1. AI register
Which AI you use, what for and who is responsible. Fill in “what for” and “customer data” yourself.
| Tool | What for | Customer data in it? | Responsible person | Date |
|---|
FREE · tool · UK GDPRno account · no email address
UK AI passport: register, policy and website notices
Do you use ChatGPT, Claude or another AI in your business? The UK has no AI Act, but other rules do apply: UK GDPR when personal data goes into an AI tool, and advertising and consumer law when you publish AI images, text or reviews. Tick what you use and you get an AI register, an AI policy, an AI literacy plan per role and the notices for your website. Everything stays in your own browser.
TOOL · the AI passport
Nothing has been made yet.
2. AI policy
One page in plain English: what is allowed, what is not, and how you stay honest with customers.
3. AI literacy plan per role
Good practice, and a way to show how your people handle AI and personal data. Have everyone sign after the conversation.
4. Notices for your website
Short sentences that tell customers when AI is involved. Put them where the customer sees them, at the first contact.
DOC.01
The UK has no AI Act, and that changes the rules
The United Kingdom chose not to write one general AI law. The government set out five principles (safety, transparency, fairness, accountability and the right to contest) and left existing regulators such as the ICO, the CMA and the ASA to apply them in their own areas. As far as we could verify on 6 November 2026, no UK statute regulates AI as such. So the EU rules on AI literacy (Article 4) and on telling people about AI (Article 50) are not UK duties.
What this passport does instead
It builds the four documents on the rules that do apply in the UK: UK GDPR for personal data, the ICO's expectations on transparency, advertising and consumer law for what you publish. The AI literacy plan is good practice here, not a legal duty.
Why you should not rely on this for long
UK policy is still moving. The ICO consulted on draft guidance on automated decision-making in spring 2026 and its final guidance and code are still to come. We check the sources again within six months, or when a new law or ICO code appears.
DOC.02
Personal data and AI: UK GDPR and the ICO
If personal data goes into an AI tool, UK GDPR and the Data Protection Act 2018 apply exactly as they do to any other tool. The ICO expects you to be open about how and why you use personal data, including in AI-assisted decisions, and to say so in plain language. We found no UK law that requires an AI policy as such; you do have to inform people.
One rule changed this year. Since 5 February 2026, Article 22 of UK GDPR has been replaced by Articles 22A to 22D (section 80 of the Data (Use and Access) Act 2025). A decision is solely automated when there is no meaningful human involvement, and it is significant when it has a legal or similarly significant effect on someone. Such decisions are restricted where they rest on special category data, and in all cases you need safeguards, including a way for the person to contest the decision.
Is the ICO guidance up to date?
Not entirely. The ICO says its guidance on AI and data protection is under review after the 2025 Act, and a draft on automated decision-making was consulted on between 31 March and 29 May 2026. Check ico.org.uk before you rely on a detail.
Why the passport asks about customer data
Because the answer decides whether your privacy notice, your records and your tool settings are involved. The register has a column for it; filling it in is yours to do.
DOC.03
Adverts, reviews and honesty
There is no blanket UK rule that you must label AI in your adverts. The ASA and CAP say their codes apply to AI content exactly as to any other content, and that a disclosure on its own is very unlikely to put right a message that is misleading. An AI image that shows a result a product does not deliver stays misleading with or without a label.
Fake reviews have been banned since 6 April 2025 under the Digital Markets, Competition and Consumers Act 2024. Do not publish invented customer stories or reviews, written by a person or by AI.
What the passport does with this
The notices it writes for AI images are good practice, and every notice says that a label does not make a misleading image acceptable. The policy bans made-up customer stories and reviews.
DOC.04
When the EU AI Act can still apply to you
The EU AI Act applies to a business in a third country when “the output produced by the AI system is used in the Union” (Article 2(1)(c)). If you serve customers in the EU, for example with an AI chat, AI-written offers or images, check whether it applies to you. Two parts matter most for a small business.
Article 4 asks providers and deployers to take measures to support the AI literacy of their staff and of others who work with AI for them. No specific level has to be guaranteed for any individual. It has applied since 2 February 2025. Article 50 asks that people are told when they deal with an AI system, at the latest at the first interaction, and that deep fakes and some AI texts are labelled. It has applied since 2 August 2026.
Who has to tell the customer about a chatbot?
Article 50(1) puts the duty to design the system so that it informs people on the provider of the system. If you use another company's chatbot, you are the deployer and should check that it tells people; if you built it or sell it under your own name, you are the provider. Either way, tell people at the start.
What does a breach cost?
For Article 50, an administrative fine up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher; for small and medium-sized businesses the lower of the two (Article 99(4)(g) and (6)). Each member state sets its own penalty rules.
Dates
AI systems that generate synthetic content and were on the market before 2 August 2026 have until 2 December 2026 for the marking duty in Article 50(2) (Article 111(4)).
DOC.05
What the AI passport is not
It is a template based on UK sources and, where it applies, the EU text. It is not legal advice and not a certification. It covers nothing for AI used to take high-stakes decisions about people, and it does not replace your privacy notice. Have the documents checked by whoever handles compliance and privacy in your business, and read the sources again after six months or when a new law or code appears.
DOC.06 · FAQ
Frequently asked questions
Does the AI Act apply to my UK business?
Not as such. The UK has no AI Act. It can apply if the output of your AI is used in the EU, for example because you serve customers there. Then Article 2(1)(c) of the EU AI Act may bring you in scope, and the passport adds a line that tells you to check.
What does it cost and do I need an account?
Nothing, and no. You enter what you use and get the four documents straight away. There is no account, no subscription and no email address.
Is my input stored or sent anywhere?
No. The page does all the work in your own browser. What you enter does not leave your device. Close the page and it is gone, so save the result as a PDF or an .md file.
Do I need an AI policy in the UK?
We found no UK law that requires one as such. A short policy is still the simplest way to show that you handle personal data responsibly and do not mislead customers.
Is this legal advice?
No. It is a template with its sources. Have it checked by whoever handles compliance and privacy in your business.
How often should I update it?
At least every six months, and with each new tool or team member. The sources were read on 6 November 2026; if the law changes, the new date will be on this page.
DOC.07
Sources and check date
Checked on 6 November 2026 by reading the sources below. Every statement on this page can be traced to one of them.
UK: A pro-innovation approach to AI regulation (gov.uk); Data (Use and Access) Act 2025, section 80 (Articles 22A to 22D); UK GDPR Article 5; ICO, Explaining decisions made with AI; ASA, Disclosure of AI in advertising; CMA, Unfair commercial practices and the Digital Markets, Competition and Consumers Act 2024.
EU, where it applies: Regulation (EU) 2024/1689, consolidated 27.07.2026 (Articles 2, 4, 50, 99, 111 and 113). Example from practice: how we ourselves talk about AI.
DOC.08
Your AI rules are in place. Is your website ready for them?
A chat with no notice or an AI image with no label does not belong on your website. We build websites with those notices in place from day one: building, hosting, maintenance and further development for € 75 a month (online shop € 150 a month), excluding VAT, fixed for the first 24 months and cancellable monthly after that.
Written by GianlucaFounder of TheSEO. Has been building visibility for businesses since 2017, in Google and in AI answers. More about the institute.