AI Compliance Consulting in the UK: What It Covers and What Businesses Need in Place

Most UK businesses now use artificial intelligence somewhere, whether in a customer-facing product, an internal tool or a supplier’s software. Far fewer can say which rules apply to that use, who is responsible for meeting them, or what evidence they would show a regulator, a customer or an auditor if asked. That gap is what AI compliance consulting exists to close.

This guide explains which rules matter to UK businesses, what a compliance engagement actually covers, what you should have in place before you start, and what good output looks like.

1. Which rules apply to a UK business

The first question most leadership teams ask is does the EU AI Act apply to UK companies? It can, even though the UK is outside the EU. The Act reaches providers and deployers outside the EU where their AI systems are placed on the EU market or their outputs are used there. A UK software company selling into Europe, or a UK firm using AI to make decisions about EU customers, may be in scope.

At home, the picture is different. At the time of writing the UK has no single AI statute. Instead, existing regulators apply existing law to AI, guided by shared principles on safety, transparency, fairness, accountability and redress. In practice that means data protection law and the Information Commissioner’s expectations, consumer and competition rules, and sector regulators such as the Financial Conduct Authority for financial services.

Most businesses are therefore subject to a patchwork rather than one rulebook: UK data protection law, sector requirements, contractual obligations to customers, and the EU AI Act where they trade into Europe. Mapping which of these applies to which system is the starting point of any serious compliance work.

2. What an AI compliance engagement covers

The work usually follows a recognisable sequence.

Inventory. Finding out what AI is actually in use, including tools bought by individual teams, features switched on inside existing software, and models built in-house. Most organisations discover more than they expected.

Classification. Deciding which systems are higher risk, based on what they do and who they affect. A tool that drafts internal emails and a tool that screens job applicants do not carry the same obligations.

Gap assessment. Comparing current practice against each applicable requirement and recording where the business falls short, with the evidence behind each finding.

Controls and policy. Putting in place the policies, approval routes, human oversight, testing and record-keeping that close the gaps, proportionate to the risk.

Supplier assurance. Checking what vendors will actually warrant about their AI, and what the contract says about data, liability and change.

Monitoring and reporting. Setting up the ongoing checks and board reporting that keep the position current as systems, suppliers and rules change.

3. Standards that help

Compliance is not only about statute. Standards give a structure that regulators, customers and insurers recognise. ISO/IEC 42001, the management system standard for AI, provides a framework for governing AI across its lifecycle, and the NIST AI Risk Management Framework is widely used as a practical reference for identifying and managing risk.

Neither is a legal requirement for most UK businesses, but working towards one gives a defensible, repeatable method and makes it far easier to answer customer due diligence questionnaires that increasingly ask about AI governance.

4. What to have in place before you start

You do not need to be mature to begin, but a few foundations make the work faster and cheaper.

1. A named senior owner for AI, even if the title is informal.
2. A list, however rough, of the AI tools and features in use, and who uses them.
3. A basic acceptable use policy so staff know what is permitted.
4. A record of the main suppliers whose products contain AI.
5. A route for raising concerns or incidents involving AI outputs.

If these do not exist, a good adviser will build them as part of the engagement. If they do, the diagnostic can go straight to the harder questions.

5. What good output looks like

The test of a compliance engagement is whether you could hand the result to a regulator, an auditor or a major customer. Look for a documented inventory and risk classification, a prioritised gap report that distinguishes legal requirements from good practice, clear owners and dates for each action, and a short board paper that states the position plainly.

Be wary of work that produces a long report and no decisions, or that treats every system as equally risky. Proportionality is the point. A business that spends the same effort on a spell checker as on a recruitment algorithm has not understood the rules.

Making the decision

A useful first step is simply to find out where you stand. Ask whether you could list every AI system in use today, say which ones affect customers or employees, and show who approved them. If the answer is no, the inventory is the place to start.

Alchemy Consulting provides AI compliance consulting for UK businesses, from first inventory through to board reporting. If you want a quick view of where you are before speaking to anyone, the free AI readiness scorecard takes a few minutes and shows where to focus.