UK Professional Services: Navigate the 2026 AI and Data Protection Compliance Shift

The compliance ground beneath professional services firms has shifted considerably in 2026. New domestic legislation, an expanding EU regulatory regime with extraterritorial reach, and a markedly more aggressive enforcement posture from the Information Commissioner's Office (ICO) have combined to create a landscape that demands serious, documented attention — not just awareness. For accountants, solicitors, HR consultancies, and marketing agencies operating in or connected to the UK and EU markets, the question is no longer whether AI compliance applies to your firm. It is whether your current approach will withstand scrutiny.

The Data (Use and Access) Act 2025: A New Domestic Framework

The Data (Use and Access) Act 2025 (DUAA) came into force on 5 February 2026, replacing Article 22 of the UK GDPR with a new domestic framework governing automated decision-making (ADM). This is a material divergence from EU rules — one that firms operating across both jurisdictions must handle carefully, since compliance with one regime does not automatically satisfy the other.

The DUAA grants broader scope for ADM in contexts not involving special category data, while preserving safeguards for individuals subject to solely automated decisions in high-stakes situations. For HR consultancies and recruiters, this is directly relevant: AI tools used in candidate screening, performance management, and workforce planning now operate under this revised regime. Existing ADM policies and Data Protection Impact Assessments (DPIAs) will likely require review and updating to reflect both the new permissions and the retained protections.

A further provision — requiring organisations to maintain a formal complaints procedure in relation to data protection infringements — takes effect on 19 June 2026. Firms without a clearly documented and operational procedure will be in breach from that date. The ICO has updated its guidance on 'Data protection by design and by default' to assist organisations in making the transition, and that guidance warrants careful reading.

The EU AI Act: No Exemption for UK Businesses

For firms with any EU nexus — serving EU-based clients, processing EU user data, or placing AI systems on the EU market — the EU AI Act is a live obligation, not a distant concern.

2 August 2026 marked the direct applicability of key transparency obligations under Article 50. Any AI system interacting with users must disclose that it is doing so. AI-generated content must carry provenance signals, such as watermarks. These are not aspirational standards; they are enforceable requirements. Penalties for non-compliance reach up to €35 million or 7% of global annual turnover — figures that concentrate the mind.

Prohibited AI practices and General-Purpose AI (GPAI) model obligations remain fully live. Obligations specific to high-risk AI systems have seen some deferrals — to December 2027 or August 2028 in certain cases — but that deferral does not extend to the foundational requirements now in effect. UK-based firms should not interpret the post-Brexit relationship with EU law as providing any insulation here. The Act applies on the basis of where AI systems are deployed and who they affect, not where the provider is incorporated.

For international professional services firms — whether headquartered in the US, Canada, the Middle East, or Asia-Pacific — the same logic applies if their services touch EU users or markets. The regulatory perimeter is defined by reach, not by registered address.

ICO Enforcement: The Stakes Are Higher Than They Were

The volume and severity of ICO enforcement has increased sharply. Between September 2025 and May 2026, the ICO issued 22 enforcement actions. The pattern across those cases is instructive.

In October 2025, a pensions administration provider was fined £14 million following inadequate security measures that contributed to a significant cyber incident. In February 2026, Reddit received a £14.47 million fine and Imgur/MediaLab a further £247,590 for failures in handling children's personal information. In May 2026, South Staffordshire Plc and South Staffordshire Water Plc were fined £963,900 for GDPR infringements linked to a cyber incident affecting over 630,000 data subjects.

The Information Commissioner v Clearview AI case, in which the Upper Tribunal upheld the ICO's jurisdiction regarding the extraterritorial application of UK GDPR in October 2025, confirms that overseas firms are not beyond reach. Criminal prosecutions of individuals for unlawful data access have also risen, with a £355,000 confiscation order issued against a former insurance worker in May 2026 serving as a stark illustration of personal liability. Data protection failures are no longer solely a corporate risk.

The Professional Services Warning: Privilege, Accuracy, and Accountability

For solicitors and barristers, the risks associated with AI misuse have moved from theoretical to documented. The Upper Tribunal's 2026 ruling in Munir v Secretary of State for the Home Department established that using unapproved AI tools for client work can permanently waive legal professional privilege and constitute a breach of client confidentiality — with mandatory reporting obligations to both the Solicitors Regulation Authority (SRA) and the ICO as a consequence.

Separately, Pinsent Masons received public criticism from a London court earlier this year for submitting inaccurate, unverified AI-generated information. Multiple English cases in 2025 and 2026 involved lawyers citing fictitious, AI-hallucinated cases — resulting in wasted costs orders, public criticism, and regulatory referrals. The Bar Council updated its generative AI guidance in November 2025 to address responsible use and the imperative of verifying AI outputs before they are relied upon.

These are not isolated incidents. They reflect a systemic failure to treat AI as a tool requiring governance rather than simply a tool requiring access. The lesson for any professional services firm — in any jurisdiction — is that deploying AI in client-facing or legally significant work without documented oversight, verification protocols, and appropriate authorisation creates serious regulatory and professional risk.

What Firms Should Prioritise Now

The convergence of these developments creates a clear action list for professional services businesses:

Review ADM and DPIA documentation against the DUAA 2025 framework before 19 June 2026, particularly if your firm uses AI in HR, recruitment, or client risk assessments.

Audit AI transparency practices to ensure compliance with Article 50 of the EU AI Act if your services reach EU users — regardless of where your firm is based.

Establish or update your data protection complaints procedure to meet the incoming statutory requirement.

Implement AI tool approval and verification policies for client-facing work. In legal and advisory contexts, the absence of such policies is now a documented liability.

Map your exposure to ICO enforcement by reviewing data security measures, breach response procedures, and third-party data processor agreements. The enforcement record of the past nine months demonstrates that the ICO is acting, and acting at scale.

The 2026 AI and data protection compliance landscape is more demanding, more international in its reach, and more consequential in its enforcement than it was twelve months ago. Professional services firms that treat compliance as a periodic exercise rather than an embedded operational function are carrying risk they may not have fully quantified.

Ops Intel works with professional services businesses globally to identify compliance gaps, build practical governance frameworks, and stay ahead of regulatory change. If your firm needs a structured assessment of its AI and data protection obligations, contact the Ops Intel team to arrange an initial consultation.