AI Tracker
UK

The Information Commissioner's Office (ICO), the UK data protection regulator, has published guidance on how to apply existing data protection laws to AI, and an AI toolkit to help organisations identify and mitigate risks during the AI lifecycle.

• The UK General Data Protection Regulation (UK GDPR) (complemented by the Data Protection Act 2018 (DPA) and e-privacy legislation) requires organisations processing personal data to comply with principles of fairness, transparency, purpose limitation, minimisation, accuracy, accountability, storage and security, among others. It also includes strict rules about when automated processing (such as within an AI system) can be used to make decisions about individuals. The ICO has noted that these principles map closely to those in the AI policy white paper.
• During 2024, the ICO ran a consultation series on generative AI (GAI) and data protection, covering the lawful basis for web scraping to train GAI models, purpose limitation in the GAI lifecycle, accuracy of training data and model outputs, engineering individual rights into GAI models and allocating controllership across the GAI supply chain. The ICO reported on the outcomes of the consultation series and detailed its policy position in December 2024.
• The Data (Use and Access) Act,  which received Royal Assent, in June 2025 relaxed some constraints on automated decision‑making and expand lawful bases for data use in research and public services. This aligns with the UK's pro-innovation light-touch and principles-based approach to the regulation of AI. However, it stops short of adopting a House of Lords amendment requiring AI firms to disclose copyrighted training data after defeat by the Commons.
• On 11 February 2025, the ICO, along with four other data protection authorities, signed a Joint Statement at the Paris AI Action Summit, on building trustworthy data governance frameworks to encourage the development of privacy-protective AI.
• In March 2025, the ICO announced a commitment to produce a statutory code of practice for businesses developing or deploying AI, clarifying data protection expectations.
• In June 2025, the ICO announced its AI and biometric plan of action for 2025 to 2026 which includes updating guidance on automated decision-making (ADM) and profiling, developing a statutory code of practice on AI and ADM, and engaging with foundation model developers to ensure personal data is protected during AI model training.

• To date, the Intellectual Property Office (IPO), the official UK body responsible for intellectual property rights, has provided limited recommendations in respect of AI. Two open issues for AI businesses are (1) the extent to which copyright and database right materials can be used to train AI models; and (2) the difficulty in patenting AI technologies.
• The government acknowledged in March 2023 that there are several regulatory barriers faced by AI businesses in accessing copyright and database right materials. Currently, the Copyright, Designs and Patents Act 1988 protects source code, databases and other creative inputs often used to train AI. Text and data‑mining for non‑commercial research is already exempt.
• A working group was established by the IPO to resolve the use of creative inputs to train AI  through a voluntary code of practice. This group failed in February 2024 due to the strength of copyright owners' rights under the existing legislation. To address the impasse, the government is now considering responses to a wide-ranging consultation on introducing an exception to existing legislation to permit commercial uses of data mining, with an opt‑out mechanism for rights holders.
• Getty Images v Stability AI tested whether scraping third‑party content to train generative models infringes copyright or database rights. In the case, Getty Images alleged that Stability AI made unauthorised use Getty Images' content through "online scraping" for the training of the model underlying Stability AI's systems. In September 2025, the High Court in London issued a ruling siding with Stability AI stating, "An AI model such as Stable Diffusion which does not store or reproduce any Copyright Works (and has never done so) is not an 'infringing copy'." See our summary of the High Court's findings here
• Patenting AI technologies can be difficult, as mathematical methods and computer programs "as such" are excluded subject matter under the Patents Act 1977 and Patents Rules 2007. However, the use of AI algorithms to obtain an advantageous result may be patentable. The IPO’s May 2024 AI patent guidelines are on hold pending an appeal to the Supreme Court of the Emotional Perception AI case, which will likely settle questions around the patentability of AI systems. In 2023, with the Thaler case, the Supreme Court found that a patent's inventor must be a human and cannot be an AI system.
• In July 2025, the UK government formed new, expert working groups on AI and copyright with representatives from the creative industries and the AI sector focused on impacts, opportunities and common ground in the AI and copyright debate.
• In December, the government released the technical working group's terms of reference and a progress report on the use of copyright works in the development of AI systems.

