The short answer
More than people assume, and less than people want. There is no single AI law in the United Kingdom. Instead, existing rules on data protection, consumer rights, equality and product safety already apply, enforced by the regulators who were already there. The European Union has taken a different route with a dedicated AI Act.
Existing law already covers a great deal
The common assumption is that AI is a legal vacuum. It is not. If a system processes personal data, data protection law applies. If it makes a decision affecting someone, equality law may apply. If it is sold with claims, consumer law applies.
That is why the UK's approach has been to let existing regulators handle AI in their own areas, rather than write one law covering everything. The data protection regulator, the competition authority and the financial regulator each already have powers.
The criticism of that approach is that it leaves gaps between regulators and depends on each having the expertise. The defence is that it avoids freezing a fast-moving field into a single statute.
ORBIT / THE NAVIGATOR
“Unregulated” is usually shorthand for “no law with the word AI in the title”. Plenty of law applies. Whether it applies well is the argument worth having.
Two different routes
The European Union has passed a dedicated AI Act, which sorts systems by risk and imposes obligations accordingly, with the strictest rules on high-risk uses and some practices banned outright.
The United Kingdom has so far preferred principles applied by existing regulators, with policy still developing.
If you use tools built elsewhere — and you almost certainly do — you feel both. Providers tend to build to the strictest regime they face and apply it broadly, because maintaining several versions is expensive.
What already applies in the UK
- Your personal data
- Data protection law, enforced by the Information Commissioner's Office.
- Decisions about people
- Equality law, where a decision affects someone with a protected characteristic.
- Things sold to you
- Consumer protection rules, including on misleading claims.
- Regulated sectors
- Existing sector rules — financial, medical, legal — apply to AI used within them.
The shape of the landscape rather than legal advice. Which rules apply depends on the circumstances.
What it means for you
You have more rights than you probably realise over your own data, including the right to ask what is held and to complain to the regulator if you are unhappy.
Marketing claims about AI products are subject to the same rules as any other claim. A product that does not do what it says is a consumer issue, not a technology issue.
What you do not have is a general right to an explanation of every automated output. That remains one of the live arguments.
What to actually do
- If something is done to you by an automated system, ask what data it used.
- Complain to the relevant regulator, not just the company. They record patterns.
- Treat sweeping “unregulated” claims as a prompt to ask which rules actually apply.
See it for yourself
Reading about it only gets you so far. This one is written to show you the thing described above, rather than describe it again.
When I use something you wrote for me at work, what am I responsible for, regardless of what your makers are responsible for? Be specific about where the line sits.
Then paste it into whichever assistant you use — ChatGPT, Claude, Gemini or Copilot. Not sure which? Meet them all.
If you remember nothing else
- There is no single UK AI law; existing regulators apply existing law.
- The EU has a dedicated AI Act sorting systems by risk.
- Providers often build to the strictest regime and apply it everywhere.
- Your data rights already apply, and the regulator takes complaints.
- A general right to an explanation of an automated decision is still contested.
Where this came from
- ICO, artificial intelligence guidancechecked 26 September 2026
- European Commission, the EU AI Actchecked 26 September 2026
Anything here that turns out to be wrong is worth telling us about. Figures that move — prices, sizes, energy use — are kept in the registry with their dates, rather than written into the prose where they would quietly go stale.
Questions about “The rules, and who makes them”Asked by readers, answered by us. Open to read them.
Open to load them.
Ask about this page and we will answer it here, where the next person can read it too.
Nobody else can answer you, and you cannot answer anybody else. This is not a forum — we would rather say that than run a room we cannot watch at three in the morning.
Your question goes up with the answer and without your name. Nothing identifies you, ever.
If we cannot answer it we will tell you why, and that one stays between us.