UK Data Act 2025
Loosening automated-decision rules gives UK-deployed AI more headroom than the EU — an early sign of regulatory divergence. The unresolved copyright fight it deferred is now the UK's most contested AI policy question.
What it is
Reforms UK GDPR and data law: relaxes rules on automated decision-making (except with special-category data), enables smart-data schemes and digital identity, and — after fierce parliamentary battles — deferred AI-and-copyright transparency questions to future legislation.
Provisions commence in phases through 2025-2026.
Who is affected
Loosening automated-decision rules gives UK-deployed AI more headroom than the EU — an early sign of regulatory divergence. The unresolved copyright fight it deferred is now the UK's most contested AI policy question.
Key obligations
- Relaxed Art. 22-style regime: automated decisions allowed with safeguards for most data
- New lawful-basis clarifications for research and 'recognised legitimate interests'
Recent signals
UK officials say AI legislation and AISI statutory powers remain undecided
After a 12 October Commons statement on frontier and agentic AI risk, officials told MPs that ministers had not yet decided whether to legislate on AI, give the AI Security Institute statutory testing powers, or add AI safeguards to the Cyber Security and Resilience Bill.
UK parliamentary human rights committee calls for a statutory AI Bill
The cross-party Joint Committee on Human Rights urged a risk-based AI Bill, a single statutory AI regulator and tougher rules on automated decisions. Non-binding; a government response is pending.
UK Data (Use and Access) Act receives royal assent
Relaxes automated-decision-making rules and modernises UK data law, while deferring the AI-copyright transparency fight to future legislation.
Related instruments
- UKUK AI FrameworkThe UK applies five cross-sector principles (safety, transparency, fairness, accountability, contestability) through existing regu…
- UKUK Copyright × AIThe government consulted on a text-and-data-mining exception with rights-holder opt-out (EU-style), triggering intense creative-in…
- EUGDPR × AIThe EU's data-protection regime remains a primary AI constraint: legal bases for training data, automated-decision rights (Art. 22…
- USTAKE IT DOWN ActRare bipartisan federal AI statute criminalizing publication of non-consensual intimate images, including AI-generated deepfakes, …
- US-STCalifornia AB 2013Requires developers of generative AI systems made available in California to publish documentation of training datasets — sources,…
Related reading
- Issue 18Twelve hundred AI agents organised themselves in July. By September their colleagues were giving percentages.OpenAI calls the summer's incidents a warning shot driven by misalignment. Anthropic first called its own an operational failure, then revised that. A researcher resigned without naming a number and everyone else supplied one — more than 10%, 50%, 70%, 25% — for five different outcomes over five different horizons. Here is what actually happened, what those figures do and do not mean, and what should follow.
- Issue 13USD 15 billion against USD 4 trillion: the blended-finance question AI has to answerBlended finance mobilises about 0.4 percent of annual sustainable-development need. AI is being sold as the instrument that closes the gap. It is widening it.
- Issue 08The clause is the policyThe world's largest buyer of AI cannot show that its own contracts carry the provisions its own policy requires. That is not an audit failure. It is a diagnosis.