AI Regulation is Changing. What Does It Mean for UK Leaders?

Europe is tightening the rules

The EU AI Act is often presented as a single piece of legislation that regulates artificial intelligence according to its level of risk. It prohibits certain practices, introduces obligations for providers and users of AI, and places particular requirements on systems considered high risk.

However, its implementation has not been entirely straightforward.

The AI Act entered into force in August 2024, with different elements coming into effect at different times. Some provisions, including those covering prohibited AI practices and AI literacy, have applied since February 2025. Rules concerning general-purpose AI models followed in August 2025.

Then came the AI Omnibus.

The changes that came into force on 27 July 2026 extended the transition period for some high-risk AI requirements. Systems used in areas including employment and education will now generally face the relevant high-risk rules from 2 December 2027, while AI embedded in certain regulated products has a deadline of 2 August 2028.

At the same time, this should not be read as Europe stepping away from regulation.

Transparency requirements under Article 50 have started to apply from 2 August 2026. These include requirements around informing people when they are interacting with certain AI systems and making certain AI-generated or manipulated content identifiable.

The message is therefore more nuanced than "Europe is regulating AI and Britain isn't".

Europe is taking a more comprehensive legislative approach. The UK is pursuing a more flexible, principles-based one.

Both approaches are trying to grapple with what is the same problem: how do we gain the benefits of AI without losing control of the risks?

The important point for those in leadership positions, whatever their sector is that that question matters whether or not their organisation ever falls directly within the scope of the EU AI Act.

The legislation matters, but the leadership questions matter more

For organisations operating across borders, supplying European customers or working with European partners, the EU AI Act may have direct implications. Even where it does not, European regulation is likely to influence technology providers, suppliers and international standards.

There is also the experience of GDPR to consider. European regulation does not necessarily stay neatly within European borders. Requirements can find their way into contracts, technology products, supply chains and organisational expectations well beyond the jurisdiction in which they were created.

There is also a more fundamental reason for UK leaders to pay attention.

The issues that sit underneath the legislation do not stop at national borders.

Take recruitment.

AI can already help organisations sift CVs, assess applications, analyse online tests and identify potential candidates. The efficiency benefits are obvious. But so are the risks if a system systematically disadvantages particular groups, makes inaccurate assessments or effectively rejects candidates without meaningful human consideration.

This isn't some distant regulatory scenario.

In March 2026, the UK's Information Commissioner's Office warned organisations using automated decision-making in recruitment to ensure decisions are lawful, fair and transparent. It highlighted the importance of meaningful human involvement, transparency with candidates and the ability to challenge decisions.

The same principle applies well beyond recruitment.

What happens when AI helps determine who gets shortlisted for promotion? How employee performance is assessed? Which customers receive particular services? Which applications are prioritised? What information a customer sees? Or which risks an organisation chooses to focus on?

At that point, AI is no longer just a productivity tool.

It is influencing decisions about people, and this is where leadership matters most.

Waiting for the rules is not a strategy

One of the risks of the current debate is that organisations wait for a definitive regulatory answer before deciding how they should use AI.

That is understandable because in many aspects of our work we are accustomed to working within clear frameworks.

However, the difference now is that AI is developing much faster than legislation can reasonably keep pace with it.

The UK's approach makes this particularly important. A principles-based regulatory environment gives organisations greater flexibility, but flexibility also means greater responsibility. There may not always be a specific rule telling a leader exactly what they can or cannot do.

What that absolutely does not mean is that anything goes.

Existing responsibilities around data protection, equality, employment, consumer protection, confidentiality, intellectual property and information security all still matter. The ICO, for example, already expects organisations using AI that processes personal data to consider fairness, transparency, accountability, accuracy, security and individuals' rights.

There is also an important distinction for leaders to understand, and that is that having a human somewhere in the process does not automatically make a decision meaningfully human.

