“Is there a UK AI Act?” is one of the most common questions UK businesses ask — and the answer surprises people. Here’s the clear position for 2026, cited to official sources. (dgm implements osFoundry as an independent partner. This is general information, not legal advice.)

The short answer: no

There is no UK AI Act. As of June 2026, the UK has no single, omnibus AI statute. It deliberately rejected the EU’s horizontal-law model in favour of a principles-based, regulator-led approach. And no standalone AI Bill appeared in the King’s Speech of 13 May 2026 — instead the government announced a “Regulating for Growth Bill” whose main AI mechanism is cross-economy regulatory sandboxing powers, not binding AI duties.

So if you’ve been told “you need to comply with the UK AI Act”, that’s a misunderstanding — there isn’t one.

How AI is actually regulated

“No AI Act” does not mean “no rules”. UK AI obligations flow from existing cross-cutting law applied to AI:

  • Data protection — UK GDPR + Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025;
  • Equality law (Equality Act 2010);
  • Consumer protection and product safety; and
  • Sector rules — the FCA (financial services), MHRA (medical devices), Ofcom (online safety).

The five principles

The 2023 white paper “A pro-innovation approach to AI regulation” set out five cross-sector principles that existing regulators apply within their remits:

  1. safety, security and robustness;
  2. appropriate transparency and explainability;
  3. fairness;
  4. accountability and governance;
  5. contestability and redress.

Note the model: existing regulators apply the principles — there’s no new single AI regulator enforcing a statute.

The big caveat: the EU AI Act

Here’s what catches UK businesses out. The EU AI Act applies extraterritorially. A UK firm that places AI systems on the EU market, or whose AI output is used in the EU, can be in scope regardless of having no EU establishment — much like GDPR. So “no UK AI Act” doesn’t mean “no AI statute applies to you” if you touch the EU market. (See our dedicated guide on the EU AI Act for UK businesses.)

What this means in practice

For most UK businesses, compliance means: get your data protection right (lawful basis, DPIAs, transparency, automated-decision safeguards), meet your sector regulator’s expectations, and — if you sell into the EU — classify against the EU AI Act. The recurring UK theme across regulators is “human in the loop” and accountability.

Where osFoundry and dgm fit

dgm implements AI with compliance designed in — data control (self-host in your own cloud or an EU region; osFoundry publishes US/EU/JP regions, not a UK one), audit logging, and human oversight. We are an independent integration partner with zero integrations so far, and not a law firm — for legal compliance decisions, take qualified advice. To scope a compliant AI project, book a consultation with dgm.