The UK has no single AI law, but UK employers already have clear AI duties. UK GDPR and the Data Protection Act 2018 apply whenever AI touches personal data, the ICO expects you to be able to show how you use AI accountably, and the Data (Use and Access) Act 2025 rewrote the rules on automated decision-making from 5 February 2026. If your AI systems or their outputs are used in the EU, the EU AI Act can apply too, including its Article 4 duty to take measures to support your staff’s AI literacy.
This guide is for HR, L&D, compliance, data protection and security leaders at UK employers. It explains what each rule expects, what changed in 2026, and gives a practical checklist for AI training and governance.
Why there is no “UK AI Act” (yet)
The UK has chosen a principles-based approach. In its February 2024 response to the AI regulation white paper, the government confirmed five cross-sector principles for existing regulators to interpret and apply within their remits:
- safety, security and robustness
- appropriate transparency and explainability
- fairness
- accountability and governance
- contestability and redress
The principles are not statutory. In practice, the rules that bite come from existing law and existing regulators: data protection and the ICO, equality law, consumer and competition law, and sector regulators such as the FCA for financial services.
As of October 2026, the government has not introduced a comprehensive AI bill. A parliamentary committee report in September 2026 called for one, so this may change. For now, plan around the laws that already apply, because they cover most of what employees actually do with AI.
UK GDPR and the Data Protection Act 2018: the rules that already apply to AI
Every time an employee pastes customer records into a chatbot, an HR team screens CVs with an AI tool, or a product team trains a model on user data, UK GDPR applies. The core duties are familiar, but AI makes them harder to meet:
- Lawful basis and purpose: you need a lawful basis for each AI use of personal data, and a new AI use may not fit the purpose you originally collected the data for.
- Transparency: people must be told, in plain language, how their data is used, including by AI.
- Fairness and accuracy: AI outputs can be biased or simply wrong. You remain responsible for decisions based on them.
- Data minimisation and security: only the data you need should go into an AI system, and it must be protected, including from leakage through prompts.
- Data protection impact assessments (DPIAs): required where processing is likely to result in a high risk to individuals, which covers many AI uses.
- Accountability: you must be able to show your compliance, not just claim it.
The ICO’s “Guidance on AI and data protection” sets out how these principles apply to AI systems. The ICO notes that the guidance is under review following the Data (Use and Access) Act, so check for updates before relying on any specific passage.
What the Data (Use and Access) Act 2025 changed
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025 and was brought into force in stages. The changes that matter most for AI use at work:
| Area | What changed | When |
|---|---|---|
| Automated decision-making (ADM) | Article 22 of UK GDPR was replaced by Articles 22A to 22D. Outside special category data, significant decisions based solely on automated processing are permitted if safeguards are in place: telling the individual, letting them make representations, offering human intervention and letting them contest the decision | 5 February 2026 |
| Recognised legitimate interests | A new lawful basis for specified purposes, such as crime prevention and safeguarding, without a separate balancing test | 5 February 2026 |
| Complaints | A statutory right for people to complain directly to the organisation first | 19 June 2026 |
| The regulator | The Information Commissioner’s Office became the Information Commission, run by a board. It is still known as the ICO | 30 September 2026 |
The ADM change is the one with the biggest training implication. The law moved from a prohibition with exceptions to a right to challenge with safeguards. That only works if the people offering “human intervention” can genuinely understand, question and overturn an AI-supported decision. A recruiter who rubber-stamps an AI shortlist is not a safeguard.
The ICO consulted on draft guidance on automated decision-making and profiling from 31 March to 29 May 2026, and published a report on ADM in recruitment alongside it. Check the ICO website for the final version before you finalise your own procedures.
When the EU AI Act reaches UK firms
Brexit did not take UK firms out of scope. Under Article 2, the EU AI Act can apply to a UK organisation that:
- places AI systems on the EU market or puts them into service in the EU (as a provider)
- uses AI through an establishment in the EU, such as an EU subsidiary (as a deployer)
- provides or deploys an AI system whose output is used in the EU, for example AI-assisted analysis or content delivered to EU clients
Where the Act applies, Article 4 on AI literacy has applied since 2 February 2025. In July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) softened it. Providers and deployers must now “take measures to support the development of AI literacy” of their staff and others operating AI on their behalf, rather than ensure a “sufficient level” of it. The European Commission is clear that AI literacy remains an obligation, that national market surveillance authorities supervise and enforce it from 2 August 2026, and that no certificate is required: an internal record of training and other initiatives is enough.
For UK groups with EU operations or EU clients, the practical answer is to run one AI literacy programme that satisfies both regimes, with records that can be shown to an EU client or regulator. Our AI Governance & Compliance training shows compliance and legal teams how to map UK GDPR, the DUAA and the EU AI Act onto a single control set.
The UK employer AI checklist: six steps
1. Inventory where AI meets personal data
- List approved AI tools, AI features inside existing software, and AI that staff use without approval.
- Flag every use that involves personal data, special category data or decisions about people.
