01 / THE REGULATORY LANDSCAPE A working map of UK law · aiact.uk
The UK already regulates AI. Nobody is conducting.
There is no single, comprehensive UK AI Act. This map brings together thirty-eight entries that shape artificial intelligence — statutes, regulations, bills in progress, standards and oversight bodies — administered by multiple bodies whose responsibilities overlap. The missing piece is not a thirty-ninth instrument. It is the layer that makes the existing framework work together.
About this map and its evidence
The 38 entries are this map's selection of laws, proposed legislation, standards and oversight bodies. Their legal status and territorial scope differ; a bill or voluntary standard is not an existing statutory duty. The proposed orchestration layer is a policy argument.
The orchestration argument and proposed duties are the author’s policy position.
What sits underneath
Select any instrument to read what it covers and where it stops.
The case
A single statute was never the missing piece
Arguments about UK AI regulation usually collapse into one question: do we copy the EU or not. That question skips the more useful one. What does the law already do, and what breaks when thirty-eight regimes meet one technology?
An organisation deploying a model into a hiring process can face overlapping duties: data protection law on the processing, equality law on the outcome, employment law where applicable, and contract law on the tooling it bought. Consumer law is also relevant where consumer relationships are involved. The organisation can receive partial answers, and existing coordination arrangements do not guarantee a single route through every overlapping duty.
That is an orchestration failure, not a coverage gap. It is not fixed by writing a new set of duties; it is fixed by legislating for how the existing duties are coordinated, resolved and surfaced.
Memoranda of understanding between regulators are not enforceable by the person harmed. A voluntary forum can be defunded. If coordination matters enough that the regime fails without it, it belongs in the statute — with named duties, named holders, and a route to challenge when it does not happen.
Coverage is wide, not thin
From equality law to medical devices to automated vehicles, many AI harms already have a statutory home. The Automated Vehicles Act 2024 sets out a detailed sector-specific safety framework, with full implementation planned for the second half of 2027.
The definitions do not match
The mapped frameworks use different concepts, definitions and thresholds. Compliance teams must translate between them as well as put controls in place.
Nobody holds the whole picture
Regulators see different parts of the picture. There is no comprehensive cross-sector register of consequential AI use, which can make systemic patterns harder to identify before harm occurs.
The person harmed carries the burden
Someone refused a loan, a place or a job by an automated system may have to navigate different complaint, regulator and court routes to challenge the decision.
The instrument map
Thirty-eight entries that shape AI governance
Grouped by the harm they address rather than by the department that owns them. Each entry records the responsible body, its relevance to AI, its legal status and the limits of its scope.
What the layer must do
Seven functions, each drafted as a duty
An orchestration layer earns its place only if it is specific. These are the seven things the existing thirty-eight cannot do for themselves, each written as something a named body owes and a person can enforce.
One set of definitions
A single statutory vocabulary for AI system, developer, deployer and automated decision, applied across the instruments by amendment rather than by guidance. Regulators keep their thresholds; they stop keeping their own dictionaries.
Precedent: the common definitions used across the NIS Regulations 2018 and its successor bill.A register of use
A statutory record of consequential AI use in public services and regulated sectors — what it is, who deploys it, what it decides. The Algorithmic Transparency Recording Standard already provides a record for in-scope tools in central government departments and relevant arm's-length bodies. The model works; the scope and the statutory footing are what is missing.
Precedent: Algorithmic Transparency Recording Standard, DSIT.One incident route
A single duty to report serious AI-caused harm, routed by the receiving body to whichever regulator owns it. Data breach reporting and NIS incident reporting already prove that a fixed clock plus a fixed recipient works.
Precedent: UK GDPR breach notification; NIS incident reporting.Assurance before deployment
For high-consequence settings only, evidence of testing and control presented before use, not after complaint. The Automated Vehicles Act 2024 sets out an authorisation scheme of this shape for one sector, with full implementation planned for the second half of 2027.
Precedent: Automated Vehicles Act 2024 authorisation; MHRA AI Airlock.Coordination with teeth
A statutory duty on the principal regulators to resolve overlaps, run joint casework and publish where they disagree. The Digital Regulation Cooperation Forum does this voluntarily today, which means it can stop.
