AI law & governance
AI law: the liability is where it has always been
There is no UK AI Act. That does not mean AI is unregulated — it means the rules sit in data protection, employment, discrimination and contract law, and the exposure is real.
What businesses usually get wrong about this
Two mistakes, in opposite directions.
The first
Assuming that because Parliament has not passed an AI Act, nothing applies. It does. An AI system that screens job applicants engages the Equality Act 2010 and UK GDPR exactly as a human screener would, and “the model decided” has never been a defence to anything.
The second
Assuming this requires a wholly new compliance programme, bought from a specialist. Mostly it does not. It requires applying law you are probably already subject to, to a set of systems you may not have catalogued.
The practical problem for most businesses is narrower than either: they cannot say what AI they are actually running. A tool inside the recruitment platform, a feature switched on in the CRM, something a team adopted without procurement. You cannot assess a risk you have not found, and that is where most failures begin.
The three regimes
What actually applies to you now
01
The EU AI Act, if anything you do touches the EU
High-risk duties apply from 2 December 2027
AI used in recruitment and employment — targeting job adverts, filtering applications, evaluating candidates, allocating work, monitoring performance, decisions on promotion or termination — is classified high-risk. Those duties were due on 2 August 2026; the EU’s Digital Omnibus on AI, in force since 27 July 2026, deferred them to 2 December 2027.
It reaches you where a system is placed on the EU market, used in the EU, or its outputs affect people located in the EU. A London business screening candidates for a role in Dublin is inside it. Penalties run to €15m or 3% of global turnover for high-risk breaches, and €35m or 7% for prohibited practices — which have been banned since February 2025 and include emotion recognition in the workplace.
The transparency duties under Article 50 did apply from 2 August 2026, and they still do. If you use AI in hiring and you have European candidates, the December 2027 date is closer than it looks — an inventory now is worth an hour.
02
UK automated decision-making rules
Data (Use and Access) Act 2025
The old near-prohibition on solely automated decisions with significant effects was replaced by a permissive regime with conditions: you must give meaningful information about the logic involved, a right to obtain human review, and a right to contest the outcome.
The condition that fails most often is human review. “Meaningful human involvement” means active review before the decision takes effect, by someone with the competence and the authority to disagree with the system. A manager who approves a shortlist they had no realistic ability to question has not provided it — and volume hiring is where this breaks down most reliably.
The ICO is under a statutory duty to produce a Code of Practice on AI and automated decision-making. The enabling regulations came into force on 12 May 2026; the Code is expected in 2027.
03
The Equality Act 2010
Seen last, should be seen first
If a hiring tool produces systematically worse outcomes for a protected group, that is potential indirect discrimination — whether or not anyone intended it and whether or not anybody understands why the model does it. The employer is liable, not the vendor, and the vendor’s contract will usually say so.
Discrimination compensation is uncapped. A recruitment tool applied across thousands of applications is not one claim.
Where we act
Six kinds of AI matter
01
AI governance and compliance
Establishing what you are running, what applies to it, and what a proportionate response looks like for an organisation your size.
02
The EU AI Act for UK businesses
Whether you are in scope, whether you are a provider or a deployer, and what each obligation means in practice.
03
AI in recruitment and automated decisions
Hiring tools, scoring, shortlisting and monitoring — and whether your human review would survive scrutiny.
04
Algorithmic discrimination
Where AI systems meet the Equality Act 2010. For employers managing the risk, and for individuals on the receiving end of it.
05
AI vendor contracts and procurement
Training data lawfulness, audit rights, indemnities and the allocation of a risk that standard terms usually leave entirely with you.
06
AI-related disputes
When a system has caused loss and the argument turns to who is responsible.
Being direct about it
Why a firm like ours
We will be direct about this, because it is the question a sensible reader is already asking.
The legal risk created by AI systems is not, for most businesses, novel legal risk. It is discrimination risk, data protection risk, contractual risk and employment risk, arising from a new source. Those are the areas this firm works in every day.
We are unlikely to be the right firm for you if you are building a foundation model or need someone to negotiate compute agreements.
We are likely to be the right firm if you are deploying AI in your business — in hiring, in managing people, in decisions about customers — and you need to know what you have taken on.
Fees
What it costs
£400/hr
plus VAT, with a scope and estimate agreed in writing before we start.
Fixed fee
For an AI inventory and risk review, which establishes what you are running and what applies to it, and for a vendor contract review against a specific agreement. Both are quoted before we begin.
Retained
Ongoing advisory work sits within our business counsel arrangement.
Questions
Questions businesses ask us
Is there a UK AI Act?
No. The UK regulates AI through existing law and existing regulators rather than a dedicated statute — principally the ICO under data protection law, with Ofcom and the FCA in their own sectors. That is a deliberate policy choice, not a gap, and it means the obligations you are subject to are mostly ones you already had.
Does the EU AI Act apply to my UK business?
Quite possibly. It applies where an AI system is placed on the EU market, used in the EU, or its outputs affect people located in the EU. A UK company screening candidates for a role in an EU country is in scope. The high-risk duties for recruitment AI apply from 2 December 2027, deferred from 2 August 2026 by the Digital Omnibus on AI; the Article 50 transparency duties have applied since August 2026.
We use AI to screen job applications. What do we need to do?
At minimum: know what the tool does and on what data it was trained; ensure human review that is genuine rather than nominal; tell candidates the tool is being used; be able to explain the logic in terms a person can understand; and test outcomes across protected groups. If you have EU candidates, the EU AI Act deployer obligations apply on top.
What counts as meaningful human involvement?
Active review before the decision takes effect, by someone competent to assess it and with the authority to disagree. A manager who signs off a shortlist of 200 they had no realistic ability to interrogate has not provided it. This is the condition that fails most often in volume hiring.
If our AI vendor’s tool discriminates, are they liable or are we?
As the employer, you are. The candidate’s claim is against you, and your contract with the vendor will usually place the risk with you as well. Whether you can recover anything from the vendor depends entirely on what that contract says — which is why AI procurement terms are worth reading before signature rather than after a claim.
Can we be liable for discrimination we did not intend?
Yes. Indirect discrimination does not require intention. If a practice puts people sharing a protected characteristic at a particular disadvantage and cannot be objectively justified, it is unlawful regardless of what anybody meant — and the fact that nobody can explain why the model behaves that way is not a defence. It is closer to the opposite.
Where do we start?
An inventory. Most organisations cannot list the AI systems they are running, including features enabled inside tools they already licence. You cannot assess what you have not found, and the inventory usually takes less time than people expect.
This page is general information, not legal advice. AI regulation is moving quickly — take advice on your own position.
Start with a conversation
A free 20-minute call. Tell us what you are running and we will tell you what applies to it.
No charge
A free 20-minute call
Tell us what has happened and we will tell you whether we can help, what it would involve and roughly what it would cost. No advice is given on this call and there is no charge for it.
£350 plus VAT
A paid strategy session
One hour with a partner, followed by a written summary of your position and options. For people who want proper advice without instructing a firm yet. Credited in full against your fees if you go on to instruct us.
Or reach us directly
We answer enquiries the same working day.