- Note which systems or outputs reach the EU.
A structured starting point is AccuroAI’s AI governance readiness assessment, which helps you see where your controls stand before you plan training.
2. Classify each use by risk
- Low risk: drafting, summarising or brainstorming with no personal data.
- Higher risk: anything involving customer or employee data, or outputs relied on externally.
- Highest risk: significant automated decisions about people, such as hiring, credit, pricing or access to services.
3. Do the data protection groundwork
- Confirm a lawful basis for each higher-risk use and update privacy notices.
- Run DPIAs where the risk is high, and revisit existing DPIAs for tools that have added AI features.
- For any ADM, document the Article 22A to 22D safeguards and who provides human intervention.
4. Set clear rules for staff
Publish a short AI acceptable use policy: approved tools, data that must never go into a prompt, when a human must review an output, and how to report a mistake without fear. Then make the policy visible in the tools themselves. Platforms such as AccuroAI’s workforce AI governance give security and compliance teams visibility of employee AI use and enforce data rules at the point of use.
5. Train by role, and keep records
| Audience | What they need to know |
|---|---|
| All staff | Approved tools, data red lines, hallucination and bias, how to report incidents |
| HR and recruiters | ADM safeguards, meaningful human review, fairness and equality risks |
| Managers | When AI output can be relied on, and who is accountable for decisions |
| DPOs, legal and compliance | UK GDPR and DUAA changes, DPIAs for AI, EU AI Act scope and Article 4 evidence |
| Security and IT | Shadow AI discovery, prompt data loss prevention, AI vendor review |
| Board and executives | AI risk appetite, oversight and reporting |
For the whole workforce, our Safe AI at Work programme covers the essentials in a single session. For directors and senior leaders, AI Risk & Strategy for Leaders focuses on oversight and accountability. Keep attendance, content and assessment records: they are your evidence for the ICO, EU clients and EU regulators alike.
6. Review every quarter
The ICO’s final ADM guidance, any future UK AI bill and EU guidance on Article 4 can all change what “good” looks like. Put a quarterly review in the diary, and refresh training when the rules or your tools change.
Frequently asked questions
Is there a UK law that requires AI training for employees?
Not a specific one. But UK GDPR requires appropriate organisational measures and accountability, and you cannot show either if staff do not know how to use AI tools safely with personal data. If the EU AI Act applies to you, Article 4 adds a direct duty to take measures to support staff AI literacy.
Does the EU AI Act apply to UK companies after Brexit?
It can. It applies to UK organisations that place AI systems on the EU market, use AI through an EU establishment, or provide or deploy AI systems whose output is used in the EU. A UK company using AI only for UK operations, with no EU output or customers, is generally outside its scope.
Can we now use AI to make decisions about people without a human?
Since 5 February 2026, UK law permits significant decisions based solely on automated processing outside special category data, but only with safeguards. People must be told about the decision and be able to make representations, obtain human intervention and contest it. Special category data remains more tightly restricted.
What does the ICO expect from organisations using generative AI tools?
The same data protection principles apply: a lawful basis, transparency, fairness, data minimisation, security and accountability. In practice that means knowing which tools staff use, controlling what personal data goes into them, carrying out DPIAs where risk is high, and training people.
Did the ICO change its name?
Yes, in substance. On 30 September 2026 the Information Commissioner’s Office became the Information Commission, governed by a board. It is still called the ICO, now standing for the Information Commission’s Office.
Get your teams ready
Product Innovation Academy runs AI literacy, AI governance and AI security training for UK employers, with AI Security & Governance programmes delivered in partnership with AccuroAI. Compliance and legal teams can also explore AccuroAI’s resources for compliance and legal teams. Request a proposal and we will tailor a programme to your tools, policies and regulatory footprint.
Sources
- Department for Science, Innovation and Technology, “A pro-innovation approach to AI regulation: government response”, February 2024 (summary by Baker McKenzie). insightplus.bakermckenzie.com
- Lewis Silkin, “AI judgment day on the horizon while UK lawmakers play catch up”, 14 September 2026. lewissilkin.com
- ICO, “Guidance on AI and data protection”. ico.org.uk
- The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, SI 2026/82. legislation.gov.uk
- Wiggin, “Key provisions of the Data (Use and Access) Act 2025 come into force”, 9 February 2026. wiggin.co.uk
- ICO, “ICO consultation on the draft guidance about automated decision-making, including profiling”, March 2026. ico.org.uk
- ICO, “Recruitment rewired”. ico.org.uk
- Lewis Silkin, “What the ICO’s transformation into the Information Commission means for your organisation”, 29 September 2026. lewissilkin.com
- EU Artificial Intelligence Act, Article 2: Scope. artificialintelligenceact.eu
- EU Artificial Intelligence Act, Article 4: AI literacy (consolidated text with amendments). artificialintelligenceact.eu
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union. eur-lex.europa.eu
- European Commission, “AI Literacy: Questions & Answers”. digital-strategy.ec.europa.eu