Binds UK controllers making significant automated decisions with legal or similarly significant effects on data subjects. Replaces UK GDPR Art. 22 default prohibition on significant automated decisions. Controllers may now make such decisions using any lawful basis (incl. legitimate interests), but must: notify data subjects pre-decision, allow representations, provide meaningful human review, and enable contest rights. Special category data remains more restricted.
In force February 5, 2026 per SI 2026/82 (Commencement No. 6). Replaces and substantively restructures UK GDPR Art. 22: removes default prohibition; adds mandatory pre-decision notification, representations, human review, and contest rights. Secondary legislation: UK GDPR (Amendment) Regulations 2026.
Stated maximum penalty — UK GDPR penalties (up to £17.5M or 4% global annual turnover — whichever higher); ICO enforcement
Binds Any person in the UK who creates or requests creation of a non-consensual intimate deepfake image. Section 138 of the Data (Use and Access) Act 2025 inserts ss.66E–66H into the Sexual Offences Act 2003, criminalising the creation of non-consensual 'purported intimate images' (deepfakes) and the act of requesting such creation, even if the image is never distributed.
In force February 6, 2026 per SI 2026/31 (Commencement No. 5 Regulations 2026). Distinct from Crime and Policing Act 2026 (ss.66I–66L) which targets tool suppliers; this section targets end-users who create or request deepfakes.
Stated maximum penalty — Unlimited fine and/or summary imprisonment (Sexual Offences Act 2003)
Binds Individual developers, distributors, and corporate bodies (criminal offences); Ofcom-regulated platforms (OSA priority-content duty). Criminalises making, adapting, possessing, supplying, or offering to supply AI models optimised to generate CSAM (up to 5 years imprisonment). Separately criminalises AI “nudification” tools/deepfake intimate image generators. Upgrades AI-generated intimate image creation to priority offences under the Online Safety Act; Ofcom-regulated platforms must prevent and remove such content (up to £3M penalty for non-compliance).
Royal Assent: 29 April 2026 (2026 c.20). Section 99 (purported intimate image generators) and related provisions commenced 29 June 2026 via UKSI 2026/689 (Commencement No. 1). CSAM generator offences (Pt.3 Ch.3) commenced on same SI.
Stated maximum penalty — 5 years imprisonment (CSA/deepfake AI generator offences); £3M Ofcom fine (platform intimate image duty)
Binds Existing regulators (ICO, CMA, Ofcom, FCA) and the firms they oversee. Principles-based; ICO, CMA, Ofcom and FCA apply existing law to AI. No horizontal AI statute.
Binds Would create an AI Authority binding AI actors (if enacted). Private Member’s Bill to create an AI Authority; no government backing, unlikely as drafted.
Private Member’s Bill, no government backing; unlikely as drafted. The Government has signalled interest in future AI safety legislation but has not introduced a government-sponsored AI bill; rulemaking by sector regulators remains the more probable near-term route.
When does Pro-innovation framework (sector regulators) take effect in United Kingdom?
Pro-innovation framework (sector regulators) is already in force, with obligations live since February 5, 2026. No horizontal AI statute; five principles applied through existing regulators.
Who must comply with AI rules in United Kingdom?
Current obligations bind, among others, Existing regulators (ICO, CMA, Ofcom, FCA) and the firms they oversee; Would create an AI Authority binding AI actors (if enacted). Scope and thresholds vary per instrument — see each row's source for the legal text.
What are the penalties for AI non-compliance in United Kingdom?
Stated statutory maxima include: UK pro-innovation framework — Sector regulator powers; Crime and Policing Act 2026 — 5 years imprisonment (CSA/deepfake AI generator offences); £3M Ofcom fine (platform intimate image duty). These are the maximum amounts in the instruments; actual enforcement is at the regulator's discretion.
Not legal advice. Each obligation links to its primary source and carries the date it was last checked; verify the legal text before relying on it.