Navigating UK AI Procurement: Essential Compliance and Due Diligence for Founders

Procuring AI software in the UK requires a keen understanding of the country's 'pro-innovation' regulatory approach, particularly concerning data protection and the Information Commissioner's Office (ICO). Founders must conduct thorough due diligence, encompas

By Loom Workz Reviewed by Atahan 7 October 2026 4 min read

The short answer

UK founders must navigate AI procurement by grounding their strategies in UK GDPR and the Data (Use and Access) Act 2025, which streamlines automated decision-making rules. The Information Commissioner's Office (ICO) is developing a statutory AI Code of Practice, expected in 2027, and will release specific procurement guidance for SMEs. Key steps include rigorous vendor due diligence on data handling, bias mitigation, transparency, and security, alongside implementing AI-specific contractual safeguards. Proactive monitoring of ICO updates and establishing robust internal governance are vital for ensuring compliant and trustworthy AI adoption.

The UK's Evolving AI Regulatory Landscape for Buyers

The UK adopts a 'pro-innovation' approach to AI regulation, distinguished by its reliance on existing regulators rather than a single, overarching AI Act. This framework is guided by five core principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. These principles are voluntarily applied by regulators such as the Information Commissioner's Office (ICO), which plays a pivotal role in enforcing data protection aspects of AI use in the UK. This dynamic regulatory environment necessitates a proactive and informed approach from founders procuring AI software.¹²

Understanding this landscape is crucial, as the ICO, being the primary data protection regulator, is actively shaping how AI systems must comply with data protection laws. Their strategic approach focuses on ensuring that data protection principles, including security and transparency, are integral to AI development and deployment. This includes continuous guidance and engagement to address the unique challenges AI presents, particularly concerning personal data.³

Foundational UK Data Protection Law and AI

UK GDPR remains the cornerstone for processing personal data, a requirement that inherently applies to most AI systems. Organisations must establish a lawful basis for processing, ensure fairness, provide transparency, and maintain robust security measures. These fundamental principles directly translate to how AI systems interact with and process data, forming the initial compliance checklist for any AI procurement.³

Further streamlining these obligations, the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, has introduced significant reforms to automated decision-making (ADM). Effective from 5 February 2026, this Act replaced Article 22 UK GDPR with new rules that permit all ADM within scope, provided comprehensive safeguards for transparency and accountability are in place. These changes simplify some data protection considerations for ADM tools but reinforce the need for meticulous due diligence.⁴⁵

The ICO's Expanding Mandate and Future Guidance

The ICO's influence on AI compliance is set to grow significantly. The ICO is under a statutory duty, mandated by regulations in force since 12 May 2026, to produce a comprehensive Code of Practice on AI and automated decision-making. This Code, anticipated to take effect in 2027, will provide crucial regulatory clarity and, once active, must be considered by both the ICO and courts. This underscores the importance of assessing AI use now and preparing for future regulatory expectations.⁶

In addition to the statutory Code, the ICO plans to publish a 'transparency resource' aimed specifically at helping organisations, particularly SMEs and public bodies. This guidance will assist them in conducting appropriate data protection due diligence when procuring off-the-shelf cloud-based AI tools and services. While existing ICO guidance on AI and data protection outlines current UK GDPR obligations, this new resource will offer tailored support for procurement processes, reflecting the evolving landscape post-Data (Use and Access) Act.⁷

Essential Due Diligence for AI Software Procurement

Beyond basic features, rigorous vendor due diligence for AI software procurement must delve into several critical areas. Founders need to scrutinise how vendors handle data, especially training data, ensuring appropriate contractual terms cover data rights, model updates, output ownership, and sub-processing. These terms are increasingly expected in due diligence but are not yet standard practice across all AI contracts. It's also imperative to assess the accuracy, potential biases, and fairness considerations embedded in the AI system's design, avoiding procurement of services or datasets where bias or discrimination cannot be adequately mitigated.⁶⁸

Transparency and explainability are paramount, with a preference for AI models that enable an understanding of how decisions are made, facilitating the identification and rectification of biases. Security and robustness are also critical; vendors' practices must be thoroughly assessed against novel AI-specific risks and aligned with ICO guidance. The AI Security Institute's focus on testing frontier models highlights the ongoing emphasis on robust security. Finally, clear accountability and governance are essential, requiring precise identification of controller and processor relationships throughout the AI supply chain, coupled with robust governance measures.¹³⁸

Proactive Steps for UK Founders to Stay Compliant

To navigate this evolving regulatory landscape effectively, UK founders must remain proactive. Regularly monitoring the ICO's website and official communications for new guidance on AI and ADM is essential to stay informed of compliance shifts. Given the anticipated 2027 implementation of the statutory AI Code of Practice, preparing for these changes now will provide a significant advantage.⁶⁷

Establishing documented internal governance processes for AI use within your organisation is another vital step. This demonstrates a commitment to regulatory principles and helps manage reputational exposure associated with unmanaged AI usage. Furthermore, consider engaging independent third-party organisations or experts to conduct audits and evaluations of AI systems, especially concerning accuracy and fairness. This not only bolsters compliance but also strengthens trust in the AI solutions you deploy.⁶⁸

Sources

Sources last checked 7 October 2026.