TRW & Co · Technology, Data & IP
AI Lawyers in London
AI lawyers London businesses instruct help them build, buy and deploy artificial intelligence lawfully. The UK has no single AI statute, so data protection, intellectual property, equality, consumer and sector rules all apply at once. New automated decision-making rules, key copyright and patent rulings and EU AI Act deadlines make 2026 a decisive year for AI governance.
Key pointSince 5 February 2026, solely automated decisions with significant effects on people are generally allowed in the UK if safeguards such as human review and a route to contest are in place, which makes documented safeguards, not avoidance, the compliance task.
At a glance
No single UK AI Act
The UK regulates AI through existing law and sector regulators such as the ICO, CMA, FCA and Ofcom, and no government AI Bill had been introduced by October 2026.
Automated decisions reformed
The Data (Use and Access) Act 2025 replaced the old restriction on solely automated decisions with a safeguards-based model from 5 February 2026.
Getty v Stability AI
In November 2025 the High Court held that model weights which do not store copies of works are not infringing copies under UK copyright law.
Patent test reset
In February 2026 the Supreme Court abandoned the Aerotel test in Emotional Perception, aligning UK patentability of AI inventions more closely with the EPO.
EU AI Act reach
UK businesses selling AI into the EU may be caught by the EU AI Act, whose high-risk deadlines were the subject of a 2026 postponement agreement.
Swipe or scroll →
What AI lawyers London businesses instruct actually advise on
AI lawyers London businesses instruct advise on the legal questions raised by building, buying and deploying artificial intelligence: who owns the model and its outputs, whether training data was lawfully used, how personal data rules apply, who is liable when a system gets it wrong, and which regulators can intervene. The work spans technology contracts, data protection, intellectual property, employment, consumer and competition law, and sector regulation.
The UK has no single AI statute. Instead, existing law applies to AI in the same way it applies to any other technology, and sector regulators interpret their rules for AI use cases. That makes the legal picture fragmented: a single deployment, such as an AI tool that screens job applicants, can engage the UK GDPR, the Equality Act 2010, employment law and the contract with the vendor all at once.
AI becomes a legal question earlier than many organisations expect. It arises at procurement, when choosing a model provider; at design, when deciding what data to use; at launch, when telling customers how the system works; and at every point where an automated output affects a person, a price or a decision.
The UK legal and regulatory framework for AI
A principles-based, regulator-led approach
Successive UK governments have chosen not to legislate for AI horizontally. As of October 2026, no government AI Bill has been introduced, although the possibility of legislation for the most capable models has been discussed for some time. Regulators including the ICO, the CMA, the FCA, Ofcom, the Equality and Human Rights Commission and the MHRA apply their existing powers to AI. The government's AI Opportunities Action Plan, published in January 2025, focuses on adoption and infrastructure, and the AI Security Institute evaluates advanced models.
Data protection and automated decisions
Data protection law is the most developed source of AI regulation in the UK. From 5 February 2026 the Data (Use and Access) Act 2025 replaced the old near-prohibition on solely automated decisions with significant effects. Such decisions are now generally permitted if safeguards are in place: information about the decision, the ability to make representations, human intervention and a route to contest. Stricter limits remain where special category data is involved. Our data protection team advises on DPIAs for AI systems.
Intellectual property
Copyright, database right, patents and trade marks all apply to AI, but several questions remain open. In Getty Images v Stability AI [2025] EWHC 2863 (Ch), the High Court rejected a secondary copyright infringement claim because the model weights did not store copies of the claimant's works, after training-related claims had been abandoned. Limited trade mark infringement was found in respect of watermarks generated by early model versions.
The government's Report on Copyright and Artificial Intelligence, published in March 2026, dropped a broad text and data mining exception with an opt-out as its preferred option and proposed removing special protection for wholly computer-generated works. Our guide to copyright and AI covers the detail.
On patents, the Supreme Court held in Thaler v Comptroller-General [2023] UKSC 49 that an inventor must be a natural person. In Emotional Perception AI v Comptroller-General [2026] UKSC 3 it abandoned the long-standing Aerotel test for excluded subject matter and aligned the UK more closely with the European Patent Office, allowing the appeal concerning an artificial neural network.
Liability, consumer and competition law
There is no special AI liability regime. Claims arise in contract, negligence, misrepresentation, defamation and product liability, and under consumer protection law where AI-generated content misleads. The CMA has examined competition in foundation models and can use its digital markets powers where firms hold strategic market status.
| Use case | Main regulators | Key legal issues |
|---|---|---|
| Recruitment and workforce tools | ICO, EHRC | Automated decisions, discrimination, transparency to candidates |
| Credit, insurance and investment decisions | FCA, PRA, ICO | Consumer Duty outcomes, explainability, model risk |
| Chatbots and generative content platforms | Ofcom, ICO, CMA | Online safety duties, misleading content, data use |
| Medical devices and diagnostics | MHRA, ICO | Device regulation, health data, clinical safety |
| Pricing and marketing | CMA, ASA | Consumer protection, collusion risk, advertising rules |
Key decisions: build, buy or fine-tune
Most organisations do not build foundation models. They license a model, fine-tune it on their own data or embed a third-party tool in a workflow. Each route allocates legal risk differently, and AI lawyers London clients rely on will push that allocation into the contract rather than leaving it to chance.
