Vardonne

Insights · Guide V

The regulatory map

What applies to a UK firm using AI: the law already in force, what public buyers expect, and the EU rules that follow your output.

Figure 1 Three layers

The law that applies now

Data protection
UK GDPR as amended; ICO guidance on AI
Equality and consumer law
Unchanged by the technology
Sector rules
Your regulator’s existing rulebook

What public buyers expect

AI Playbook
Ten principles for government bodies
PPN 017
Questions on AI use in bids and delivery
PPN 014
Cyber Essentials where data or systems require it

The law that follows your output

EU AI Act
Where AI is placed on the EU market
Output used in the EU
Reaches providers and deployers outside it
Revised dates
High-risk rules from December 2027

Source: GOV.UK, ICO, European Commission1,2,5

The Playbook’s ten principles

Published for government in February 2025, the Playbook is the clearest statement of what a public body is expected to do with AI, and so of what it will expect of its suppliers.1

  1. You know what AI is and what its limitations are
  2. You use AI lawfully, ethically and responsibly
  3. You know how to use AI securely
  4. You have meaningful human control at the right stages
  5. You understand how to manage the full AI life cycle
  6. You use the right tool for the job
  7. You are open and collaborative
  8. You work with commercial colleagues from the start
  9. You have the skills and expertise needed to implement and use AI solutions
  10. You use these principles alongside your organisation’s policies and have the right assurance in place

The EU AI Act, and why it reaches UK firms

Article 2 applies the Act to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU where the output of the system is used in the EU.4 A UK firm selling an AI-enabled service to EU customers should read it as applying until advised otherwise.

Figure 2 EU AI Act: when each part applies

  1. 1 August 2024

    The Act enters into force.

  2. 2 February 2025

    Prohibited practices and AI literacy duties apply.

  3. 2 August 2025

    Governance rules and obligations for general-purpose AI apply.

  4. 2 August 2026

    General application, transparency rules and enforcement begin.

  5. 2 August 2026 2 December 2027

    High-risk obligations for Annex III uses (sensitive areas such as employment and credit).

  6. 2 August 2027 2 August 2028

    High-risk obligations for AI in regulated products (Annex I).

Struck dates are the originals, moved by the AI Omnibus, Regulation (EU) 2026/1744, in force 27 July 2026. Source: European Commission2,3

The Omnibus also adds a ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material from December 2026, extends some SME relief to small mid-caps, and softens the AI literacy duty.2,3

What is not coming

DSIT will not publish AI Management Essentials and will not make it a requirement of government procurement.6 For a UK firm, the working references remain the ICO’s guidance, the Playbook if you sell to government, and ISO/IEC 42001 if you want a formal management system around it.5

Sources

  1. Artificial Intelligence Playbook for the UK Government. GOV.UK, 10 February 2025.
  2. Regulatory framework for AI (application dates). European Commission, read 21 September 2026.
  3. AI Omnibus enters into force (Regulation (EU) 2026/1744). European Commission, 27 July 2026.
  4. Regulation (EU) 2024/1689 (the AI Act), Article 2. EUR-Lex, official text.
  5. Guidance on AI and data protection. Information Commissioner’s Office, read 21 September 2026.
  6. AI Management Essentials tool: government response. DSIT, GOV.UK, published 6 February 2026.
↑