<p><em>No dedicated AI Act, a voluntary cyber security code that is turning into a global standard, and a data protection reform that quietly flipped the default rule on automated decisions &#8212; fifteen months after DSIT&#8217;s code, a House of Commons Library briefing confirms Parliament still has no AI Bill in front of it.</em></p>
<p>A timeline sits at the top of this piece, plotting dated milestones in UK and EU AI governance from the 2023 white paper through to the EU AI Act&#8217;s final compliance deadline &#8212; now 2 August 2028, not 2027, after the EU&#8217;s Digital Omnibus on AI postponed the Act&#8217;s high-risk-system dates in July 2026. It is built to make one thing visible: the UK has not passed a dedicated AI law, and is not close to one &#8212; what has actually happened is a sequence of voluntary codes, joint technical guidance, standards-body work and a data protection Act that touches AI only indirectly, several of which the widget lets you scrub through by date rather than take on trust from a single source.</p>
<h2>Key findings</h2>
<ul>
<li><strong>The commonly cited &#8220;January 2025&#8221; date for the AI Cyber Security Code is close, but the precise date matters and is checkable.</strong> DSIT&#8217;s &#8220;Code of Practice for the Cyber Security of AI&#8221; was published on <strong>31 January 2025</strong>, confirmed directly on its GOV.UK page. It is explicitly, repeatedly, &#8220;a voluntary Code of Practice&#8221; &#8212; not a rule, not a certification requirement. Its scope covers 13 principles grouped into five lifecycle phases: secure design, secure development, secure deployment, secure maintenance and secure end of life.</li>
<li><strong>The Code is not standing still: it is becoming an international technical standard.</strong> NCSC&#8217;s own blog post, dated 22 May 2025, confirms NCSC and DSIT worked with ETSI&#8217;s Technical Committee on Securing AI to publish a technical specification and implementation report, &#8220;Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems,&#8221; carrying the same 13 principles and five phases as the UK Code. The UK government has said it will update the Code itself to mirror the ETSI documents going forward. This is the clearest evidence found in this research of the Code&#8217;s direction of travel &#8212; toward a recognised global baseline, not toward UK statute.</li>
<li><strong>The &#8220;NCSC guidelines on secure AI development&#8221; often cited are real, and distinct from a separate joint US/UK document worth citing alongside them.</strong> NCSC&#8217;s &#8220;Guidelines for secure AI system development,&#8221; produced with CISA and endorsed by agencies from 18 other countries (with 21 further international agencies and ministries involved in its development), is dated <strong>27 November 2023</strong> on NCSC&#8217;s own site (a US-dated CISA alert on the same guidance is dated 26 November 2023 &#8212; a one-day, timezone-consistent difference, not a factual conflict). It structures advice around four lifecycle stages: secure design, secure development, secure deployment, and secure operation and maintenance. A second, later document is also directly relevant and easy to conflate with it: &#8220;Deploying AI Systems Securely,&#8221; a joint Cybersecurity Information Sheet published 15 April 2024 by the NSA&#8217;s AI Security Center with CISA, the FBI, and the national cyber agencies of Australia, Canada, New Zealand and the UK (NCSC-UK). It focuses specifically on securely operating externally developed AI systems, a narrower and later-stage question than the November 2023 guidelines&#8217; design-through-development focus.</li>
<li><strong>ICO guidance on AI fairness is real, detailed, and &#8212; as of this piece&#8217;s access date &#8212; explicitly marked as under review because of new legislation.</strong> The ICO&#8217;s &#8220;Guidance on AI and data protection&#8221; was substantially restructured on 15 March 2023 around the UK GDPR&#8217;s own principles (fairness, transparency, lawfulness, accountability), with a dedicated fairness chapter and DPIA-specific content for AI. Its fairness chapter, read directly on ICO&#8217;s site for this piece, defines fairness precisely: processing personal data &#8220;in ways that people would reasonably expect&#8221; and not in ways causing &#8220;unjustified adverse effects,&#8221; and separately warns that &#8220;common practice&#8221; is not the same as meeting reasonable expectations. That same live page currently carries this notice, in the ICO&#8217;s own words: <strong>&#8220;Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.&#8221;</strong> Any reader relying on this guidance should treat the fairness chapter as provisional, not settled, pending that review.</li>