Employers are subject to a patchwork of employment-related laws that apply in relation to their use of AI systems in the workplace. In addition to data protection rules that impose notice, purpose‑limitation and impact‑assessment obligations where automated systems influence employment decisions, employers must comply with:

• The Equality Act 2010, which prohibits direct and indirect discrimination based on protected characteristics such as such as age, sex, race, religious beliefs, sexual orientation, or disability, including when conducted through AI systems. If an individual complains that a decision made using an AI system was discriminatory, the burden shifts to the deployer of the AI system to prove that no unlawful bias or discrimination played a role in the decision affecting the impacted subject or, in the event of indirect discrimination, that any disadvantage can be justified.
• The European Convention on Human Rights, which requires transparency and proportionality when monitoring staff, for example through AI‑powered surveillance.
• The Trade Union Congress proposed an Artificial Intelligence (Regulation and Employment Rights) Bill in April 2024, with greater transparency duties, workplace AI risk assessment obligations and a right to consultation on “high‑risk” AI deployment. It has not secured government support, though the October 2024 Employment Rights Bill’s explanatory memorandum signals a future consultation on workplace‑surveillance technologies.

In July 2025, the Joint Committee on Human Rights launched an inquiry on human rights and artificial intelligence and how existing and potential regulation can protect rights in the age of AI.

In August 2025, the Trade Union Congress set forth six motions related to AI emphasising its proposal for a pro-worker AI and innovation strategy.

Competition

• The Competition and Markets Authority (CMA) identified AI as a strategic priority in its 2024/25 Annual Plan, indicating that it will be "vigilant of any competition concerns". It noted in its AI strategic update in April 2024 that these include AI exacerbating or taking advantage of existing problems and weaknesses in markets (particularly for recommendations, pricing, or personalisation) and the most powerful AI models being developed by a small number of the largest incumbent technology firms.
• The CMA also published a review of foundation models in September 2023 setting out principles for development of foundation models, including accountability to consumers, access to key inputs, interoperability, fair dealing and transparency. This was followed by an update paper on potential competition risk posed by foundation models in April 2024.
• The CMA has used its merger control powers to review AI partnerships such as Microsoft and Mistral, Microsoft and OpenAI, and Amazon and Anthropic. While no AI deal has yet been blocked, future investigations will likely re-test the CMA's theories of harm around loss of competition from the development and supply of chatbots and foundation models.
• The Digital Markets, Competition and Consumers Act empowers the CMA to impose conduct requirements on firms designated with strategic market status (SMS) in relation to designated activities such as AI deployment. These requirements can include rules on fair dealing, choice and transparency in AI deployment. Additionally, the CMA can make pro-competition interventions on undertakings designated with SMS. The CMA has launched investigations into both Google and Apple under the new regime.

Consumer protection

• Ofcom, the UK's communications regulator, is focused on the risks of synthetic media (deepfakes), personalisation, and security and resilience, according to its strategic approach. Under the Online Safety Act, which Ofcom has confirmed regulates generative AI and chatbots, providers of user‑to‑user and search services must assess and mitigate 'illegal' and 'lawful but harmful' content risks. Ofcom’s illegal harms Codes of Practice, which followed its consultation on protecting people from illegal harms online, sets out governance and accountability measures to mitigate harms.
• The government proposed an offence for making sexually explicit deepfakes, as part of its expected Crime and Policing Bill.
• In June 2025, Ofcom published its strategic response to AI, which focused on ensuring responsible AI integration within the communications sector, aligning with government principles, including on supporting innovation, and enhancing user safety through transparency and collaboration.
• The Advertising Standards Authority (ASA), the UK's advertising regulator, has advised that its Committee of Advertising Practice Codes are generally "media-neutral", and advertisements on AI products or using AI-generated content must not breach the existing Codes.
• The ASA has warned against exaggerating AI capabilities of a product or service (known as AI washing), as advertised AI capabilities must be accurate, verifiable and not misleading. It has also advised on using AI-generated content in advertisements, noting that such content will be held to the same standards as non-AI-generated content.
• From April 2025, the Digital Markets, Competition and Consumers Act gave the Competition and Markets Authority direct enforcement powers and introduced new consumer rights, including a blanket ban on fake reviews (an area exacerbated by generative AI).
• In November 2025, the UK government announced their intention to introduce legislation enabling designated organisations such as AI developers and the Internet Watch Foundation to rigorously test AI models for their vulnerability to generating child sexual abuse material, as part of an amendment to the Crime and Policing Bill.

Investment

• The National Security and Investment Act came into force in January 2022. It requires mandatory notification of certain transactions in the broadly defined "artificial intelligence" and "advanced robotics" sectors.
• The Investment Security Unit may call in for review, and potentially prohibit, any qualifying transaction which may give rise to UK national security concerns. The Investment Security Unity has so far reviewed hundreds of transactions, calling in 15 per cent for in‑depth AI-sector investigations. No prohibitions or conditions imposing clearance have been issued to date in the AI or advanced robotics sectors.