Precedent: Digital Regulation Cooperation Forum; DMCC Act 2024 coordination duties.A bounded sandbox
Cross-cutting sandbox powers were announced in the 2026 King's Speech. Orchestration is what keeps them honest: published red lines, a time limit, a named decision-maker and a public record of every rule relaxed and why.
Proposed precedent: Regulating for Growth Bill, announced 13 May 2026; introduction still awaited.One door for redress
A person harmed by an automated decision should be able to bring it to one place and be routed onward. They should not have to identify the correct regulator in order to be heard.
Related models: the DRCF AI and Digital Hub coordinates advice for innovators; the Financial Ombudsman Service resolves eligible financial complaints.Where it runs out
The genuine holes, separated from the noise
Existing law reaches many AI harms, but coverage, assurance and enforcement remain uneven. These are areas where additional or clearer duties may be needed.
Frontier training and compute
There is no general UK authorisation requirement triggered solely by training a model above a specified capability threshold. Existing data, copyright and other laws can still apply; frontier safety commitments remain largely voluntary.
Open-weight release
Publishing weights makes downstream use harder to trace and control. Existing data protection, equality, consumer and sectoral laws still apply where their conditions are met, but there is no general UK regime governing open-weight release itself.
Agentic systems
Existing contract, consumer and other laws continue to apply when software acts on someone's behalf. Greater autonomy raises difficult questions about authority, oversight and how responsibility is allocated across a supply chain.
Models as components
Product liability assumes a defective product. A model supplied as a component into someone else's service sits awkwardly against the Consumer Protection Act 1987.
Synthetic media provenance
There is no general UK labelling or provenance obligation at the point of creation. Existing consumer, content and other duties may still apply to particular tools, services and uses.
Automated hiring and access
There is no universal standalone approval scheme for automated hiring. Existing duties can require assessment before use, including a data protection impact assessment for likely high-risk processing and equality consideration by public bodies.
Training data transparency
Copyright applies to protected reproductions, but there is no general UK duty to publish the training corpus. Limited visibility can make rights enforcement difficult.
Insurance and capital
There is no general AI-specific insurance or capital requirement across all deployments. Sector-specific insurance and prudential rules may still apply.
In Parliament
What is actually moving
The UK's direction has been incremental — amend the regimes that exist rather than replace them. That makes the orchestration question more urgent, not less.
No comprehensive AI bill in the 2026 King's Speech
The State Opening on 13 May 2026 set out the legislative programme without a comprehensive artificial intelligence bill. The Lords Library's background briefing described the UK's contextual approach: existing legal frameworks regulate AI according to how and where it is used.
Cyber Security and Resilience (Network and Information Systems) Bill
Introduced in the Commons in November 2025 and carried into the 2026–27 session. It is now in the House of Lords; the latest bill text was amended in Grand Committee on 7 September 2026, with report stage next. It would amend the NIS Regulations 2018 — widening scope to managed service providers and data centres, strengthening incident reporting, and creating powers to direct organisations on national security grounds. A significant proposed change to the AI operating environment.
Regulating for Growth Bill
Announced in the 2026 King's Speech. The proposed bill would create controlled sandbox powers to test innovations and possible changes to existing rules, including cross-sector AI uses. In a written answer on 10 September 2026, the government said introduction would follow when parliamentary time allows.
Data (Use and Access) Act 2025
Already on the statute book, with implementation in stages. Its reforms to solely automated decision-making commenced on 5 February 2026; it also establishes frameworks for digital verification services and smart data schemes. A significant AI-relevant change to UK law arrived inside a data bill.
In 1974, the people who built the technology stopped it themselves
What lasted from the recombinant DNA moratorium was not the pause. It was risk assessment, classification, notification before starting, graded controls and a standing expert committee — the same pattern the seven functions above describe.
Using this map
Built to be argued with
This page is maintained as a working document rather than a publication. If an entry is wrong, out of date, or missing an instrument that should be on it, that is worth knowing — the map is only useful if it is accurate.
It is intended for policy teams, regulators, boards and anyone who has to answer the question "which law applies to this" before deploying a system.
