protection Act 2018, as amended by DUAA 2025 | Personal data in training, inference and automated decisions | ICO |
| Equality Act 2010 | Discriminatory outcomes in employment, services and public functions | EHRC, courts |
| Consumer protection and DMCC Act 2024 | Unfair practices, algorithmic pricing, consumer harm | CMA |
| Online Safety Act 2023 | AI-generated content on regulated services, including synthetic content duties | Ofcom |
| FCA Handbook, Consumer Duty, SM&CR | AI in financial services, model risk, personal accountability for AI outcomes | FCA |
| Medical device regulation | AI as a medical device | MHRA |
| Product safety and General Product Safety Regulations | Consumer product safety where AI is embedded | OPSS |
| Employment law | AI in hiring, monitoring and dismissal | Employment tribunals |
The practical consequence is that a company deploying AI in hiring faces the ICO on data, the EHRC and tribunals on discrimination, and no AI-specific regulator at all. The compliance surface is real and distributed, which is harder to manage than a single statute, not easier.
The Change That Did Happen: DUAA Automated Decision-Making
The one development that altered legal duties for ordinary UK businesses took effect on 5 February 2026.
The Data (Use and Access) Act 2025 restructured the UK position on automated decision-making. Under the previous Article 22 of the UK GDPR, solely automated decisions producing legal or similarly significant effects were effectively prohibited subject to three narrow exceptions. The DUAA replaced that with a permission-with-safeguards model: such decisions are permitted provided safeguards are in place, including the ability to obtain human intervention, to make representations, and to contest the decision.
| Feature | UK, post-DUAA | EU GDPR |
|---|---|---|
| Default position | Permitted subject to safeguards | Prohibited subject to three exceptions |
| Required safeguards | Human intervention, representations, right to contest | Human intervention, right to contest |
| Special category data | Restrictions retained | Stricter restrictions apply |
| Enforcement record | Untested at scale | Active. The Dutch DPA fined Uber €825 million in August 2026 over automated driver deactivations |
The divergence matters for anyone deploying AI decisioning across both jurisdictions. A decision architecture built to the UK standard will not satisfy EU Article 22. One built to Article 22 will satisfy the UK.
The DUAA also introduced recognised legitimate interests as a new lawful basis under Schedule 4, covering a closed list of purposes. Training AI models is not among them, which is a point of frequent confusion.
The ICO Code of Practice on AI and Automated Decision-Making
From 12 May 2026 the ICO carries a statutory duty under SI 2026/425 to produce a code of practice on AI and automated decision-making.
The code has not yet been published. When it is, it will be the closest thing the UK has to operational AI guidance with statutory backing, since a code of practice issued under this duty is admissible in evidence and courts and tribunals must take it into account where relevant.
For UK businesses, the publication of this code is a more consequential event than any of the bills discussed above, and it requires no parliamentary time.
The Regulating for Growth Bill
The May 2026 King’s Speech announced a Regulating for Growth Bill. As at July 2026 a draft was expected around November 2026, with the change of prime minister introducing timing uncertainty.
What is known about it:
| Feature | Position |
|---|---|
| Regulatory sandbox powers | Expected to be a central element |
| AI-specific obligations | Not expected. It is a cross-sector deregulatory and sandbox instrument |
| AI Growth Labs | The sandbox concept set out in DSIT’s October 2025 Blueprint for AI regulation |
| Status | Draft expected around November 2026, subject to delay |
This bill is the government’s chosen vehicle in place of an AI statute. Treating it as a UK AI Act would be a misreading. It is a mechanism for allowing controlled departures from existing rules in order to encourage adoption, not a framework for constraining AI development.
What UK Businesses Should Actually Prepare For
The absence of a UK AI statute does not reduce the compliance load for most UK businesses. It redistributes it, and for anyone selling into the EU it moves the binding framework offshore.
| Trigger | Applicable framework | Status |
|---|---|---|
| AI system placed on the EU market | EU AI Act, Regulation (EU) 2024/1689 | In force. Annex III high-risk obligations from 2 December 2027 |
| Output of a UK-operated AI system used in the EU | EU AI Act, Article 2(1)(c) | In force. No EU establishment required for scope |
| Generative AI output published anywhere reaching EU users | EU AI Act Article 50 | In force since 2 August 2026 |
| Software or connected product sold into the EU | Cyber Resilience Act | Reporting live since 11 September 2026, full application 11 December 2027 |
| Consumer product sold into the EU | GPSR, Regulation (EU) 2023/988 | In force since 13 December 2024 |
| Product placed on the EU market after 9 December 2026 | Product Liability Directive (EU) 2024/2853 | Transposition deadline 9 December 2026 |
| AI processing personal data of UK residents | UK GDPR as amended by DUAA | In force |
| AI processing personal data of EU residents | EU GDPR | In force |
A UK company selling AI products into Europe is subject to a dense and enforceable framework. It simply is not a British one.
Two points follow for UK providers specifically.
A UK-established entity cannot act as an EU authorised representative under Article 22 or Article 54 of the EU AI Act. Brexit removed that option, and a London address in an EU product listing does not satisfy the requirement.
UK businesses face EU obligations without a domestic equivalent to benchmark against. There is no UK framework that, if followed, produces EU compliance as a by-product. The work has to be done against the EU text directly.
