UK law changed in early 2026. Here's what that means for your AI tools — and what you can do about it today.
Bias and discrimination
What the Equality Act 2010 says about AI tools, how proxy discrimination works, and the five questions to ask about any AI making decisions about people.
Transparency and explanation
UK GDPR Articles 22A–22D (new from February 2026) and EU AI Act Article 50: what your AI must be able to explain, and what "meaningful" actually means in law.
Data privacy and security
UK GDPR Articles 5, 6 and 32: lawful basis for AI data use, security obligations, and the prompt injection attacks that are currently the most exploited AI vulnerability in the UK.
Bias
Equality Act 2010 — Direct and indirect discrimination via AI, including unintentional proxy discrimination. Liability sits with the deployer.
Transparency
UK GDPR Articles 22A–22D (new Feb 2026) — Right not to be subject to solely automated significant decisions without meaningful human involvement. Right to contest and to information.
Transparency
EU AI Act Article 50 (in force Aug 2026) — AI systems interacting with humans must disclose their automated nature. Applies to UK businesses serving EU users.
Privacy
UK GDPR Articles 5, 6 and 32 — Lawful basis for AI data use, data minimisation, purpose limitation, and appropriate security measures including resistance to adversarial attacks.