A pro-innovation approach to AI regulation (CP 815) — the five cross-sectoral principles
Department for Science, Innovation and Technology, HM Government · guidance · in_force · v1 · official text
The UK's framework for AI is principles applied by existing regulators, not a statute. Five principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress. The white paper states they are issued on a non-statutory basis and implemented by existing regulators within their remits, with a statutory duty on regulators to have regard to them anticipated later. Held as guidance because that is what it is; the regulator that supervises you is where it becomes real.
- Section 3.2.3 — the five cross-sectoral principles The cross-sectoral principles — Safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress — applied by existing regulators, not enacted.
- Section 3.3 — non-statutory basis Implementation by existing regulators — The principles are not on a statutory footing; regulators apply them within their remits; a statutory duty to have regard to them is anticipated later.
Guidance on AI and data protection
Information Commissioner's Office · guidance · in_force · v1 · official text
The ICO's guidance on how UK data protection law applies to AI, last updated 22 September 2025, structured by principle: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; security and accountability; and individual rights, with a risk toolkit. It is not a statutory code: 'must' marks what the law requires and 'should' marks good practice. The ICO states the guidance is under review following the Data (Use and Access) Act 2025.
- About this guidance — status Status of the guidance — Not a statutory code: it interprets data protection law as it applies to AI ('must') and recommends good practice ('should'); under review after the Data (Use and Access) Act 2025.
UK GDPR, Articles 22A to 22D — automated decision-making, as inserted by section 80 of the Data (Use and Access) Act 2025
UK Parliament; Data (Use and Access) Act 2025 (c. 18) · binding · in_force · v1 · official text
The UK's rule on decisions taken solely by automated processing, in force from 5 February 2026. A decision is solely automated when there is no meaningful human involvement, and significant when it has a legal or similarly significant effect (Art. 22A). Such decisions may not be taken on special-category data except with explicit consent or where required or authorised by law (Art. 22B). For every significant solely-automated decision the controller must give information about the decision, let the person make representations, obtain human intervention and contest it (Art. 22C). The Secretary of State may define meaningful human involvement and similarly significant effect by regulations (Art. 22D). This replaced the former Art. 22 prohibition.
- Article 22A — automated processing and significant decisions Automated processing and significant decisions — Solely automated means no meaningful human involvement, judged with regard to how far the decision is reached by profiling; significant means a legal or similarly significant effect.
- Article 22B — special category data Automated decisions: special category data etc. — A significant solely-automated decision based on special-category data is allowed only with explicit consent, or where necessary for a contract or required or authorised by law with Article 9(2)(g) applying; and never in reliance on the recognised-legitimate-interest ground.
- Article 22C — safeguards Safeguards for automated decision-making — For every significant solely-automated decision on personal data the controller must give information about the decision, allow representations, provide human intervention and allow the decision to be contested.
- Article 22D — regulations Further provision about automated decision-making — The Secretary of State may by regulations define meaningful human involvement and similarly significant effect, and add safeguards.
← All jurisdictions