Send a correctionPrimary sources · key claims reviewed 15 September 2026
- Cyber Security and Resilience Bill — current parliamentary stage
- Automated Vehicles Act — implementation programme
- Automated passenger services — staged implementation
- Regulating for Growth Bill — 10 September 2026 parliamentary answer
- ICO — AI in recruitment outcomes report
- EHRC — public sector equality duty
- HSE — duties to non-employees under section 3
- CMA — complying with consumer law when using AI agents
- CMA — AI and algorithmic collusion
- ATRS — mandatory scope and exemptions
- Product safety — Great Britain and Northern Ireland scope
- Report on Copyright and Artificial Intelligence — March 2026
- Data (Use and Access) Act — February 2026 commencement regulations
- Biometrics and Surveillance Camera Commissioner — statutory role
Original references
- The King's Speech 2026: background briefing notes — Prime Minister's Office, published 13 May 2026
- Cyber Security and Resilience (Network and Information Systems) Bill — UK Parliament, bill page and stages
- Cyber Security and Resilience Bill: HL Bill 32 of 2026–27 — House of Lords Library
- King's Speech 2026: science, innovation and technology — House of Lords Library briefing
- Cyber Security and Resilience Bill briefing — House of Commons Library
- legislation.gov.uk — text of every Act and statutory instrument cited on this page
The scientists stopped their own experimentsJuly 1974 — February 1975
Recombinant DNA had just been demonstrated. It worked. It was the most promising thing in biology, and the people who had built it called for a voluntary pause in selected experiments while their potential hazards and suitable controls were assessed.
The request was voluntary. A dedicated recombinant-DNA oversight framework had not yet been established, although laboratories remained subject to other applicable rules. The moratorium held because a committee convened by the US National Academy of Sciences, chaired by Paul Berg, published a letter in mid-1974 asking colleagues to defer two classes of experiment voluntarily — and because enough of the small number of laboratories capable of the work agreed.
This page sets out why that pause was necessary, what it bought, where it failed, and which live British instruments descend from it.
The specific experiment nobody wanted to be the one to run
What triggered it
By 1973 it was possible to cut DNA from one organism, splice it into a circular plasmid, and put that plasmid into a bacterium that would then copy it indefinitely. The bacterium of choice was Escherichia coli — a strain of which lives in the human gut.
The proposal that concentrated minds was the cloning of DNA from SV40, a monkey virus that caused tumours in laboratory animals, into E. coli. If the resulting organism escaped and colonised people, nobody could say what would happen. Nobody could say it wouldn't, either. That was the whole problem: the question had not been asked in a form that could be answered, because until that year it had been hypothetical.
Two other categories worried the committee as much. Splicing antibiotic-resistance genes into bacteria that did not have them risked manufacturing resistance patterns that clinical medicine had no answer to. Splicing in genes for potent bacterial toxins risked the same thing with a sharper edge. These possibilities raised unresolved questions about risk, containment and responsibility.
Six arguments, each of which still has to be made separately
Why the pause was needed
A moratorium is a blunt, expensive instrument. It is justified only under particular conditions — and in 1974, all of them were met at once.
The capability arrived before the evidence
The technique was working in laboratories years before anyone had run a single study on what an engineered organism does outside one. There was no dose-response data, no escape modelling, no epidemiology, because the thing being studied had not previously existed. Ordinary scientific caution — proceed, observe, correct — assumes you can observe the failure and still be in a position to correct it.
Where the evidence base is empty and cannot be filled quickly, waiting is not timidity. It is the only way to acquire the information that would make proceeding rational.
The hazard could reproduce itself
This is the argument that carried the day, and it is the one that does not generalise cheaply. Unlike an inert substance, an organism may reproduce under suitable conditions. Survival, replication and spread depend on the organism and environment; the uncertainty made containment central to the debate.
Some possible releases could have been difficult to contain or reverse. The concern was a potentially self-propagating hazard whose likelihood and consequences were not yet well characterized.
There was no containment standard to comply with
Laboratories had practices for handling known pathogens, graded by how dangerous the organism was. Recombinant work did not fit: the hazard was not the parent organism but the novel combination, and there was no scheme for grading something nobody had characterised.
A pause is the correct instrument when the problem is not that people are behaving badly but that no one has yet written down what behaving well would consist of. The moratorium was, in effect, time allocated to drafting.
The restraint came from the people with most to lose
The signatories were not outsiders. They were the field's leaders, several of them working on exactly the experiments being deferred, with careers, laboratories and priority claims riding on speed. Berg himself shelved the SV40 work.
