The UK principles-based approach to AI: what it means for agents

The UK has chosen not to pass a single AI law. Instead, existing regulators such as the FCA, PRA and ICO apply cross-sector AI principles through the rules they already enforce. For AI agents, that means no AI checklist to tick: firms must show that their agents meet conduct, prudential and data protection rules, and design the controls themselves.

What does the UK approach require, in plain words?

The UK takes a principles-based, regulator-led approach to AI. The government has set out cross-sector principles for regulators to interpret and apply within their remits:

• safety, security and robustness: AI systems should function securely and as intended, with risks identified and managed;
• appropriate transparency and explainability: people should be able to understand when and how AI is used, to a degree suited to the context;
• fairness: AI should not undermine legal rights, discriminate unfairly or create unfair outcomes;
• accountability and governance: there should be clear lines of responsibility and effective oversight;
• contestability and redress: people should be able to challenge harmful outcomes and decisions.

These principles do not create new legal duties on firms by themselves. They guide how regulators use the powers they already have. For how this compares with the EU's single statute, see the EU AI Act vs the UK approach to AI agents.

Who does it apply to?

Every UK firm using AI, through whichever regulators already supervise it. In financial services, that means the FCA for conduct, the PRA for prudential soundness, the ICO for data protection and the PSR for payment systems. Firms outside financial services meet the same principles through their own sector and cross-economy regulators.

What does it mean when the system is an agent?

A principles-based regime is easy to misread as a light one. For agents, it is closer to the opposite. A rulebook tells you the minimum; principles hold you to the outcome. The trade-off, which we argue in principles-based regulation leaves agent design to you, is flexibility in exchange for having to justify every design choice yourself.

Here is how existing rules carry each principle to agents in UK financial services.

Safety, security and robustness. The PRA's SS1/23 expects model risk to be managed, including for AI. Operational resilience expectations require important business services to stay within impact tolerances. An agent that supports such a service must be tested, monitored and able to fail safely.

Transparency and explainability. UK GDPR requires clear information about processing and, for significant automated decisions, information about the logic involved. The FCA's Consumer Duty requires communications that customers can understand.

Fairness. The Consumer Duty requires good outcomes for retail customers, including those in vulnerable circumstances. Equality law and UK GDPR's fairness principle apply too.

Accountability and governance. The Senior Managers and Certification Regime makes named individuals answerable. For agents, someone must own each agent's authority and outcomes.

Contestability and redress. Complaints rules require fair handling and access to redress. UK GDPR gives people safeguards against significant automated decisions.

Take an illustrative case. A UK consumer credit firm deploys an agent to handle arrears contact. No AI rule tells it what the agent may do. The firm works it out from the rules it already has: the Consumer Duty requires fair treatment of customers in difficulty, so the agent must recognise signs of vulnerability and hand those customers to a person; UK GDPR requires transparency, so customers are told an AI agent is handling their contact; SM&CR requires an owner, so a named senior manager approves the agent's authority. Each control is traceable to an existing rule.

How do you meet the principles for agents?

What will UK regulators ask?

• Which of our rules apply to this agent, and how does each control trace to them?
• Who is the accountable senior manager?
• How do customers know an agent is involved, and how do they challenge it?
• How do you know the agent produces good outcomes for vulnerable customers?
• What happens to your services if the agent or its model provider fails?

What does the approach not do?

It does not give firms a safe harbour: following the principles in general terms will not answer a specific breach of the Consumer Duty or UK GDPR. It does not remove EU duties for firms that also serve EU customers. And it is not static; regulators issue guidance as they apply the principles. Other jurisdictions take similar paths in finance, such as Singapore; see how the MAS FEAT principles apply to AI agents. For the general idea of matching controls to risk, see what a risk-based approach is. For the full map, see our guide to AI agent regulation mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Pryme turns principles into enforced limits. Authority is granted per capability, per customer, proven on the customer's own cases through Attest, enforced at the moment of action through the minimum chain, and it expires. Every verdict is filed in an append-only record, so a firm can trace each control to the rule it serves.