The ICO's guidance makes the point that human oversight needs to be genuine and that a person who accepts an AI recommendation without questioning it is not necessarily providing meaningful human involvement. The reviewer needs the authority and capability to challenge the system and change the outcome.

This is why the use of AI is as much about organisational culture as it is about technology.

What should leaders actually be doing?

The starting point shouldn't necessarily be another policy document.

It should be a conversation.

A leadership team should be able to answer some fairly basic questions about how AI is being used across the organisation.

Where are we actually using it? Not just where has the organisation formally approved it, but where are people using it in practice?

What decisions is it influencing? There is a significant difference between AI helping someone complete a task and AI influencing a decision about another person. The closer AI gets to decisions affecting someone's employment, finances, opportunities, rights or access to services, the greater the need for scrutiny.

What happens when the system gets it wrong? AI systems can be extremely useful and still be wrong. Leaders need to consider not just how accurate a system is in general, but what happens in the individual cases where it isn't. Who spots the error? Who is accountable? Can the person affected challenge the decision?

And is the human oversight genuinely meaningful?

It is tempting to describe an AI-supported process as "human-led" because a person has the final click. That isn't enough. Can that person understand the recommendation? Do they have the confidence and authority to challenge it? Are they expected to exercise judgement, or are they effectively being asked to rubber-stamp the machine?

There is also a related question about capability - do people across the organisation understand how to use AI responsibly?

AI literacy needs to go beyond knowing how to use ChatGPT or write an effective prompt. People need to understand what AI can and cannot reliably do, how bias can arise, what information should not be entered into a system, how outputs should be checked and when human judgement needs to take precedence.

Interestingly, AI literacy is itself one of the requirements already applying under the EU AI Act.

Finally, leaders need to be clear about the organisation's own position.

If an employee is uncertain about whether an AI application is appropriate, do they know where to go? Can they question its use? Are leaders clear about what the organisation will and will not accept?

Good governance and direction from leadership should not be designed to prevent people from using AI, it should be about helping them to use it well.

The part that cannot be delegated

It is tempting to think of AI governance as something for the technology team, the legal team or the data protection officer to sort out.

Although all of those functions have an important role, they absolutely cannot make the leadership decisions on behalf of the organisation.

Leaders determine the organisation's risk appetite, they establish the culture in which technology is adopted, and they decide what gets challenged, what gets escalated and what gets accepted.

All of this becomes particularly important as AI moves from a place where it is something people use to help them do their jobs, towards something that increasingly shapes the jobs themselves.

A system might recommend a candidate, but manager still needs to decide whether that recommendation is reasonable.

An algorithm might identify an apparent performance issue, but someone still needs to understand what sits behind the data before acting on it.

A generative AI tool might produce an apparently convincing answer, but someone still needs to decide whether it is good enough to rely on (or indeed, true).

Those are not technology decisions. They are decisions about judgement and responsibility which are very much a leadership decisions.

Regulation may be different however the questions are not

The UK may continue to take a different route from Europe. That could give British organisations more flexibility to innovate and experiment. It could also leave leaders having to make more decisions for themselves about where sensible boundaries should sit.

That might not necessarily be a bad thing.

There is a danger in treating regulation as the point at which an organisation finally has to think seriously about an issue. By then, the technology may already be embedded in everyday decisions and behaviours.

The more useful approach is to start with the organisation we want to be and then consider how AI fits into that.

Where does it genuinely improve what we do? Where does it introduce a risk we are not comfortable with? Where does human judgement remain essential? And, perhaps most importantly, are our people confident enough to say when something doesn't look right?

Those questions are unlikely to become obsolete when the next piece of AI legislation arrives.

If anything, they are the questions that will matter more as the technology becomes less visible in our organisations and more deeply woven into how decisions are made.

This means that for all of us in leadership roles, we need to look beyond keeping up with what AI can do, and be crystal clear about what we are asking it to do, and what we still expect people to take responsibility for.