That is why it held without enforcement, and it is why it was credible. A warning from people who benefit from the warning being ignored is worth more, evidentially, than any amount of external alarm.
Public consent had to be earned before it was spent
Molecular biology was about to ask society for a great deal: money, laboratories in cities, eventually pharmaceuticals grown in engineered bacteria. Had the first public knowledge of recombinant DNA been an accident report, that permission would have been withdrawn for a generation.
The pause was partly an act of self-preservation, and it is not less honourable for that. A field that visibly polices itself before being told to is treated differently afterwards by legislators — as the comparatively permissive regimes of the late 1970s showed.
It had a question and a route to review
This is the condition most often missed. The 1974 letter did not call for an indefinite halt to genetic engineering. It named two classes of experiment, asked for a third to be approached carefully, proposed an advisory committee, and called an international meeting to settle the matter — which happened seven months later.
The letter proposed an international meeting and review of conditions for resuming work. It did not set a legally binding end date. Without that structure it would have been a ban by another name, and it would have collapsed, because the laboratories observing it had no reason to observe a halt with no terminus.
From scientific concern to an oversight framework
The sequence
-
1972–73The technique worksDNA from one organism is spliced into a plasmid and replicated in E. coli. Proposals to clone tumour-virus DNA follow almost immediately.
-
July 1974The Berg letterA committee convened by the US National Academy of Sciences publishes a call for voluntary deferral of the riskiest classes of experiment, asks the NIH to establish an advisory committee, and proposes an international meeting. Published simultaneously in the major journals so that no laboratory could claim not to have seen it.
-
Jan 1975Ashby reports in BritainA working party under Lord Ashby, set up the previous year, concludes the benefits are substantial though unpredictable and that the work should continue under proper precautions rather than stop. Cmnd 5880.
-
Feb 1975AsilomarAround 140 scientists, joined by lawyers, physicians and press, meet at Pacific Grove, California over four days. They agree that work may resume where containment is matched to the estimated risk, using both physical barriers and host organisms selected or modified to reduce survival outside laboratory conditions. A small number of experiment classes stay deferred.
-
June 1976NIH guidelinesThe Asilomar consensus becomes written rules with graded containment levels, binding on federally funded research and policed through institutional committees and a national advisory body.
-
Aug 1976Williams reportsThe UK working party chaired by Robert Williams publishes a code of practice with its own containment categories and recommends a central advisory body. Cmnd 6600.
-
Dec 1976GMAG convenesThe Genetic Manipulation Advisory Group meets for the first time, giving Britain a standing body to assess individual proposals rather than a one-off rulebook.
-
1978Voluntary becomes statutoryThe Health and Safety (Genetic Manipulation) Regulations require genetic manipulation work to be notified. Self-restraint is converted into a legal duty under the health and safety system.
What the interval made possible
What the pause produced
Not a ban, and not a delay for its own sake. The interval was used to invent a way of working that did not exist in July 1974 and that has governed the field ever since.
The central idea was proportionality: containment should be matched to the estimated risk of the specific experiment, not applied uniformly. That required a classification scheme — a tiering of work by hazard, with correspondingly graded laboratory requirements — and it gave regulators something they could actually administer.
The second idea was biological containment. Rather than relying only on physical barriers, researchers developed host systems intended to reduce survival outside controlled conditions. Biological containment complemented physical barriers; neither was an absolute guarantee of safety.
The third was institutional: a standing advisory body, notification before starting, local safety committees, and a route by which new classes of experiment could be assessed as they emerged. The pause ended, but the machinery it produced did not.
Follow the instrument, not the anecdote
Britain's answer, and where it ended up
The moratorium is usually told as an American story. The British response ran in parallel from 1974, took a different route — statutory, health-and-safety-based, case-by-case — and is still in force.
- 1975Ashby Working Party (Cmnd 5880)
Assesses the hazards of experimental manipulation of micro-organisms. Concludes the work should proceed with precautions.
- 1976Williams Working Party (Cmnd 6600)
Produces a code of practice, containment categories, and the recommendation for a central advisory group.
- 1976Genetic Manipulation Advisory Group
Assesses individual proposals case by case rather than issuing fixed rules — the British divergence from the American guideline model.
- 1978Health and Safety (Genetic Manipulation) Regulations
Notification becomes a legal requirement. Genetic manipulation is folded into the health and safety framework rather than given a bespoke statute.
