What shapes an AI project in the United Kingdom
In Britain the question is rarely whether AI is allowed. It is which existing duty applies to what the agent does, and whether you can show you met it.
| Topic | What it means for your agent | Decide early |
|---|---|---|
| Regulatory approach | The UK had not passed a general AI act when this page was reviewed. The data protection, financial, competition, communications and medicines regulators each apply their own rules to AI within their fields | Which regulator's guidance covers your use case |
| Personal data | An agent that reads customer or staff records is processing personal data under UK GDPR. It needs a lawful basis, a clear purpose and no more data than the task requires. The regulator expects a data protection impact assessment for most AI uses involving personal data | Who completes the assessment, and what the agent is kept away from |
| Automated decisions | Since changes that took effect in 2026, significant decisions may be made by automated means more widely than before, provided people are told, can make representations, can ask for a human to step in and can contest the result. Tighter limits apply where sensitive categories of data are used | Which decisions are significant, and how a person intervenes |
| Marketing and calls | Marketing emails and texts to individuals need consent or the existing-customer exception, automated marketing calls need prior consent, and live calls are screened against the Telephone Preference Service | What the agent may send or dial, and on what basis |
| Where the model runs | Sending personal data to a model hosted outside the UK is a restricted transfer. Providers offer UK or European processing regions and contract terms for this, and US providers can rely on the UK-US data bridge if they have joined it | Provider, region and transfer basis, recorded |
| Regulated sectors | Financial firms answer to the Consumer Duty for the outcomes an agent produces, and health tools face NHS and medicines rules. Equality law applies to automated treatment of people in every sector | Whether your sector adds duties of its own |
Agent workflows we build for British businesses
Four places where an agent removes routine work and a person keeps the judgement. More examples are in our AI agent solutions catalogue.
Customer service agent
For teams handling routine enquiries by chat and email.
- Customer asks a question
- Agent answers from approved content
- Identity checked before account details are shown
- Transfer to a colleague on request
- Transcript stored under the retention policy
Subject access request assistant
For organisations that spend days assembling one person's data.
- Request registered
- Agent searches the connected systems
- Draft bundle assembled
- Staff review and redact
- Response issued inside the statutory period
Purchase invoice processing
For finance teams entering supplier invoices by hand.
- Invoice received
- Supplier, amounts and VAT read
- VAT number and totals checked
- Queries sent to a person
- Bill created in the accounting package
Complaint triage
For regulated firms and utilities with a deadline on every complaint.
- Complaint recognised in incoming messages
- Category and urgency suggested
- Vulnerable customers flagged for a person
- Case opened with its deadline
- Handler receives a summary
What we build
Customer and staff assistants
Agents for service desks, websites and internal help, limited to approved content and able to hand over to a person. See the website chat agent.
Document and data workflows
Reading, checking and filing of invoices, forms and correspondence, with people handling the exceptions. See the document processing agent.
Impact assessment support
The technical half of a data protection impact assessment: data flows, model behaviour, risks and the measures that reduce them.
Human intervention by design
Review queues and override controls, so a significant decision can always be explained, challenged and changed by a person.
UK and European processing
Model and hosting choices that keep personal data in the regions your transfer rules allow.
Evaluation you can read
Plain reports on accuracy, refusals and escalations from tests on your own cases, repeated whenever the agent changes.
What we need from you
- The process you want to improve, with volumes and current timings
- Your data protection officer or adviser, from the first meeting
- Examples of real cases, anonymised
- Access to the relevant systems in a test environment
- A named person who can accept or reject the agent's output
Ownership and licensing terms are defined in the project agreement.
A readiness checklist for an AI pilot in the UK
Before the pilot starts
0 of 8 checkedChoosing a supplier for this work? Our guide to choosing an AI development company lists what to ask and what the answers should contain.
What to do next
Tell us about the process, the data it uses and who is responsible for it today. We will say plainly whether an agent suits it, what the assessment is likely to raise and how a pilot would run. Start a conversation or book a 30-minute call.
Common questions
Does the UK have an AI law?
Not a general one, as of this page's review. The government's approach has been to let existing regulators apply their own rules to AI. For most businesses the law that matters is UK GDPR, with equality law, consumer law and sector rules beside it. The Information Commissioner's Office publishes detailed guidance on AI and data protection, and it is the best starting point for a project.
Are fully automated decisions allowed under UK data protection law?
More widely than before. Changes that took effect in 2026 allow significant decisions to be made by automated processing, as long as safeguards are in place: the person is informed, can make representations, can obtain human intervention and can contest the decision. Stricter conditions remain where special category data is involved. We build those safeguards as working features, not as text in a policy.
Do we need a data protection impact assessment for an AI agent?
In most cases, yes. The regulator's guidance treats AI that processes personal data as likely to be high risk, which makes an assessment the expected first step. It records what the agent does, the risks to people and how they are reduced. Your organisation owns the document. We contribute the technical detail and adjust the design to its findings.
Can an AI agent phone or message our customers?
It can reply to people who contact you, and send service messages they expect. Marketing is tighter. Emails and texts to individuals need consent or the existing-customer exception, and automated marketing calls need the person's prior consent. Live sales calls must be screened against the Telephone Preference Service. An agent follows the same rules as a member of staff, and its system should enforce them.
Where to go from here
Related serviceAI AgentsAgents that work inside your systems, with approval where it matters