Licensing a third-party model
Standard terms of major model providers are often non-negotiable for smaller customers. Check the intellectual property indemnity and its exclusions, restrictions on use of inputs and outputs for training, data location, and service levels. Our guide to AI contracts sets out the clauses that matter most.
Fine-tuning on your own data
Fine-tuning raises questions about whether you hold the rights to use training data, including customer data and third-party content, and whether personal data has a lawful basis for that new purpose. It also creates valuable assets, so ownership of the fine-tuned weights and improvements should be settled in writing.
Building in-house
Building gives control but concentrates risk. Data provenance, employee and contractor IP assignments, open-source licence compliance and security become your responsibility. Investors will examine all of these in due diligence.
AI rarely creates entirely new legal problems. It takes old ones, such as ownership, liability and fairness, and makes them harder to see.
AI in regulated sectors
Sector rules often matter more than general AI policy. AI lawyers London firms in regulated industries work with need to translate each regulator's expectations into concrete controls.
Financial services
The FCA has said it does not plan AI-specific rules and will instead apply existing requirements, including the Consumer Duty, the Senior Managers and Certification Regime and systems and controls obligations. A firm using AI in credit decisions, claims handling or customer communications must be able to show that outcomes are fair, that vulnerable customers are not disadvantaged and that a named senior manager is accountable. Model risk management, explainability and testing records are the evidence that matters. Our fintech team advises on these questions.
Online platforms and generative services
Generative AI chatbots and services that let users share AI-generated content can fall within the Online Safety Act 2023, which Ofcom enforces. Providers may need risk assessments for illegal content and, where children are likely to use the service, child safety duties and age assurance. Consumer protection law also applies to AI-generated marketing, fake reviews and personalised pricing, now with the CMA's direct fining powers under the Digital Markets, Competition and Consumers Act 2024.
Healthcare and life sciences
AI software used for diagnosis or treatment can be a medical device, regulated by the MHRA, with health data subject to the strictest data protection conditions. Clinical safety standards and NHS procurement requirements add further layers. Developers should plan the regulatory pathway at the design stage, because retrofitting evidence is slow and expensive.
Employment
Workplace monitoring, productivity scoring and automated rostering all raise data protection, equality and employment law issues. Employees have rights to information about automated decisions and to challenge them, and collective consultation may be required where changes affect terms and conditions.
A practical AI governance process
A workable governance programme does not need a large team. It needs a clear inventory, proportionate assessment and named accountability. AI lawyers London organisations work with typically help design a process like this.
- Inventory. List every AI system in use or development, including tools staff use informally, with owners and purposes.
- Classify risk. Rank uses by their impact on people, money and reputation, and flag any that could fall within the EU AI Act's high-risk categories.
- Assess. Carry out DPIAs and equality impact assessments for higher-risk uses, testing for bias, accuracy and explainability.
- Contract. Review vendor terms for IP, data, security, audit and liability, and negotiate where the risk justifies it.
- Disclose. Tell customers, staff and candidates when AI is used and how to challenge outcomes, in plain language.
- Oversee. Put meaningful human review where decisions matter, with training so reviewers do not simply rubber-stamp outputs.
- Monitor. Track incidents, complaints and model drift, and report to the board at regular intervals.
Documents and evidence to assemble
When a regulator, customer or investor asks how you manage AI risk, the answer is a set of documents, not a policy statement. The core set includes:
- An AI inventory with risk ratings, owners and review dates.
- An AI use policy for staff, covering approved tools, confidential information and verification of outputs.
- DPIAs and equality impact assessments for higher-risk systems.
- Records of training data sources, licences and any opt-outs honoured.
- Vendor contracts, model cards and technical documentation supplied by providers.
- Testing results for accuracy, bias and robustness, with remediation records.
- Customer-facing notices and terms explaining AI use and limitations.
- Board minutes and incident logs.
In Ayinde v London Borough of Haringey [2025] EWHC 1383 (Admin), the Divisional Court warned that lawyers who put fictitious, AI-generated citations before the court risk serious sanctions. The lesson applies beyond the legal profession: any business that relies on generative AI output in a regulated or contractual context needs a documented verification step.
Risks and common mistakes
Feeding confidential or personal data into public AI tools
Staff using free generative AI tools may disclose confidential information, trade secrets or personal data to a provider that can use it to improve its models. That can breach confidentiality obligations to clients, undermine trade secret protection and amount to an unlawful disclosure of personal data. Approve specific enterprise tools with contractual protections, block or restrict others, and train staff. A clear acceptable use policy, enforced in practice, is one of the cheapest risk controls available.
