The UK has no single AI law. Its regulators apply existing rules on conduct, prudential soundness, data protection and payments to AI, and expect firms to show how they meet the required outcomes. For AI agents, nobody hands you a checklist: you decide how agents are bounded, overseen and recorded, and must explain why that design works.
What does a principles-based approach mean in the UK?
The UK has chosen a principles-based, regulator-led approach to AI rather than a dedicated statute. Existing regulators apply their existing frameworks within their remits: the FCA for conduct, the PRA for the prudential soundness of banks and insurers, the ICO for data protection, the PSR for payment systems. Our explainer on the UK principles-based approach to AI and what it means for agents sets out how the pieces fit.
The rules those regulators apply are largely outcome-focused. The FCA's Consumer Duty requires good outcomes for retail customers. The Senior Managers and Certification Regime requires named individuals to answer for areas of the business. The PRA's SS1/23 sets principles for model risk management at banks. UK GDPR and the Data Protection Act 2018 set principles for processing personal data. None of them was written for agents, and all of them apply to agents.
Why does that put the design burden on the firm?
Because outcome rules say what must be true, not how to make it true. A prescriptive rule might say "an AI system may not approve refunds above a set amount without human review". A principles-based regime says customers must receive good outcomes, decisions must be fair, accountable people must be in control and the firm must be able to show all of it. Whether that requires a refund limit, a hold for a named person or something else is left to the firm.
This is flexible. A firm can design controls that fit its business, its customers and its risk appetite. It is also demanding. The firm must make the design choices, record its reasons and produce evidence that the choices work. When a supervisor asks how an agent meets the Consumer Duty, "we followed the rules" is not an answer, because the rules did not specify the design.
How do outcomes translate into agent design?
Start from the outcome, decide what it implies for the agent, and choose a control that leaves evidence.
| Regulatory expectation | Design decision for the agent | Evidence |
|---|---|---|
| Good outcomes for retail customers | Which actions the agent may take alone, which are held, which are refused | Verdict record; outcome monitoring by customer group |
| Named individual accountability | An accountable owner for each agent and each material capability | Ownership register linked to senior manager responsibilities |
| Sound model risk management | Validation of each agent on the firm's own cases; change control on model updates | Certification results; re-test records |
| Lawful, fair, transparent processing | Sources limited to what the task needs; significant decisions kept with people | Data protection impact assessment; source register |
| Operational resilience | Ability to suspend the agent and hand work back to people | Handback drills; exit plans |
Each row is a choice the firm makes. A different firm might make a different choice and still meet the outcome. What both must have is the reasoning and the evidence.
Do principles-based regimes elsewhere work the same way?
Many do, to varying degrees. GDPR itself is built on principles, set out in Article 5: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Our page on GDPR Article 5 principles applied to AI agents shows how each shapes agent design. In Singapore, the MAS FEAT principles of fairness, ethics, accountability and transparency play a similar role for financial firms; our explainer on how MAS FEAT principles apply to AI agents covers them.
The United States has no single federal AI law, and relies on existing sectoral rules and state laws, which is closer to the UK model than to the EU's. The EU AI Act, by contrast, adds specific obligations for specific uses on top of principles. Our comparison of how US AI regulation differs from the EU AI Act covers that contrast. Even under the EU Act, much of the design work is still left to the firm.
Is the absence of a specific rule a form of permission?
No. A common misreading is that if no rule says an agent may not do something, it may. Under a principles-based regime, the question is whether doing it is consistent with the outcomes the rules require. An agent that declines credit without meaningful human involvement, or makes it hard for customers to complain, may breach outcome rules even though no rule mentions agents.
The risk-based approach is the right lens: controls should be proportionate to the risk each capability carries. Low-risk capabilities need light controls. Capabilities that affect customers' money, access or rights need strong ones, whether or not a rule names them.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What is the trade-off?
Principles give firms room to design sensible controls, and they demand that firms think, decide and record. There is no safe harbour in following a checklist, because there is no checklist. Some firms find that uncomfortable and wait for prescriptive rules that may not come.
Waiting is itself a design choice, and usually a poor one. For each agent, list the outcomes the rules in your sector require, write down the design decision you have made to meet each, and attach the evidence that it works. That document is what you will show a supervisor. The wider mapping of rules to controls is in our guide to AI agent regulation, mapped to controls.
Questions people ask
Will the UK introduce a specific AI law?
The current approach is principles-based and regulator-led. Firms should design for that approach while monitoring developments, rather than waiting for a law that may or may not arrive.
Which UK regulator is responsible for AI agents?
Whichever regulator covers the activity the agent performs. An agent handling retail customers falls within the FCA's remit for conduct; one processing personal data within the ICO's; a bank's agents within the PRA's prudential oversight too.
How detailed should the design record be?
Detailed enough that someone outside the team could understand what each agent may do, why, who decided and how you know it works. A short record per agent and per material capability is usually more useful than a long general policy.