Timeline
| Date | Event |
|---|---|
| March 2023 | Pro-innovation White Paper. Five non-statutory principles, existing regulators |
| July 2024 | Government announces intention to legislate on the most powerful models |
| 2025 | No AI bill introduced. UK AI Regulation Bill withdrawn |
| 21 October 2025 | DSIT Blueprint for AI regulation and AI Growth Lab call for views |
| 12 November 2025 | Cyber Security and Resilience Bill introduced |
| 5 February 2026 | DUAA automated decision-making provisions in force |
| April 2026 | 2024 to 2026 session ends. Artificial Intelligence (Regulation) Bill [HL] does not complete passage |
| 12 May 2026 | ICO statutory duty to produce an AI and ADM code of practice takes effect, SI 2026/425 |
| May 2026 | King’s Speech announces Regulating for Growth Bill. No standalone AI bill |
| 2 August 2026 | EU AI Act Article 50 transparency obligations apply |
| 11 September 2026 | EU Cyber Resilience Act reporting obligations apply |
| November 2026 | Regulating for Growth Bill draft expected. Superintelligence Private Member’s Bill second reading scheduled 13 November |
| 9 December 2026 | EU Product Liability Directive transposition deadline |
| 2 December 2027 | EU AI Act Annex III high-risk obligations apply |
Where Grecta Fits
Grecta is product compliance infrastructure rather than organisational compliance tooling. The distinction matters here because the UK position pushes the binding obligations onto the product, not the company.
Grecta determines which obligations reach a product across the EU AI Act, GDPR and UK GDPR, the Cyber Resilience Act, the GPSR, DORA, NIS2 and the Product Liability Directive, then builds the infrastructure around each one: evidence bound to the obligation, recalculation when the law or the product changes, an audit trail of every evaluation, the reports each authority expects, and retention for as long as the obligation runs.
For a UK business, the practical effect is that the absence of a UK AI statute stops being a planning problem. The obligations that actually bind the product are identified, documented, and kept current as the EU frameworks move, while the UK position is tracked for the changes that do land, such as the ICO code when it is published.
Book a Grecta demo to see how obligations are mapped to a specific product and what the evidence set looks like.
FAQ
Is there a UK AI Regulation and Safety Bill?
Not at the time of writing (October 2026). There is no bill by that name and no AI-specific bill before Parliament as of October 2026. The Artificial Intelligence (Regulation) Bill was a Private Member’s Bill in the Lords during the 2024 to 2026 session which did not complete passage, and a UK AI Regulation Bill is recorded as withdrawn in 2025.
Is there a UK AI Act?
No. The UK has no AI statute. The 2023 White Paper set out five cross-cutting principles applied by existing regulators within their existing remits, and those principles remain non-statutory.
Will the UK pass an AI Act?
There is no announced legislative programme for one. Ministerial statements through 2025 and 2026 indicated no specific AI bill in the short to medium term, and the May 2026 King’s Speech announced a Regulating for Growth Bill (not UK AI Regulation and Safety Bill) with sandbox powers in place of an AI statute.
What is the Regulating for Growth Bill?
A bill announced in the May 2026 King’s Speech, expected to carry regulatory sandbox powers including the AI Growth Labs concept from DSIT’s October 2025 Blueprint. A draft was expected around November 2026. It is a deregulatory and sandbox instrument, not an AI regulatory framework or UK AI Regulation and Safety Bill.
What is the superintelligence bill?
A Private Member’s Bill introduced in the Commons proposing to prohibit the development of artificial superintelligence, with a second reading scheduled for 13 November 2026. Private Members’ Bills rarely become law without government backing, and this one does not have it.
What regulates AI in the UK right now?
Existing regimes applied by existing regulators. The UK GDPR and Data Protection Act 2018 as amended by the DUAA, enforced by the ICO. The Equality Act 2010. The Online Safety Act 2023, enforced by Ofcom. The DMCC Act 2024, enforced by the CMA. Sector regulation from the FCA, MHRA and others.
What in AI Regulation and Safety Bill changed on 5 February 2026?
The automated decision-making provisions of the Data (Use and Access) Act 2025 came into force, replacing the near-prohibition on solely automated decisions with a permission-with-safeguards model. This is the single change that altered legal duties for ordinary UK businesses deploying AI.
Does the EU AI Act apply to UK companies?
Yes, where an AI system is placed on the EU market, put into service in the EU, or where its output is used in the EU under Article 2(1)(c). A UK company with no EU entity can be in scope through the output route alone, and a UK-established entity cannot act as its EU authorised representative.
Is the ICO code of practice on AI published?
Not as at October 2026. The ICO has carried a statutory duty to produce it since 12 May 2026 under SI 2026/425. When published, it will be admissible in evidence and courts and tribunals must take it into account where relevant, which makes it the most consequential UK AI guidance in prospect.
Should we wait for UK AI legislation before building AI governance?
No. The obligations that bind UK businesses operating in Europe are already in force under EU law, and the UK’s own distributed framework imposes real duties through data protection, equality and sector regulation today. Waiting for a UK AI Act means waiting for something that has been repeatedly announced and repeatedly not introduced.
Does the UK have AI regulatory sandboxes?
Not yet in statutory form. The AI Growth Labs concept was set out in DSIT’s October 2025 Blueprint for AI regulation, and the sandbox powers are expected to arrive through the Regulating for Growth Bill. As at October 2026 that bill is in draft and not before Parliament.
Sources
UK Parliament, Artificial Intelligence (Regulation) Bill [HL]
Data (Use and Access) Act 2025
DSIT, A pro-innovation approach to AI regulation
ICO, artificial intelligence guidance
Regulation (EU) 2024/1689, EU AI Act
Bird & Bird AI Regulatory Horizon Tracker, United Kingdom
Osborne Clarke, Regulatory Outlook January 2026
Disclaimer
This guide reflects the position as at October 2026. Parliamentary bills and their scheduling change, and the Regulating for Growth Bill and the ICO code of practice were both pending at the time of writing. Published by Grecta. It is regulatory analysis, not legal advice.
