Frontier AI cyber guidance, competition remedies, and regulator accountability plans

The UK’s AI governance landscape continued to evolve through sector-specific interventions rather than framework legislation. Financial authorities issued coordinated expectations on frontier AI cyber risks, the competition regime moved closer to practical controls over AI-generated search content, and major regulators published plans explaining how they intend to support innovation while managing AI-related risks.

Assurance hardens, healthcare sandboxes scale, and exams draw clearer AI lines

The Digital Assurance Playbook took effect from 1 April and requires government assurance teams to test AI initiatives against the UK government’s AI Playbook and the Algorithmic Transparency Reporting Standard. The MHRA expanded its AI Airlock programme with three years of funding to scale sandbox testing for AI as a medical device. The FCA announced the second cohort for AI Live Testing, extending supervised live experimentation in financial services and committing to further good and poor practice output later this year. The PRA Business Plan 2026/27 made responsible AI adoption and monitoring of firms’ AI use an explicit supervisory priority for the year ahead. Ofqual published Artificial intelligence malpractice and assessment - advice note, clarifying how existing qualification rules apply to AI-related misuse.

Summary of Policy Communication on Scotland AI Compliance Framework

AIJurium submitted a briefing note titled ‘Scotland AI Compliance Framework’ to Keith Brown MSP, raising the potential value of a Scotland-focused approach to AI compliance and assurance. This communication was directed towards identifying how Scotland’s existing AI policy work could be strengthened through practical assurance capacity, especially as generative AI becomes more widely adopted across public, private and third sector contexts.

ADM guidance opens, copyright reform pauses, and financial-sector guardrails sharpen

The UK’s latest AI governance activity points in three directions at once: firmer data-protection expectations for automated decision-making, a more cautious government stance on copyright reform for AI training, and deeper sector-specific supervision where AI could create systemic or public-service risk. The period also brought a notable expansion of evidence-gathering in children’s social care, showing that governance attention is moving beyond horizontal AI principles into operational settings.

AI-generated imagery privacy statement and FCA insurance AI review

Information Commissioner’s Office (ICO) backed a joint statement by 61 data protection authorities warning about privacy risks from AI-generated realistic imagery/video of identifiable people without consent, with particular concern for harms to children. Financial Conduct Authority (FCA) published its new Regulatory Priorities: Insurance report, including a planned Q1 2026 “Artificial Intelligence review” to engage industry on AI uses, risks, opportunities, and barriers to safe adoption in insurance.

Online safety investigations and public sector AI transparency tools

This report tracks concrete shifts in UK AI governance that change what organisations may need to do in practice. The strongest signals this fortnight were online safety enforcement moving into active investigations, and central government tightening the practical foundations for public sector AI use through data readiness and transparency tooling.

Scotland AI Governance Map

Scotland’s AI Strategy is framed as a collectively developed governance approach, built through public and stakeholder engagement, and delivered through ‘Collective Leadership’ rather than a fixed, top-down legal framework. It relies on a ‘co-production’ model and a living playbook style of implementation, so principles and practices evolve with participation as the ecosystem learns what works.

Online Safety Enforcement, Public-Sector AI Governance Tools, and Cyber Resilience

This period shows UK AI governance becoming more operational: Ofcom is now issuing repeat Online Safety Act penalties and activating the fees regime; government teams are rolling out practical ethics tooling for AI use in public services; and cyber resilience legislation is moving through Parliament with the ICO setting out what expanded oversight could mean for digital and managed service providers. EU sandbox implementation work and wider transatlantic friction around online regulation remain important for UK organisations with cross-border exposure.