Build your REG-1 profile
Answer a few questions and we'll generate your personalised enforcement intelligence dashboard.
Company name
Primary AI system type
Company size
Which of these functions exist in your company? (select all that apply)
We'll only show you action plan sections that are relevant to your team structure.
What compliance measures do you already have in place? (select all that apply)
Current assessment
UK Artificial Intelligence (Regulation) Act 2024
Passed · Royal Assent 14 Nov 2024 · Commencement order laid · Force date 1 Jun 2026
Loading your scope classification…
Enforcement probability
70–85
Midpoint 78
Days to force date
—
1 Jun 2026
Enforcement window
Jul–Nov 2026
ICO projected start
ICO budget signal
↑ +23%
Year-on-year increase
What's driving this score
Commencement order confirmed
Legislative
High weight
SI 2026/218 was laid on 18 February 2026, setting 1 June 2026 as the force date for Schedules 1–3. This removed all ambiguity on timing and is the largest single driver of enforcement risk. There is no longer any realistic scenario where the force date changes.
ICO has opened investigations into your sector
Regulatory
High weight
The ICO opened a formal investigation into a UK hiring AI platform on 11 March 2026 — a company with a structurally similar product to yours. Sector-specific enforcement activity is the strongest leading indicator of follow-on investigations in the ICO's historical pattern.
Political and budgetary commitment is clear
Political
Medium weight
The DSIT Secretary of State has publicly confirmed enforcement as a priority for 2026. The ICO's AI enforcement budget has been increased by 23% year-on-year. The governing party's Year 1 manifesto commitment to AI regulation enforcement is on track. Political will is high and stable.
What would lower this score
↓ Schedule 3 reclassification
If the Schedule 3 consultation (closes 12 Apr 2026) broadens the medium-risk definition to include lower-automation tools, the score would fall to approximately 45–60 and the enforcement window would extend by 6–12 months. This is possible but not the current ICO signal.
↓ ICO budget cut
An emergency spending review cutting the ICO's enforcement budget would reduce capacity and push the score to approximately 55–68. Current polling and fiscal signals make this unlikely within the next 12 months.
Next trigger dates
12 Apr 2026
Schedule 3 guidance consultation closes
Determines whether your system is classified high-risk or medium-risk — changes the entire compliance scope.
Critical
1 Jun 2026
AI Act enters force
ICO begins accepting complaints. High-risk AI operators must have conformity assessments in place from this date.
Critical
Jul 2026
Enforcement window opens
First ICO investigations projected. Hiring AI platforms are the primary target sector based on current enforcement signals.
Watch
Scope classification
Top 3 actions to take now
REG-1 monitors 18 UK sources covering legislation, government activity, ICO enforcement, court decisions, and civil society pressure. Below is a plain-English summary of each signal and why it matters for your company. Sources are grouped by type.
Commencement order laid — force date confirmed 1 June 2026
18 Feb 2026 · Statutory instrument
SI 2026/218 brought Schedules 1–3 of the AI (Regulation) Act 2024 into force on 1 June 2026. This is binding law — the date cannot change without a further statutory instrument, which would require Parliamentary approval and is extremely unlikely given the current political timeline.
What this means for you
You have a fixed, legal deadline. All Schedule 3 obligations (conformity assessment, technical documentation, human oversight, ICO registration) must be in place by 1 June 2026.
Royal Assent — AI (Regulation) Act 2024 becomes law
14 Nov 2024 · Act of Parliament
The AI (Regulation) Act 2024 received Royal Assent on 14 November 2024, creating a new statutory framework for high-risk AI systems in the UK. Schedule 3 defines which AI systems are classified as high-risk, including automated employment decisions.
What this means for you
The legal framework is in place. Your obligations are defined in law, not guidance — this is enforceable.
Schedule 3 guidance consultation — open until 12 April 2026
Closes 12 Apr 2026 · ICO consultation
The ICO is consulting on draft guidance that will determine the exact scope of high-risk classification under Schedule 3. This includes the boundary between high-risk and medium-risk AI systems for employment use cases. The outcome will affect whether your obligations apply from 1 June or from a later phase-in date.
What this means for you
Monitor the consultation outcome closely. If the high-risk threshold narrows, your obligations may change. Until the guidance is finalised, plan for high-risk classification.
DSIT confirms ICO enforcement as a 2026 priority
04 Mar 2026 · Government speech
The Secretary of State for DSIT has publicly confirmed that ICO enforcement of AI Act obligations is a stated government priority for 2026. This aligns with a 23% increase in the ICO's AI enforcement budget and the governing party's year-one manifesto commitment to AI regulation.
