A founder I spoke with last month had spent an afternoon Googling “UK AI law” before our call. She came in convinced she needed a six-figure legal review before her team could keep using ChatGPT and a transcription tool. She runs a fifteen-person consultancy. By the end of the call she had a one-page register, a named owner, and a privacy notice tweak. That was the work. The panic was the expensive part.
The reason that confusion is so common is that the answer is not where founders expect to find it. There is no single UK AI Act sitting on a shelf. What you actually have to comply with is already familiar, just applied to a new kind of tool. This piece walks through what UK AI law really is in 2026, when it bites for a small service firm, and what to do about it before the next round of regulator activity.
What are a UK business’s legal obligations around AI?
A UK business’s legal obligations around AI sit in existing law, not an AI statute. UK GDPR applies whenever an AI tool touches personal data. The Equality Act 2010 covers discriminatory outcomes. Consumer protection law makes you responsible for what AI tells your customers. Sector regulators such as the FCA and the SRA add conduct rules. As of July 2026, no standalone UK AI Act exists.
The consumer protection point is newer than many owners realise. Since April 2025 the CMA has been able to fine up to 10% of global turnover for unfair commercial practices, and its March 2026 guidance on AI agents confirmed that a business is responsible for what its AI does in the same way it is responsible for what its staff do.
What does UK AI law actually look like in 2026?
The UK does not have a single AI Act yet. The government’s March 2023 white paper set five cross-sector principles that existing regulators are expected to apply within their own rulebooks: safety, transparency, fairness, accountability, and contestability. Bodies like the ICO, FCA, CMA, and Ofcom are now embedding those principles into rules they already enforce. The result is a patchwork, not a single statute.
That means there is no AI-specific licence to apply for, no AI register to file with a central body, and no separate AI inspector who turns up at your door. The relevant law for a small service firm is the law you already have. UK GDPR. The Equality Act 2010. Sector conduct rules if you are in financial services, healthcare, or another regulated field. The five AI principles are the lens regulators now use when they apply those existing powers to AI tools you bring into your business.
The government has signalled narrow legislation for the most powerful AI models, but as of July 2026 no AI bill is before Parliament and ministers have indicated none is coming in the short to medium term. For now, treating UK AI law as “existing law applied carefully to AI” is the accurate reading.
When do these rules actually bite for a small firm?
The trigger small firms hit first is UK GDPR. The ICO defines personal data broadly, so anything that can identify a person counts: names, emails, IP addresses, client records, call transcripts, CVs. The moment a tool processes that kind of data, UK GDPR applies, regardless of the size of your business. ChatGPT used on client emails, an AI screening service running CVs, or a transcription tool handling call recordings all qualify.
The higher-risk trigger is automated decision-making, and the rules here changed in February 2026. The Data (Use and Access) Act 2025 replaced the old Article 22 with new Articles 22A to 22D. Significant decisions made solely by automation, such as credit scoring or fully automated rejection of job applicants, are now permitted on any lawful basis, provided you meet the safeguards. You must tell people automation is being used, give meaningful information about the logic involved, offer human review, and provide a route to contest the decision. Decisions built on special category data remain tightly restricted. For a typical small consultancy this rarely bites, because humans are still in the loop. For anyone running automated screening or scoring, these safeguards are the first thing to study.
Equality law applies too. Biased AI outputs that result in less favourable treatment of someone with a protected characteristic can breach the Equality Act 2010, regardless of whether an AI-specific rule was breached. Employment lawyers have flagged AI-assisted recruitment tools as a particular risk for indirect discrimination if they are not tested and monitored.
What can it actually cost to get this wrong?
The ICO can fine up to £17.5 million or 4% of global annual turnover, whichever is higher, for serious UK GDPR breaches. That ceiling catches founders by surprise because it scales with turnover, not firm size. The British Airways breach in 2020 produced a £20 million fine after about 400,000 customer records were exposed. Marriott was fined £18.4 million the same month after a breach affecting 339 million guest records globally.
Neither was an AI case, but the same standards apply to AI tools that process personal data. The cost question is also wider than fines. Large clients, insurers, and lenders are starting to ask for documented AI governance, data protection impact assessments, and security certifications as a condition of doing business. Even where the law itself is light for a firm of your size, your clients may demand more. An employment tribunal claim under the Equality Act over an AI-assisted hiring decision can also land before any regulator gets involved.
There is also the EU angle, which catches a meaningful share of UK firms by surprise. The EU AI Act applies to AI systems placed on the EU market or whose outputs are used in the EU, regardless of where the provider is based. Fines for serious breaches can reach €35 million or 7% of global turnover. If your firm sells SaaS, services, or data-driven products into the EU, you may already be in scope.
What should a small firm actually do this month?
Four moves cover what UK regulators expect from a firm under fifty staff. First, write a one-page tool register of every AI tool in use, what data it touches, and what decisions it influences. Copilot, ChatGPT, the transcription tool, the chatbot on your website, the booking assistant. This single document is the artefact most-often-asked-for in any governance conversation, and it is the cheapest to produce.
Second, confirm and write down your lawful basis for using personal data in each tool, and apply data minimisation, feeding a tool only the data the task needs. For a typical small service firm the lawful basis will be legitimate interests or contract performance, occasionally consent. Avoid pasting confidential client material into third-party AI tools without checking the data processing terms, particularly around whether your inputs are used to train the provider’s models. OpenAI, Anthropic, Google, and Microsoft all publish current terms that say what happens to API and enterprise inputs.
Third, name one senior person as the AI owner. This is the accountability principle made concrete. It does not need to be a dedicated role, and for a small firm it usually sits with the operations director, the founder, or a partner. The point is that one person knows what tools are in use, what data they touch, and what to do if something goes wrong. Fourth, update your privacy notice to explain AI-related processing where AI meaningfully influences a decision about a person. Pricing, eligibility, screening, prioritisation: anywhere AI shapes the outcome that a customer or staff member experiences.
Where could this tighten quickly, and what should you watch?
The nearest concrete change is the ICO’s statutory code of practice on AI and automated decision-making. The regulations requiring it came into force in May 2026, final ICO guidance on automated decisions is expected later in 2026, and the code itself will follow. When it lands it will be the closest thing yet to a single ICO rulebook for AI, and firms that already have the four basics in place will adjust easily.
The other change to watch is the EU AI Act phasing in through 2025 and 2026. Its risk-based obligations apply to providers and deployers of high-risk systems, and its reach extends to UK firms serving EU customers. Even outside formal law, customers and insurers will increasingly ask for evidence of AI governance as part of procurement, particularly in regulated sectors. The direction of travel is towards more documentation and more named accountability, not less.
The honest read on UK AI law in 2026 is that it is largely existing law applied with new attention. The work for a small service firm comes down to making sure the basics of UK GDPR, equality, and sector conduct are actually being applied to the tools you have brought into the business in the last eighteen months. If you have not done a tool register yet, that is where to start. If you would like a second pair of eyes on what your firm should actually do, Book a conversation.
