The regulators: safety without an AI Act

The UK regulates artificial intelligence (AI) through a sectoral approach, without a single standalone AI Act. Instead, existing regulators such as the Information Commissioner’s Office (ICO), Ofcom, the Financial Conduct Authority (FCA), the National Cyber Security Centre (NCSC), and the Medicines and Healthcare products Regulatory Agency (MHRA) each apply their authority to AI systems.

This creates a complex regulatory landscape where compliance can stem from multiple directions. Understanding how these regulators operate and what obligations they impose is essential for anyone deploying AI systems in the UK.

Regulatory bodies and their AI mandates

The UK’s regulatory approach to AI is fragmented, with each sector-specific regulator adapting its existing laws to cover AI. The Information Commissioner’s Office (ICO) has taken a proactive stance, introducing an AI auditing framework and issuing practical toolkits. A statutory duty was enacted on 12 May 2026 to produce a code of practice on AI and automated decision-making.

The ICO is also actively engaging with 11 large-scale foundation-model developers. Additionally, the ICO has planned agentic-AI guidance for the 2026-27 period.

Ofcom, responsible for online safety, is applying the Online Safety Act (OSA) to generative AI. Its 2026-27 AI strategy outlines steps to manage risks from AI systems. In January 2026, Ofcom initiated its first major enforcement action under the OSA against the platform X for distributing sexual deepfakes generated by Grok.

This marks a significant moment in the regulation of generative AI.

Financial services and cybersecurity oversight

The Financial Conduct Authority (FCA) has integrated AI into its regulatory framework through the Supercharged Sandbox. In its second cohort, announced in July 2026, 21 firms were selected from 199 applications. Anthropic was named as the technology partner, providing access to its Claude AI model for participating firms.

The Mills Review, which examined AI governance in financial services, recommended the development of a dedicated AI assessment capability within the FCA.

The National Cyber Security Centre (NCSC) issued updated guidelines for secure AI system development in June 2026. These guidelines cover the entire lifecycle of AI development. The NCSC also conducted a public-sector AI cyber risk assessment and co-authored Five Eyes guidance on agentic AI security with international partners.

Medical devices and AI innovation

The Medicines and Healthcare products Regulatory Agency (MHRA) has focused on AI in medical contexts through its AI Airlock sandbox. This pilot concluded in May 2026 and involved seven innovators. The initiative received three-year funding of 3.6 million pounds, demonstrating the regulator’s commitment to safely integrating AI into healthcare technologies.

Compliance complexity and practitioner guidance

Because AI systems are regulated by multiple agencies, practitioners must identify which of the five regulatory remits apply to a given deployment. For example, a generative AI model used in financial services might be subject to both FCA and ICO oversight. Most real-world AI systems engage more than one regulator, and no single filing covers all requirements.

This approach increases compliance complexity but also ensures a more holistic regulatory perspective.

What to take away

The UK’s regulatory environment for AI is defined by a lack of a single AI Act and a reliance on sectoral regulators. Each regulator, ICO, Ofcom, FCA, NCSC, and MHRA, has distinct obligations and guidance for AI deployment. Practitioners must therefore map their systems against all relevant regulatory domains to ensure compliance. This fragmented model demands a more nuanced understanding of how different regulatory bodies interact and apply their mandates to AI technologies.

Reference

Sources and further reading

• ICO AI auditing framework
• NCSC secure AI development guidelines
• MHRA AI Airlock