Every few weeks someone asks me a version of the same question. It usually comes near the end of a conversation, after we have talked about where the hours are going in their business. They have seen something that would obviously help them. Then they stop.
"Are we actually allowed to do that yet?"
It is a fair question. It is also costing people money. Worry about compliance is one of the most common reasons a small firm sits still on this. Not cost. Not skills. Worry about a law that nobody asking can quite name.
So here is the position, checked this month against the source documents rather than somebody's summary of them.
There is no UK AI Act
The House of Commons Library puts it plainly in its briefing on AI regulation, published in June this year. The UK does not have any AI-specific regulation or legislation covering AI as a technology. AI is regulated in the context in which it is used, through the legal frameworks that already exist.
The King's Speech in May contained no cross-sector AI bill either. There is a bill going through that touches AI, the Regulating for Growth Bill, but its AI provisions set up a sandbox for testing regulatory changes rather than new rules for using AI in your business.
The direction was set in a 2023 white paper, A pro-innovation approach to AI regulation, which argued for existing sector regulators rather than one new AI regulator. The current government has stuck with it. In February 2025 it told a parliamentary committee that most AI systems should be regulated at the point of use and that existing expert regulators are best placed to do that.
The government did signal back in 2024 that it would bring in binding rules for the handful of companies building the most powerful models. That legislation has still not appeared. Either way it is aimed at the people training frontier systems in data centres. It is not aimed at a builder using a tool to write quotes on a Sunday night.
Nobody is coming to inspect your chatbot.
That is the reassuring half. The other half matters more.
Five regimes that already apply to you
"No AI law" is not the same thing as "no law". Whatever you do with AI, you are doing it inside rules you were already inside. Five of them come up again and again.
1. Data protection
This is the big one. It is also the one that has actually changed.
The Data (Use and Access) Act 2025 amends the UK GDPR, the Data Protection Act 2018 and the PECR marketing rules. It does not replace them. The Information Commissioner's Office confirmed in June this year that all of its data protection provisions are now in force.
Two parts matter if you are using AI.
First, automated decisions. If a decision about a person is made purely by a machine and it has a significant effect on them, you now have more legal room than you had two years ago. The Act opened up almost the full range of lawful bases for that kind of processing, everything except the new recognised legitimate interests basis. That includes ordinary legitimate interests. That is a loosening, not a tightening. It comes with conditions attached. You have to tell the person a decision was made that way. You have to let them put their side of it. You have to let them get a human being involved. You have to let them challenge the outcome. Special category information, things like health or ethnicity, is still treated more strictly.
Second, there is a new duty on complaints. This is the one that catches people out. If somebody complains about how you have used their personal information, you have to make complaining easy, for example with a form on your website. You have to acknowledge it within 30 days and respond without undue delay. That duty applies whether or not AI was anywhere near the situation.
2. Equality law
The Equality Act 2010 does not care how a decision was reached. If a tool you bought screens people out in a way that disadvantages a protected group, the fact that a supplier built it is not much of a defence. You are answerable for it.
That is not the same as saying any unequal outcome is unlawful. Indirect discrimination has a defence built into it. If the practice is a proportionate means of achieving a legitimate aim, it stands. The problem is that you cannot run that argument at all if you have no idea why the tool rejected somebody.
This is not theoretical, although the enforcement comes from a different direction than you might expect. The ICO audited the firms that build AI recruitment tools back in 2024 and found real problems, including candidates not being told clearly how their information would be used. It followed that up in March this year with guidance aimed at employers. Watch for bias. Test for it regularly. Be clear with candidates that automation is in use. Explain how it works. Tell them how to ask for a human review.
Worth being precise about who does what here. The ICO polices data protection, not the Equality Act. But the two land on the same practical point, which is that you need to be able to explain a decision about a person. Follow the ICO's list and you are a long way toward defending the equality question too.
If you are a five-person firm hiring one person a year, you are almost certainly fine. If you have started running a stack of CVs through something clever, read that list again slowly.
3. Consumer protection
The Digital Markets, Competition and Consumers Act 2024 brought in a new consumer protection regime, which the Competition and Markets Authority has been enforcing since April 2025.
The part with AI written all over it is reviews. Posting fake reviews, commissioning them, hiding the fact that a review was incentivised, burying the bad ones so your star rating gives a misleading picture. All of that is now a banned practice, which means it is automatically unfair and illegal. No balancing test, no argument about intent.
The timing here is not a coincidence. Generative AI made producing plausible five-star reviews close to free. The law closed the door in the same period the tool arrived.
The same regime covers misleading claims in general. If a language model writes your marketing copy and it quietly overstates what you actually do, that is your claim, not the model's.
