UK AI principles, evidenced through the regulators that bind you.
The UK has not enacted a horizontal AI Act. It has a principles-based, sector-regulator-led approach: five cross-sectoral principles, each enforced through the existing powers of the regulator that already governs your sector — the ICO, FCA, PRA, MHRA, CMA, Ofcom and others.
There is no UK AI statute imposing one set of obligations. The duties bite through the regulators that already govern your sector — and they have all issued AI-specific guidance you must hold evidence against.
The March 2023 White Paper, A pro-innovation approach to AI regulation, set five cross-sectoral principles — Safety, security and robustness; Appropriate transparency and explainability; Fairness; Accountability and governance; Contestability and redress — and tasked existing regulators with applying them within their statutory remit. The 2024 Government response confirmed the approach and committed to non-statutory regulator coordination plus future targeted legislation for the most powerful general-purpose models.
The ICO's AI and data protection guidance — and ICO/Alan Turing Institute Explaining decisions made with AI — operationalise UK GDPR and the Data Protection Act 2018 for AI. AI processing personal data must satisfy the GDPR principles, complete a DPIA where high-risk, and respect Article 22 rights on solely automated decisions with legal or similar significant effect. ICO fines reach £17.5m or 4% of global turnover.
Sectoral regulators have moved in step. The FCA and PRA published their joint feedback statement on AI in financial services (FS2/24) and apply the Senior Managers and Certification Regime, Consumer Duty, operational-resilience and outsourcing rules to AI use; the MHRA regulates Software as a Medical Device and AI-as-a-Medical-Device; the CMA's AI Foundation Models update applies competition powers; Ofcom enforces the Online Safety Act on AI-generated content and risk assessments.
The UK AI Safety Institute (AISI) leads frontier-model safety testing under voluntary commitments from the major model providers, and the Government's AI Opportunities Action Plan (January 2025) sets the broader policy direction. An AI (Regulation) Bill has been re-introduced and continues through Parliament; the principles regime remains the operative framework in the meantime.
The files this framework actually requires.
A UK AI compliance pack is the evidence that each principle is operating in your specific regulatory environment. Hael generates the artefacts each UK regulator opens.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
The UK does not ask for a single document. It asks each regulator's question in its own language. Hael generates the answer in each.
Discover, classify, produce — for UK AI principles.
Find the systems in UK AI principles scope, including embedded third-party AI.
Assess each against UK AI principles's risk tiers and obligations.
Generate the UK AI principles records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
The UK principles trace is built on the same operational evidence as the EU AI Act Article 9 risk file, a NIST AI RMF Profile and the GDPR DPIA — re-rendered against five principles instead of an article tree. The ICO's Article 22 logic note is the same artefact GDPR demands. One set of facts, five UK regulators served.
Hold the evidence each UK regulator opens.
Bring an AI system operating in the UK. We'll register it on the call, map it against the five cross-sectoral principles, identify the sector regulators that apply, and show the artefacts Hael would generate for each.