What UK AI regulation means for your small business

No AI Act exists, but existing UK AI regulation still applies to your business. Here is what you are liable for and which government tools help.

Ethics & Technology · 10 October 2026 · 7 min read

If you use AI to answer customer emails, screen CVs or write product descriptions, you are already covered by UK AI regulation, even though no single law carries that name. The practical question is not what Parliament passes next. It is which existing rules apply to the tools you use today, and what you could show a regulator or an unhappy customer if something went wrong.

How UK AI regulation works without an AI Act

The UK does not yet have dedicated AI-specific legislation. As the House of Commons Library briefing on AI regulation explains, AI is regulated through existing legal frameworks, with regulators such as the ICO and Ofcom overseeing it, the latter under acts like the Online Safety Act 2023. In practice, the rules that already govern your customer data, your advertising, your contracts and your staff now govern the AI you use in each of those areas.

The government has also set out five principles that sector regulators are asked to apply. Its initial guidance for regulators on the AI principles lists them as safety, transparency and explainability, fairness, accountability and governance, and contestability and redress. Put them as questions and they become a useful test for any tool before you roll it out:

• Does it work reliably, and fail safely when it does not?
• Can you explain to a customer how it reached its answer?
• Does it treat people fairly?
• Who in your business is answerable for it?
• Can someone challenge the outcome and get it put right?

Size is no shield. The government’s impact assessment for the proposed AI regulatory regime confirms that it applies to all AI systems regardless of business size. Small and micro businesses are not exempt, though they must comply proportionately. A ten-person firm is not expected to produce the paperwork of a bank, but it is expected to have thought about the risks and to be able to say who is responsible.

Why you are liable for what your AI tools do

The sharpest edge is consumer law. The Competition and Markets Authority’s guidance on complying with consumer law when using AI agents says businesses are fully responsible for the actions of the AI agents they deploy, just as they are for their employees. Penalties for breaches can reach up to 10% of worldwide turnover.

Take a chatbot on your website that promises a refund your policy does not allow, or describes a product wrongly. You cannot treat ‘the software did it’ as an answer. Think of the tool as a new member of the sales team who has had no training. You would read what they say to customers, set limits on what they can promise, and give them someone to hand difficult cases to. Do the same for the tool.

Buying the tool in does not move the responsibility. The government’s research on AI activity in UK businesses found that approximately 40% of adopting businesses buy off-the-shelf solutions and 20% outsource development. For those firms, the tool belongs to a supplier but the complaint lands on them. Before you sign, ask the supplier what the tool does when it is unsure, what it records, and whether you can see and change its settings. If the answers are vague, that tells you something about the product.

Personal data adds a second layer. The ICO’s guidance on AI and UK GDPR applies data protection principles to AI systems. It includes an AI and data protection risk toolkit and advice on explaining AI-driven decisions. If AI touches customer or staff data, for example in CV screening or customer scoring, start there. If you cannot explain a decision in plain words to the person it affected, you have probably adopted the tool too quickly.

Government tools that help you check your own house

Two government tools are aimed at firms of your size. The Department for Science, Innovation and Technology’s AI Management Essentials (AIME) self-assessment tool, launched in early 2026, is designed to help organisations, especially SMEs and start-ups, evaluate and improve how they manage AI. Run it once to get a baseline. The gaps it shows will probably be basic ones: no list of the AI tools in use, no named owner, no plan for handling a complaint.

The second is the AI Risk Management Toolkit, published on 8 September 2026. It helps teams identify and manage legal, regulatory and ethical risks, and it is written for people who design, buy or operate AI systems. It is most useful at the point of purchase, when you are choosing between suppliers and can still walk away.

Both cost staff time, and neither is legal clearance. A completed self-assessment shows you have taken the issue seriously and gives you a record to point to. It does not protect you if a tool misleads a customer.

If you are building an AI-enabled product rather than simply using one, there is a third route. The government says regulatory sandboxes under the Regulating for Growth Bill, including the AI Growth Lab being set up in mid-2026, will let businesses of all sizes, micro included, test AI products in the live market with a time-limited relaxation of certain regulations. That can help if a specific rule is blocking a trial. The trade-off is that the relaxation is temporary, so you still have to design the product to meet the rules in the end. Most firms using off-the-shelf tools will have no need for a sandbox.

Finally, the government’s introduction to AI assurance describes assurance, the checks and standards that build trust in AI, as vital, and acknowledges that finding a way through the assurance market is especially challenging for SMEs. The sensible response is to keep your own checks simple: a list of tools, a named owner and a routine for testing outputs. Hold off on paying for heavy assurance services until your use of AI justifies them.

What to watch as the rules develop

Because there is no single AI statute, the rules that bite are the ones you already know: consumer protection, data protection and sector regulation. Changes are more likely to arrive as new guidance from those regulators than as one big law, so the ICO’s AI pages and the CMA’s guidance are the places to check periodically.

Watch your suppliers too. If a vendor changes its terms, adds an AI feature to a product you already use, or cannot answer basic questions about how its tool behaves, treat that as a risk to you, not to them. And apply one habit to every new use of AI: before it faces a customer, know who owns it, test it with awkward questions, and make sure a person can step in. That habit covers most of what the five principles ask of a small business.

Common questions

Do small businesses have to comply with UK AI regulation?

Yes. The government’s impact assessment for its proposed AI regime says it applies to all AI systems regardless of business size, and small and micro businesses are not exempt, though they must comply proportionately. In practice, existing consumer and data protection rules already apply to how you use AI today, whatever your size.

Does the UK have an AI Act?

No. The UK does not yet have dedicated AI-specific legislation. AI is regulated through existing laws, overseen by regulators such as the ICO and Ofcom. That means data protection, consumer protection and online safety rules apply to your use of AI now, rather than waiting for a single new statute.

What happens if my AI chatbot breaks consumer law?

You are responsible, because businesses are treated as fully accountable for AI agents they deploy, just as for employees. Penalties for consumer law breaches can reach up to 10% of worldwide turnover. To reduce the risk, review what the chatbot tells customers, limit what it can promise and give it a route to a human.

Sources

• House of Commons Library: briefing on AI regulation in the UK
• Department for Science, Innovation and Technology: Implementing the UK’s AI regulatory principles: initial guidance for regulators
• UK Government: UK AI regulation impact assessment
• Competition and Markets Authority: Complying with consumer law when using AI agents
• Office for Artificial Intelligence: AI activity in UK businesses, executive summary
• Information Commissioner’s Office: Guidance on AI and data protection
• Department for Science, Innovation and Technology: Guidance for using the AI Management Essentials tool
• Department for Science, Innovation and Technology: AI Risk Management Toolkit guidance
• UK Government: Regulatory sandboxes: what businesses can expect
• UK Government: Introduction to AI assurance