AI rules are arriving in stages: what leaders need to know.

What already applies in the UK

UK data protection law already applies to any AI that uses personal data. There is no waiting period: if an AI tool handles information about your customers, staff or residents, the usual rules on fairness, security and transparency apply today.

The Data (Use and Access) Act 2025 updated the rules on automated decisions, in force since 05/02/2026. Organisations have more freedom to use automated decision-making, but safeguards remain: people must be told about significant automated decisions, and be able to challenge them and ask for a person to review them.

What is coming in the UK

The ICO must now produce a statutory code of practice on AI and automated decision-making. No publication date has been set, so the practical step is to follow the ICO’s existing guidance and watch for the draft.

Sector regulators, such as the FCA, expect firms to manage AI risk within their existing rules. If you are regulated, your regulator’s current expectations already cover how you use AI.

If you serve EU users

EU AI Act duties to tell people they are dealing with AI have applied since 02/08/2026. Changes in force since July 2026 moved most high-risk rules to 02/12/2027, and to 02/08/2028 for AI in regulated products. The same changes adjusted some requirements, including the AI literacy duty.

What to do first

1. List the AI your people already use. Include the tools nobody approved. You cannot govern what you cannot see.
2. Agree who decides. Name the people who approve new AI uses and who are accountable when something goes wrong.
3. Write a short AI use policy. Say what staff can use, with which data, and what always needs a person to check it.
4. Look hardest at decisions about people. Where AI uses personal data or helps decide something about a person, check the safeguards first.
5. Train your people. Rules only work when the people using AI understand them.

Practical guidance, not legal advice. Dates checked 12/11/2026.