4. Employment law and watching your team
Data protection law does not stop you monitoring the people who work for you. It sets conditions on how.
The ICO has published guidance on monitoring workers. The short version is that you need a clear purpose. You need to tell people what you are doing. Where the monitoring is likely to be high risk, you need to assess that risk formally before you start rather than afterwards.
Vehicle trackers, call recording, productivity dashboards. All of it was already covered. This lands hardest on anyone running a fleet, which is why it is worth reading properly if you are thinking about AI in a field service operation. Adding AI on top does not create a new regime. It makes the existing one bite harder, because the analysis gets more intrusive and the records last longer.
5. Whoever regulates your sector
If you are in financial services, the FCA already has views. Medical devices, the MHRA. Online services, Ofcom under the Online Safety Act. If you hold a professional qualification, your professional body very likely has guidance of its own.
None of these regulators has been handed a new AI power. They have been told to apply the powers they already had.
The EU rules, if you sell into Europe
This is where the timing gets interesting, because something did just happen.
On 2 August this year the majority of the EU AI Act came into force and enforcement started. The transparency obligations in Article 50 began to apply, covering things like telling people when they are dealing with a machine and labelling synthetic content.
The rules for high-risk systems have moved. Following the Digital Omnibus on AI, obligations for the high-risk categories listed in Annex III now apply from 2 December 2027. High-risk AI built into regulated products follows on 2 August 2028. A further set of prohibitions arrives on 2 December 2026, aimed at systems generating non-consensual sexual imagery and child sexual abuse material. That same date carries a transitional deadline for systems already on the market before this August that generate synthetic content, which is the part more likely to touch an ordinary business.
None of this reaches you because you are British. It reaches you if you place AI on the EU market, or if the output of your system is intended to be used in the EU. A Newport software firm selling to a customer in Dublin should read it carefully. A Newport firm fitting bathrooms in Newport should not lose an evening over it.
What a small firm genuinely needs to have in order
Short list. This is most of the job.
Know what you are using. Write down the tools, who uses them and what information goes into them. Most firms cannot answer this off the top of their head. It takes an afternoon and it is the foundation for everything else.
Do not feed it what you would not post publicly. Customer records, staff details, anything commercially sensitive. Check what your supplier does with what you type into it. Free tiers and paid tiers frequently differ on exactly this point. The difference is rarely advertised.
Keep a person in the loop on decisions about people. Hiring, dismissal, credit, pricing that affects one individual. If AI narrows the field first, fine. A human makes the call and can explain how it was reached.
Say when it is not a person. If a bot answers your phone or your website chat, tell people. This costs you nothing and it is the single easiest thing on the list.
Check anything it writes before it goes out. You own the claim, the quote and the price. A tool that is confidently wrong about your lead time is your problem.
Make complaints easy. A form and a named person who reads it. That is now a duty rather than just good manners.
Update your privacy notice. If you have started using a tool that processes customer information and your notice does not mention it, that gap is the most likely thing to be held against you. It is also a twenty-minute fix.
None of that requires a lawyer. Most of it requires an afternoon and a willingness to write things down. Where it does get harder is when a team is using tools nobody sanctioned, which is usually a sign that the training has not kept pace with what people have already started doing on their own phones.
What you do not need
You do not need an AI policy drafted by a law firm. You do not need certification. There is no register to join, no licence to apply for and no inspector to satisfy.
If somebody is selling you AI compliance as a product, ask them which statute they are helping you comply with. Then watch their face.
Government's own direction of travel is the opposite of a new rulebook. It has launched an advisory sandbox, the AI Growth Labs, to help firms understand how existing regulation applies to what they want to build. Legal services went first, with applications open until late September.
Where to start
Not with the rules. With the work.
The firms that get into trouble here are rarely the ones that moved too fast. They are the ones that bolted a tool onto a process nobody had properly looked at in years, then found it was making decisions they could not explain to a customer. Understand where the hours actually go before you automate anything. The bottleneck audit is how I do that. It is the honest starting point for all of this.
Then pick one thing. Automate a process that is genuinely dull and genuinely repetitive. Keep a person on anything that touches a customer or a member of staff. Write down what you did and why.
That is the whole compliance job for most small firms. It is a great deal smaller than the worry that has been holding it up.
If you want a hand working out which part of your week is worth automating first, the initial conversation is free and there is no pitch attached to it. If it turns out there is something worth doing, I will follow it with a formal efficiency analysis that puts numbers against it. If there is not, I will tell you that instead. I work across South Wales and the South West, from Newport out to Swansea and across to Bristol. More on AI consultancy in Wales if that is your patch.