Customer-facing AI in a UK business: the rules that apply in 2026

The government set out a pro-innovation approach in a white paper in March 2023 and confirmed it in its response of February 2024. Instead of one AI law, existing regulators apply five principles in their own sectors: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.

The government said it would legislate when it was confident that was the right thing to do, and floated binding requirements only for developers of the most capable general-purpose AI. For a small business using AI, the practical consequence is that the law you already follow still applies, and nothing new replaces it.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its changes to automated decision-making came into force on 5 February 2026 and apply to decisions taken from that date. The ICO says the lawful bases for significant automated decisions are now wider and may include legitimate interests, but the safeguards still apply, and the change does not extend to special category data such as health information.

A new duty on handling data protection complaints took effect on 19 June 2026. The ICO's summary says to make complaining easy, for example with an electronic form, to acknowledge a complaint within 30 days, and to respond without undue delay.

The safeguards apply when a decision about a person is based solely on automated processing, with no meaningful human involvement, and has a legal or similarly significant effect on them. Declining a booking, an application or a refund automatically can fall into that category. Drafting a reply that a person reviews before sending generally does not, because a person is meaningfully involved.

Where the safeguards apply, the ICO's draft guidance says you should tell people about these decisions, let them make representations, provide human intervention, let them contest the decision, have a process for requests about it, and consider a data protection impact assessment.

That draft was published for consultation on 31 March 2026 and the consultation closed on 29 May 2026. The ICO's plans page expects the final version in winter 2026. Its main guidance on AI and data protection, last updated in March 2023, carries a notice that it is under review because of the new Act.

Know where AI touches personal data: which messages, records and fields it reads, and where they are sent. If a supplier's model processes customer data, check its terms and where the data goes.

Keep a person in the loop wherever a mistake would matter. An approval step before a reply is sent, or before anything is declined, is both good practice and the clearest way to avoid a decision being solely automated.

Tell people. Your privacy notice should say that you use AI, what for, and how to reach a person.

Keep a record of what the AI did: what it read, what it drafted, who approved it and what was sent. It is how you answer a complaint, and it is how you find a fault before a customer does.

Test the failures as well as the successes. Run the awkward cases on purpose before anything touches live work.

Make complaints easy, and acknowledge them within 30 days.

Every workflow we build records its actions, holds replies for approval wherever a mistake would matter, and is tested against named cases, including failures, before it goes live. Our AI Control Review applies the same checks to a workflow you already run.

Rules and guidance in this area are moving. We will update this article when the ICO publishes its final guidance, and the date at the top will show it.