Keeping control of AI in a UK organisation

Many teams now use AI tools to draft, sort and answer questions. Someone in the organisation still decides what those tools may do, and checks what they did.

The UK's approach to regulation

In March 2023, the government of the day published a white paper on AI regulation. It set out five principles for existing regulators to interpret and apply in their own areas:

The white paper proposed issuing the principles on a non-statutory basis, with no new AI regulator. In its response of February 2024, the government said it would keep the non-statutory approach under review. It also asked a number of regulators to publish their strategic approach to AI.

Personal data

The government's AI security code tells organisations that use personal data in an AI system that they may have data protection obligations. It points them to the Information Commission (which took over from the ICO on 30 September 2026) for guidance.

The Information Commission publishes guidance on AI and data protection, which applies the principles of the UK GDPR to AI systems. It also gives practical advice on explaining decisions made with AI to the people they affect. Its AI and data protection risk toolkit helps organisations assess the risks their own AI systems pose to people's rights and freedoms.

The Information Commission says its AI guidance is under review after changes made by the Data (Use and Access) Act.

Security

The National Cyber Security Centre (NCSC) publishes guidelines for secure AI system development. It groups them into four stages, from secure design and development through to secure deployment, operation and maintenance. NCSC says security must be a core requirement throughout the life of the system.

In January 2025, the government published a voluntary Code of Practice for the Cyber Security of AI. It names risks particular to AI, such as data poisoning and indirect prompt injection.

The code's principles include these duties:

Checking your own practice

The Department for Science, Innovation and Technology (DSIT) consulted on a tool called AI Management Essentials. DSIT describes it as a self-assessment tool to help organisations assess and implement responsible AI management systems and processes.

DSIT invited views in particular from start-ups and small and medium-sized businesses that build or use AI. It has since published its response to the consultation.

Research on advanced AI

The AI Security Institute is a research organisation within DSIT. Its staff study the capabilities and impacts of advanced AI, and develop and test ways to reduce the risks.

Useful links