<li><strong>The &#8220;Data Use and Access Act 2025&#8221; is real, and it changes UK AI-relevant law more specifically than is commonly assumed &#8212; via a rewrite of automated decision-making, not AI itself.</strong> The Data (Use and Access) Act 2025 received Royal Assent on <strong>19 June 2025</strong>, confirmed directly on the ICO&#8217;s own site. Its most consequential AI-relevant change: on 5 February 2026, the Act&#8217;s section 80 replaced UK GDPR Article 22 with new Articles 22A-22D. This flips the previous default. The old Article 22 prohibited solely automated decisions with legal or similarly significant effects on people unless a specific exception applied; the new regime permits such decisions by default, subject to safeguards &#8212; the right to be informed, to request human review, and to contest the outcome &#8212; and reserves the strict prohibition for decisions involving special category data. The ICO ran a consultation on draft guidance for the new regime, closing 29 May 2026. This is a genuinely significant, dated, checkable fact, arguably more operationally significant for CISOs running AI-driven decision systems than the voluntary cyber code.</li>
<li><strong>&#8220;Forthcoming White Papers&#8221; (plural) is stale framing, and this piece corrects it.</strong> There is no evidence found in this research of a further, dedicated UK AI white paper or AI Bill in active preparation. A House of Commons Library research briefing, published 10 June 2026, states plainly that the UK has no single AI Act and no AI-specific bill currently before Parliament. The operative UK approach remains the one set out in DSIT&#8217;s original white paper, &#8220;AI Regulation: A Pro-Innovation Approach,&#8221; published 29 March 2023, and the government&#8217;s consultation response confirming that approach on 6 February 2024: five cross-sectoral principles (safety/security/robustness, appropriate transparency and explainability, fairness, accountability and governance, and contestability and redress) applied by existing regulators &#8212; principally the ICO, Ofcom, the Competition and Markets Authority and the Financial Conduct Authority, coordinating through the Digital Regulation Cooperation Forum &#8212; rather than a horizontal statute. CISOs should plan around this cross-sectoral reality, not around an AI Act that, as of this piece&#8217;s access date, does not exist and has no bill before Parliament.</li>
<li><strong>The EU AI Act is real, dated, and phased &#8212; but its high-risk-system timetable changed just six days before this piece&#8217;s access date, and any account still reporting the original 2 August 2026 deadline is now out of date.</strong> Regulation (EU) 2024/1689 entered into force 1 August 2024, with obligations originally phased in over three years: prohibited-practice and AI-literacy provisions from 2 February 2025, general-purpose AI model obligations from 2 August 2025, and high-risk system obligations originally due from 2 August 2026. But the Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 &#8212; before that 2 August 2026 date arrived &#8212; postponing stand-alone high-risk system obligations under Annex III to <strong>2 December 2027</strong>, and high-risk AI embedded in already-regulated products under Annex I (plus legacy general-purpose AI compliance) to <strong>2 August 2028</strong>. GPAI enforcement powers and the Article 50 transparency obligations (AI-generated content disclosure, deepfakes, emotion recognition) were not delayed and did apply from 2 August 2026 as originally scheduled. UK organisations that sell into the EU or build products for EU customers need to track these revised dates; a UK-only organisation with no EU market exposure is not directly bound by the Act.</li>
</ul>
<h2>The UK&#8217;s approach: principles applied by existing regulators, not a single AI law</h2>
<p>CISOs looking for a single &#8220;AI Act&#8221; to read and comply with will not find one in UK law. The government&#8217;s operative position, set out in its March 2023 white paper and reaffirmed in its February 2024 consultation response, is deliberately not to legislate horizontally across all AI. Instead, five cross-sectoral principles &#8212; safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress &#8212; are meant to be applied contextually by the regulator already responsible for a given sector or activity: the ICO for data protection, the FCA for financial services, Ofcom for online services, the CMA for competition and consumer issues, coordinated loosely through the Digital Regulation Cooperation Forum. The government has said since 2024 that it recognises &#8220;binding requirements&#8221; could eventually be needed for the most capable general-purpose systems, but as of a House of Commons Library briefing published 10 June 2026, no AI-specific bill has been introduced to Parliament. Any CISO briefing that assumes a UK AI Act is imminent, or that a further dedicated AI white paper is forthcoming, is working from an outdated premise.</p>
<h2>Cyber security specifically: a voluntary code becoming a global standard</h2>
<p>Where the UK has moved further and faster is cyber security of AI specifically, not AI regulation generally. NCSC and CISA&#8217;s &#8220;Guidelines for secure AI system development&#8221; (27 November 2023) set out lifecycle-based advice &#8212; secure design, secure development, secure deployment, secure operation and maintenance &#8212; endorsed by agencies from 18 other countries. DSIT built directly on that work with its &#8220;Code of Practice for the Cyber Security of AI,&#8221; published 31 January 2025: 13 principles across five lifecycle phases (secure design, secure development, secure deployment, secure maintenance, secure end of life), explicitly voluntary, developed after a Call for Views that ran 15 May to 9 August 2024 and that DSIT says was endorsed by 80% of respondents. Separately, a joint US-led Cybersecurity Information Sheet, &#8220;Deploying AI Systems Securely&#8221; (15 April 2024), issued by the NSA&#8217;s AI Security Center with CISA, the FBI and international partners including NCSC-UK, gives more operationally specific advice on running AI systems built by someone else &#8212; relevant to the very common case of an organisation deploying a third-party or vendor AI model rather than building one from scratch.</p>