What this means for you
Political will is high and confirmed. The ICO has both the mandate and the budget to pursue enforcement actively from mid-2026.
ICO budget: £18.4m for AI enforcement, up 23% year-on-year
Oct 2025 · Budget document
The 2025 Budget allocated £18.4 million to the ICO's dedicated AI enforcement unit, a 23% increase on the previous year. This is a direct signal of enforcement capacity — the ICO can pursue more cases simultaneously and at higher speed.
What this means for you
The ICO has the resources to investigate multiple companies in parallel. Budget constraints are not a reason to expect leniency.
ICO opens formal investigation into a hiring AI platform
11 Mar 2026 · ICO enforcement register
The ICO opened a formal investigation into a UK-based AI hiring platform, citing potential breaches of Article 22 obligations and automated decision-making rules. The company's product is structurally similar to hiring AI tools that automate or support CV screening and candidate selection.
What this means for you
Sector-specific enforcement has begun. The ICO is already investigating companies with products like yours. This is the clearest leading indicator of follow-on investigations.
ICO publishes approach to AI Act enforcement
22 Feb 2026 · ICO blog post
The ICO published a blog post outlining its approach to enforcing the AI Act, confirming it will focus on high-risk AI systems processing personal data in employment decisions. The post identifies documentation gaps as the most common trigger for investigation.
What this means for you
Technical documentation is the ICO's top priority check. Start this immediately — it has a 6–10 week lead time and is the most common enforcement trigger.
Court of Appeal upholds ICO power to issue assessment notices for AI systems
Nov 2025 · Court of Appeal (binding)
In a binding judgment, the Court of Appeal confirmed that the ICO has the power to issue assessment notices requiring AI operators to cooperate with investigations into automated processing systems. A challenge to this power was dismissed. This significantly broadens the ICO's investigatory reach.
What this means for you
The ICO can compel your cooperation with any investigation. There is no legal shield against assessment notices. Proactive engagement is a better strategy than resistance.
Big Brother Watch files formal ICO complaint against hiring AI platforms
28 Feb 2026 · NGO activity
Big Brother Watch filed a formal complaint with the ICO against three UK hiring AI platforms, citing algorithmic bias in recruitment decisions. Formal NGO complaints have historically been a direct trigger for ICO investigations — the ICO is required to respond to formal complaints within a defined timeframe.
What this means for you
External pressure is actively driving ICO action in your sector. A bias audit is now a defensive priority, not just a compliance box to tick.
AI hiring penalty upheld on appeal — full amount confirmed
Dec 2025 · Information Rights Tribunal
The Information Rights Tribunal upheld the ICO's monetary penalty against a UK hiring AI operator in full on appeal. The company challenged the fine on proportionality grounds; the Tribunal found the ICO's reasoning sound and that the penalty was not excessive. This sets a precedent for how courts will treat future AI enforcement cases.
What this means for you
Legal appeals against ICO AI penalties are unlikely to succeed. The courts are supporting the ICO's enforcement approach.
The enforcement timeline for the UK AI Act 2024, from Royal Assent through projected first investigations. Dates marked Critical have hard legal consequences.
14 Nov 2024
Royal Assent — AI (Regulation) Act 2024
Act becomes law. Schedules 1–3 establish the high-risk AI classification framework, including automated employment decisions.
Complete
18 Feb 2026
SI 2026/218 laid — commencement order confirmed
The commencement order confirmed 1 June 2026 as the force date for Schedules 1–3. This is a binding statutory instrument — the date is fixed.
Complete
Now
Compliance preparation window — active
You are in the preparation window. Technical documentation has a 6–10 week lead time. Every week of delay reduces your margin before the force date.
12 Apr 2026
Schedule 3 guidance consultation closes
Determines the exact scope of high-risk classification. If the boundary narrows, some obligations may be phased in over 12 months rather than applying from 1 June.
Critical
1 Jun 2026
Act enters force — ICO begins accepting complaints
All Schedule 3 obligations apply from this date. High-risk AI operators must have conformity assessments, technical documentation, and human oversight mechanisms in place. The ICO can begin accepting complaints and opening investigations from this date.
Critical
Jul–Nov 2026
Projected enforcement window — first investigations expected
Based on the ICO's stated enforcement priorities, budget signals, and the pattern from comparable legislation (GDPR: 8 months to first enforcement; OSA: 6 months), first formal investigations are projected in this window. Hiring AI platforms are the stated primary target sector.
