← Back to blog

The UK's AI Stance: What It Means for SMEs

The UK has no AI Act. So what actually governs how UK businesses use AI? Sector regulators, the Data (Use and Access) Act, recent case law, and the governance practices that tie them together.

Stylised pixel-art map of the UK rendered in points of light over a darkened cityscape, with red and blue light streams and a shield motif, representing the UK's distinctive approach to AI governance and the businesses it shapes

The UK’s path looks different. The practical implications follow.

The UK has deliberately chosen not to write an AI Act. There’s no new regulator and no single AI law. Instead, the country has settled on five cross-sectoral principles applied by existing sector regulators on a non-statutory basis, with delivery channelled through the AI Opportunities Action Plan, AI Growth Zones, and a scaled-up AI Safety Institute.

We’ve written separately about the UK’s stance in detail: what the approach is, what’s been delivered, and the tensions that haven’t been resolved. This post answers a different question: if you run an SME in the UK, what does this mean for you in practice?

What it means for SMEs

If you only skim one thing, start here:

  • Start with the rules and regulators already touching your business.
  • Check whether AI is involved in significant automated decisions about individuals.
  • Use support, sandboxes, and upskilling where they fit your sector.
  • Keep confidential or client-sensitive material out of public AI tools.
  • Check cross-border exposure if you serve UK users from abroad or sell into the EU.
  • Put a basic AI policy and clear accountability in place.

The detail behind that checklist is straightforward, but it matters.

Start with the rules and regulators already touching your business

There is no single UK AI law to comply with. For some SMEs, that means starting with a sector regulator and the guidance it has issued. If you’re in financial services, the FCA has mapped the five principles onto its existing frameworks: Principles for Business, SYSC, SM&CR, and Consumer Duty. If you’re in healthcare, MHRA guidance applies. If you’re handling personal data, the ICO matters.

Many early-stage SMEs will not have a clear sense of “their regulator” yet. In that case, start with the legal and commercial frameworks already touching the business: data protection, consumer law, employment law, sector-specific rules if they apply, and any contractual requirements imposed by customers or platforms. Then work out whether a sector regulator also sits over the activity.

Check automated decision-making rules

The Data (Use and Access) Act changes what you can do with automated decisions. If your business uses AI to make or inform significant decisions about individuals, for example in lending, hiring, or pricing, the rules have shifted. The blanket prohibition on solely automated decision-making has been relaxed, but with new safeguards. This is worth checking before you scale anything that materially affects people.

Use support, sandboxes, and upskilling where available

Support is actually available. The AI Assurance Innovation Fund and the upskilling programmes offer actual funding and practical support. The FCA’s “Supercharged Sandbox” with Nvidia and the MHRA’s Airlock phase two are sector-specific routes to test AI innovations with regulatory engagement. A new AI Growth Lab, legislated via the Regulating for Growth Bill, is intended to add a cross-sector regulatory sandbox once it stands up.

Do not upload sensitive data to public AI tools

Case law is starting to fill the gap. A reported Upper Tribunal decision in Munir v Secretary of State for the Home Department [2026] UKUT 81 (IAC) treated the use of public AI tools with confidential or privileged material as a serious legal and professional risk. The case arose in a legal-services context, so it should not be read too broadly, but it is a useful warning sign. For SMEs, the practical point is simple: if staff use public AI tools, your AI policy should say clearly what can and cannot be uploaded.

Watch cross-border exposure

If you’re based outside the UK but serve UK customers, or monitor their behaviour, with AI that processes personal data, UK GDPR Art. 3 can still catch you. The Data (Use and Access) Act 2025 keeps that territorial-reach principle intact. There is no UK-AI-specific equivalent of EU AI Act Art. 2, but where your AI touches UK residents’ personal data, you’re in UK GDPR scope regardless of where your company sits.

The EU AI Act can also matter even without an EU subsidiary if your UK business places AI systems or general-purpose AI models on the EU market, or if your system’s outputs are used in the EU. In practice, enforcement is much stronger where there is an EU foothold: an EU establishment, authorised representative, distributor, customer base, or other market-access channel. Many UK SMEs are purely domestic; for them, the EU AI Act may have limited practical relevance, and the UK framework will usually be the immediate compliance focus.

Put basic governance in place

Governance is what ties this together in practice. The absence of a single AI law does not mean no obligations. AI use is already covered by data protection, consumer law, equality law, sector rules, and contract terms. A basic AI policy, a risk-proportionate process, and clear accountability are usually enough. Our free Policy Wizard generates a baseline AI policy you can adapt; if you already have one, the Policy Scanner reviews it for gaps. Both have been updated to reflect the Munir ruling on public AI tools and supervisor responsibility.

Infographic titled "The UK's AI Stance: What It Means for SMEs", showing a distributed approach to AI governance in the UK with five themes radiating from a central UK map: SMEs and business impact, governance and risk, guidance and policy, case law and legal principles, and regulators working together. Footer reads: clear guidance, shared responsibility, better outcomes for business and society

The bottom line

For SMEs, the practical implication is the opposite of what the framing suggests. “Pro-innovation” does not mean “no rules.” It means a distributed framework, less straightforward to map than a single codified law but typically lighter to comply with than the EU’s risk-classification regime. The businesses that navigate this well will be the ones that treat AI governance as an ongoing practice (proportionate, sector-aware, and grounded in real risk) rather than waiting for a single UK AI Act that is unlikely to come.

If you want help thinking through how the UK landscape applies to your specific business, or how to build governance practices that are right-sized for your organisation, get in touch. We help businesses work through exactly these questions.

References