<p>The most significant recent development is that this voluntary code is becoming a global technical standard. NCSC&#8217;s own 22 May 2025 blog post confirms NCSC and DSIT worked with ETSI&#8217;s Technical Committee on Securing AI to publish a technical specification and implementation report carrying the same 13 principles and five phases as the UK Code, and states the UK government will update its own Code to track the ETSI documents going forward. For CISOs, this is the practical signal to watch: a document that starts as UK voluntary guidance is being engineered into an international baseline that vendors and customers across the AI supply chain may increasingly expect as a de facto minimum, well ahead of any UK statutory requirement to adopt it.</p>
<h2>Data protection: fairness and DPIAs are settled principles, but the automated-decision rules underneath them just changed</h2>
<p>The ICO&#8217;s AI-specific guidance rests on ordinary UK GDPR principles, applied to an AI context, not a bespoke AI fairness test. Its fairness chapter is precise on this point: fairness means processing personal data &#8220;in ways that people would reasonably expect&#8221; and avoiding &#8220;unjustified adverse effects,&#8221; and it explicitly separates data protection&#8217;s fairness principle from &#8212; while noting it sits alongside &#8212; Equality Act 2010 discrimination law, which the ICO says is a distinct legal framework organisations must also consider. DPIAs, in the ICO&#8217;s framing, are not a bureaucratic gate but the mechanism for demonstrating that AI processing is &#8220;necessary&#8221; and &#8220;proportionate,&#8221; including evidence that less risky alternatives were considered.</p>
<p>What has genuinely changed underneath this is narrower and more mechanical than &#8220;AI regulation&#8221; as a whole: the rules on automated decision-making. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and on 5 February 2026 its section 80 replaced UK GDPR Article 22 with new Articles 22A-22D. The prior default was prohibition &#8212; no solely automated decisions with legal or similarly significant effects, absent a specific exception. The new default is permission, subject to safeguards: individuals must be informed, can request human review, and can contest the outcome, with the strict prohibition now reserved for decisions substantially based on special category data. The ICO&#8217;s own consultation on draft guidance for the new regime closed 29 May 2026, meaning the regulator&#8217;s detailed expectations for how organisations should apply the new Articles were, as of this piece&#8217;s access date, still being finalised rather than settled. Organisations using AI to make or materially inform decisions about employment, lending, benefits eligibility, or similar significant outcomes should treat this as the most concrete, dated legal change in this entire piece &#8212; more so than the voluntary cyber code &#8212; and should not assume ICO guidance written before 5 February 2026 still reflects the current rules; the ICO&#8217;s own fairness-in-AI page carries a live notice that it is &#8220;under review&#8221; as a direct result of this Act.</p>
<h2>The EU AI Act: relevant to UK organisations selling into the EU, not directly binding on UK-only ones</h2>
<p>For UK CISOs whose organisations trade into the EU, sell AI-enabled products to EU customers, or operate EU subsidiaries, the EU AI Act&#8217;s phased timetable is the more consequential regulatory calendar &#8212; and it moved recently. Regulation (EU) 2024/1689 entered into force 1 August 2024; prohibited-practice and AI-literacy provisions applied from 2 February 2025; general-purpose AI model obligations, plus Commission and AI Office enforcement powers against GPAI providers (fines up to EUR15 million or 3% of global turnover), and the Article 50 transparency obligations, applied from 2 August 2025 and 2 August 2026 respectively as originally scheduled. But most high-risk AI system obligations &#8212; covering many HR, credit-scoring and critical-infrastructure use cases under Annex III, originally due from 2 August 2026 &#8212; were postponed to <strong>2 December 2027</strong> by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force 27 July 2026, days before the original deadline. The final tranche, covering high-risk AI embedded in already-regulated products under Annex I and legacy general-purpose AI compliance, moved from 2 August 2027 to <strong>2 August 2028</strong> under the same Omnibus. The Act does not directly regulate an organisation with no EU market exposure, but UK organisations building or selling AI systems that reach the EU market cannot treat it as someone else&#8217;s problem &#8212; nor can they assume the original 2024 timetable still holds; it does not.</p>