High risk
2027+
Full enforcement regime — medium-risk obligations expected
Secondary legislation is expected to extend obligations to medium-risk AI systems. DRCF coordinated enforcement (ICO, Ofcom, CMA) will be fully operational. Companies that are compliant from June 2026 will be better positioned as the regime expands.
Future
Actions are personalised to your company profile.
Immediate — within 30 days
1
Commission a high-risk AI classification audit
Determine definitively whether your product falls under Schedule 3 high-risk classification. This is binary and drives the entire compliance roadmap. Engage external UK AI regulation counsel — do not rely on internal legal for this determination alone. Proactive legal engagement is a documented mitigating factor in ICO enforcement decisions.
2
Engage UK AI regulation counsel before the force date
Brief an external solicitor on your product architecture and data flows before 1 June 2026. Choose counsel with specific ICO and AI Act experience. Proactive legal engagement is a documented mitigating factor — companies that self-identify and seek counsel before enforcement begins receive better outcomes.
Short-term — within 90 days
3
Begin technical documentation immediately
Start drafting model cards, data lineage documentation, training data descriptions, and system architecture specs. This has a 6–10 week lead time and is the ICO's most-cited gap in AI investigations. The ICO's own published guidance confirms documentation gaps are the most common enforcement trigger.
4
Build a human oversight mechanism into the product
Implement a documented human review step for any decision above a defined risk threshold. This is a product engineering requirement under Schedule 3, not just a policy. Log all overrides — the ICO will audit this log in any investigation.
5
Commission an independent algorithmic bias audit
Run an independent bias assessment across protected characteristics (age, gender, ethnicity, disability). Required for conformity assessment and demonstrates good faith to the ICO. The recent formal complaint filed by Big Brother Watch against hiring AI platforms makes this especially urgent for your sector.
6
Update customer contracts and DPAs
Review and update all customer Data Processing Agreements to reflect new AI Act controller/processor obligations. Remove any marketing claims implying fully automated decisions without human review — this is an independent enforcement risk regardless of your overall compliance status.
Strategic — within 6 months
7
Register proactively with the ICO
Once the ICO confirms its supervisory role (expected Q2 2026), proactive registration is a documented mitigating factor. Companies that self-identify before enforcement begins receive preferential treatment. GDPR and Online Safety Act precedents both confirm this pattern.
8
Establish an AI governance committee
Create a cross-functional AI governance structure meeting quarterly. Formalise an AI incident response protocol. This is increasingly expected by enterprise customers in procurement due diligence and will become a contractual requirement within 12–18 months.
Overall readiness
0%
0 of 6 obligations complete
Progress saved automatically
How did enforcement play out under comparable legislation? These precedents set the pace benchmark for AI Act enforcement and are directly relevant to your preparation timeline.
UK GDPR / DPA 2018
The closest structural parallel
Passage to first enforcement
8 months
Primary first-wave targets
HR & hiring platforms
Average fine, year 1
£185,000
Implication for you: The ICO targeted HR and hiring data processors in its first enforcement wave under GDPR. Scale-ups faced identical obligations and timelines to enterprises — company size was not a mitigating factor. See what GDPR means for your action plan →
Online Safety Act 2023
The fastest recent enforcement trajectory
Passage to first enforcement
6 months
Commencement orders
Ahead of schedule
Average fine, year 1
£225,000
Implication for you: Ofcom began enforcement faster than most companies expected, catching several platforms under-prepared. The AI Act commencement order follows the same accelerated pattern. Do not assume the force date will slip.
EU AI Act — Articles 9–15
EU enforcement is already underway
UK lag vs EU (typical)
3–6 months
Employment AI classification
Annex III high-risk
Maximum fine
€30m or 6% global TO
Implication for you: EU enforcement of hiring AI is already active. The UK ICO typically follows EU enforcement action with a 3–6 month lag — EU cases will accelerate and inform ICO investigations. If you have EU customers or process EU data, you may face parallel obligations.
| Area | Actions covered | Timeline | Estimated cost | If non-compliant |
|---|
Cost estimates are indicative and adjust based on company size. Actual costs depend on counsel rates, engineering complexity, and scope. Larger companies typically face higher rates but share fixed costs across more staff.
£—
Total estimated compliance cost
£267k
Average ICO fine (AI cases 2025–26)
—
Risk-adjusted return on compliance spend
Return on compliance spend calculated as: total risk exposure (fine + legal defence + remediation + reputational impact) divided by estimated compliance cost. Based on ICO AI enforcement register averages 2025–26.