Four AI Compliance Changes Your Professional Services Firm Must Act On in 2026

The UK's AI regulatory environment has shifted considerably in the past twelve months. New legislation has cleared Parliament, the Information Commissioner's Office (ICO) has moved from guidance to enforcement, and the courts have begun issuing decisions that will shape how AI tools can be used commercially. For professional services businesses — whether you are a law firm in London, an accounting practice in Dubai, a marketing agency in Toronto, or an HR consultancy in Singapore — the UK's direction of travel matters. If you operate across borders, serve UK clients, or process the personal data of UK residents, these changes affect your compliance posture now.

Here are four developments you need to understand and act on.

1. The Rules on Automated Decision-Making Have Changed

The Data (Use and Access) Act 2025 (DUAA), which received Royal Assent in June 2025, is the most significant change to the UK's data protection framework since the UK GDPR came into force. One of its most consequential provisions concerns solely automated decision-making (ADM).

Previously, the rules were highly restrictive. Under UK GDPR Article 22, organisations could only undertake solely automated decisions with significant effects on individuals in limited circumstances. The DUAA liberalises this substantially. Organisations can now rely on legitimate interests as a lawful basis for ADM — without needing explicit consent or a contract — provided the processing does not involve special categories of personal data.

However, liberalisation does not mean deregulation. New safeguards apply. You must inform individuals when ADM is being used, give them a meaningful route to contest decisions, and ensure human intervention remains available. These requirements have direct operational implications for firms using AI tools to screen CVs, assess client risk profiles, automate credit decisions, or score marketing leads.

For internationally operating firms, the practical lesson is this: the UK has carved out its own path, distinct from the EU AI Act's more prescriptive approach. If your business spans both jurisdictions, you may be managing two different compliance frameworks for equivalent AI processes. Now is the time to map where automated decision-making occurs across your operations and confirm your legal basis for each use.

The ICO is updating its AI guidance to reflect the DUAA, with final guidance on automated decision-making expected by Summer 2026. Do not wait for that guidance before auditing your current practices.

2. The ICO Is Enforcing — Not Just Advising

There is a clear pattern in recent ICO enforcement: fines are larger, timelines are shorter, and AI and biometrics are explicitly named as strategic priorities. Professional services firms that have treated AI compliance as a theoretical exercise should take note.

In 2025 alone, the ICO issued a £14 million fine to Capita for a slow incident response, £3.07 million to Advanced following a ransomware attack, and £2.31 million to 23andMe for security failures arising from a credential stuffing attack. In February 2026, Reddit was fined £14.47 million for failures in children's privacy and age assurance — a signal that the ICO is scrutinising not just how data is secured, but how it is governed at a structural level.

The ICO is also developing a statutory Code of Practice on AI and Automated Decision-Making, mandated under the Data Protection Act 2018. Once finalised, this will set a clear benchmark against which organisations will be judged.

What this means for your firm: the ICO's expectation is that UK GDPR obligations apply fully to AI systems. Data Protection Impact Assessments (DPIAs) are mandatory for high-risk AI processing, and the ICO has published a dedicated AI and data protection risk toolkit to support this. If your firm is deploying AI tools that process personal data — client information, employee records, behavioural data — and you have not conducted a DPIA, you are exposed.

Firms operating outside the UK are not insulated. If you process the personal data of UK residents, the ICO has jurisdiction. The Reddit and Imgur/MediaLab fines confirm that international businesses are not treated differently when they fall short.

3. IP and Copyright Boundaries Are Being Tested in Court

Two landmark decisions have begun to define what AI can and cannot do with intellectual property in the UK.

In November 2025, the UK High Court ruled in Getty Images v. Stability AI. The court found limited trademark infringement where Stability AI's model reproduced Getty Images watermarks in generated outputs, but dismissed the primary copyright claims because the AI had not been trained on the specific works asserted. The ruling reinforces the territorial nature of copyright law — what is protected in one jurisdiction may not be protected in another, and the technical specifics of how a model is trained will be scrutinised closely.

In February 2026, the UK Supreme Court ruled definitively that an AI model cannot be considered an inventor under the Patents Act 1997. This closes the door on AI-generated inventions receiving patent protection in the UK without a human inventor named.

For professional services firms, particularly those advising clients on technology, media, or innovation matters, these rulings carry immediate relevance. If you are using generative AI tools to produce content, reports, creative assets, or strategic analysis for clients, you should understand the IP status of that output. Who owns it? What were the training data sources of the tool you used? Does the output potentially reproduce third-party material?

Beyond client work, firms using AI-generated content in their own marketing, proposals, or published materials carry the same exposure. Review your AI tool usage policies and ensure your teams understand that generating content is not the same as owning it.

4. AI Governance Is Now a Baseline Expectation

The UK government has deliberately chosen not to enact a standalone AI Act. Instead, the AI Opportunities Action Plan, published in January 2025, signals a pro-innovation stance that pushes responsibility back onto organisations to apply core principles across their own operations.

Those principles — safety, security and robustness, transparency and explainability, fairness, accountability and governance, and contestability and redress — are not aspirational guidance. They are the lens through which regulators, courts, and increasingly clients will assess your AI practices.

The courts have already issued direct warnings to the legal profession about AI misuse following cases where AI tools generated fictitious legal citations — so-called "hallucinations." This is not a problem confined to law firms. Any professional services business presenting AI-generated analysis as authoritative output carries reputational and, potentially, professional liability risk.

Governance is the foundation. That means documented AI policies, clear accountability structures, staff training, and processes for reviewing AI outputs before they reach clients. For firms operating across multiple jurisdictions — where the EU AI Act, US state-level AI laws, Canada's AIDA, and various APAC frameworks are developing in parallel — a coherent, documented governance framework is the most efficient way to demonstrate compliance across all of them simultaneously.

Act Before the Guidance Catches Up With You

The UK's regulatory direction is clear even where final guidance is still pending. Enforcement is active, case law is developing, and the compliance baseline is rising. Waiting for every piece of guidance to be finalised before acting is itself a compliance risk.

Ops Intel works with professional services businesses globally to build practical, proportionate AI compliance programmes — from DPIA frameworks and automated decision-making audits to AI governance policies and cross-jurisdictional compliance mapping.

If you are unsure where your firm stands, or need to move from awareness to action, contact Ops Intel to speak with one of our consultants. Compliance built now costs considerably less than enforcement later.