- 1984Advisory Committee on Genetic Modification
Replaces GMAG, advising on contained use of genetically modified organisms.
- 2014 — in forceGenetically Modified Organisms (Contained Use) Regulations 2014
The current law, in force since 1 October 2014. Dutyholders must carry out a risk assessment, classify the work, notify the competent authority, apply control measures and report accidents. HSE guidance L29 sets out how. The competent authority is HSE together with Defra in England and Wales, and HSE with Scottish Ministers in Scotland. Premises undertaking contained use for the first time must file a premises notification before work begins.
- 2004 — activeScientific Advisory Committee on Genetic Modification
Advises the competent authorities on hazard identification and risk assessment for contained use, including advice on individual activities notified under the 2014 Regulations, and maintains a compendium of technical guidance.
Read as a chain, this is the argument the : the thing that lasted was not the moratorium. It was risk assessment, classification, notification before starting, graded controls, and a standing expert committee — a pattern already available to regulate a new technology without inventing a new legal order for it.
The case against treating 1975 as a template
What the pause did not do
Asilomar is invoked so often as a precedent that its failures get edited out. They are the most instructive part.
- It answered a narrow technical question. The agenda was laboratory biosafety. The ethical, military and commercial questions — germline modification, biological weapons, who would own the resulting organisms — were kept off the table, and several went unaddressed for decades.
- The public was discussed, not present. Lawyers and journalists attended; citizens, patients and workers did not participate in setting the rules. The legitimacy claimed for the outcome was consent inferred on the public's behalf by the people seeking it.
- The risk estimates were guesses. Participants said so at the time. Containment tiers were assigned on judgement, not data, and were substantially relaxed within a few years as evidence accumulated. The pause did not produce certainty; it produced a defensible way of acting under uncertainty.
- Self-governance did not hold on its own. Within four years Britain had converted it into statutory notification duties, and the guidelines elsewhere bound only publicly funded work. Voluntary restraint bought time for law; it did not substitute for it.
- The conditions were unusually favourable. A few dozen laboratories, one professional community, shared journals, no products on the market, no investors demanding a release date. A field with commercial deployment already underway and thousands of independent actors has none of those advantages, which is why later calls for moratoria in other fields have largely failed.
Generalising the reasoning rather than the event
Apply the test
The useful inheritance from 1974 is not "scientists should pause." It is a set of conditions under which pausing is the right instrument rather than a gesture. Tick the ones a given technology actually meets.
Is a moratorium the right instrument here?
An educational reasoning framework, not a validated scoring tool or legal test. Five conditions, drawn from the 1974–75 case. Your answers stay in this page and are never sent anywhere.
Applied to general-purpose AI, the third and fifth conditions are where the argument usually breaks: capability is diffuse and the exit is rarely specified. Applied to a narrow capability with a small number of frontier developers and a stateable safety question, more of the conditions hold. That distinction — instrument matched to condition — is the point of the exercise, and it is a matter of judgement on which reasonable people disagree.
Sources
Contemporary UK official documents and the current regulator guidance. Command paper numbers are given so the primary sources can be retrieved directly.
- Health and Safety Executive — Genetically Modified Organisms (Contained Use) Regulations 2014: guidance on regulations, L29 (5th edn), covering risk assessment, classification, notification, control measures and accident reporting. hse.gov.uk/pubns/books/l29.htm
- Health and Safety Executive — Scientific Advisory Committee on Genetic Modification: remit, terms of reference and the competent authority arrangements. hse.gov.uk/biosafety/gmo/sacgm.htm
- Health and Safety Executive — What work with GMOs requires notification: premises notification (CU1) and the pre-commencement requirements. hse.gov.uk/biosafety/gmo/notifications/what.htm
- Ashby, E. (1975) Report of the Working Party on the Experimental Manipulation of the Genetic Composition of Micro-organisms, Cmnd 5880, HMSO.
- Williams, R. (1976) Report of the Working Party on the Practice of Genetic Manipulation, Cmnd 6600, HMSO.
- Health and Safety (Genetic Manipulation) Regulations 1978 — the instrument converting notification into a statutory duty.
Thirty-eight UK instruments already reach artificial intelligence
The pattern this page traces — assess, classify, notify, grade the controls, keep a standing committee — is what the instrument map tests against the law as it currently stands.