Assuming outputs are owned and free to use
Ownership of AI outputs is uncertain. Works created with AI assistance can attract copyright where there is sufficient human creative contribution, but the government has proposed removing protection for wholly computer-generated works. Outputs may also reproduce third-party material or trade marks. Check what the provider's terms say about output ownership and indemnities, and keep records of human input where ownership matters. Our article on AI-generated works ownership explains the position.
Using AI in hiring and HR without equality checks
AI screening and performance tools can reproduce bias in their training data. Under the Equality Act 2010 an employer is liable for indirect discrimination even if the vendor designed the tool, and justification requires evidence that the tool is a proportionate means of achieving a legitimate aim. Combine bias testing, human review and candidate transparency. Work with our employment team before deploying workforce AI, and consult with staff representatives where appropriate.
Accepting vendor terms that leave you uninsured
Vendor contracts often cap liability at a few months of fees, exclude consequential loss and offer IP indemnities only for unmodified use. If the system produces a defamatory, infringing or discriminatory output, the deploying business may bear the loss. Map the risk against your insurance, negotiate indemnities and caps where you have leverage, and avoid promising customers more than your supplier promises you. Our technology team negotiates these terms regularly.
Ignoring the EU AI Act because you are a UK business
The EU AI Act applies to providers placing AI systems on the EU market and, in some cases, to providers and deployers outside the EU whose system outputs are used in the EU. A UK software business selling into Europe may therefore need to comply. Prohibited practices and general-purpose AI model obligations already apply, while high-risk obligations have been the subject of a 2026 agreement to postpone them. See our guide to the EU AI Act for UK businesses.
Cross-border AI: the EU, Bangladesh, the Gulf and Asia
AI supply chains are international by default. Models are trained in one country, hosted in another and deployed worldwide, and AI lawyers London groups instruct need a view across all of them.
European Union
The EU AI Act (Regulation (EU) 2024/1689) is the most comprehensive AI law in force. Its prohibitions took effect in February 2025 and obligations for general-purpose AI models in August 2025. In 2026 the EU institutions reached a provisional agreement, through the digital omnibus, to delay the main high-risk obligations, with the new dates subject to formal adoption. UK businesses selling into the EU should plan to the final text rather than the original timetable.
Bangladesh
Bangladesh is a growing base for software development, data annotation and business process outsourcing. UK businesses that use Bangladeshi teams to label data or build models should secure IP assignments under both legal systems, put UK transfer safeguards in place for personal data, and check obligations under Bangladesh's 2025 personal data protection ordinance. Our UK-Bangladesh practice coordinates this work with our Dhaka office.
The Gulf, Singapore and China
The UAE and Saudi Arabia are investing heavily in AI infrastructure, and the DIFC has adopted rules on personal data processed by autonomous systems. Singapore relies on governance frameworks and its data protection law. China regulates generative AI services directly, including content and labelling requirements. Where these laws apply we work with local counsel and build a single compliance map.
How TRW & Co helps
We advise developers, deployers, investors and boards. As AI lawyers London clients can bring the whole problem to, we combine technology, data, IP and disputes expertise and coordinate with our offices abroad.
AI governance programmes
Inventories, risk frameworks, policies and board reporting proportionate to your size. We focus on decisions and evidence rather than lengthy documents nobody reads.
Procurement and contracts
Reviewing and negotiating model licences, SaaS terms, data licences and development agreements, including IP ownership, indemnities, audit and liability caps.
Data protection for AI
DPIAs, lawful basis analysis for training and deployment, transparency notices and the new automated decision-making safeguards introduced in February 2026.
Intellectual property strategy
Protecting models, datasets and outputs through copyright, trade secrets and patents, and managing infringement risk, with our intellectual property team.
Transactions and investment
AI-focused due diligence for acquisitions and funding rounds, covering data provenance, open-source use, IP chain of title and regulatory exposure.
Disputes and regulatory inquiries
Claims over failed AI projects, infringement allegations, discrimination complaints and regulator inquiries. Where advocacy in the higher courts is required, we instruct specialist counsel.
To discuss an AI project, contact our London office, or browse all our practices. Our overview of AI regulation in the UK is a useful starting point.
Checklist for decision-makers
These questions help boards test whether AI risk is under control. Any gap is a good reason to speak to AI lawyers London businesses trust before a regulator or counterparty raises it.
- Do we have a complete inventory of AI tools in use, including those adopted informally by staff?
- Has each higher-risk use had a documented impact assessment?
- Do our vendor contracts address IP, data use, security, audit and liability in a way we have actually reviewed?
- Do we know whether any of our products or customers bring us within the EU AI Act?
- Are automated decisions about people subject to the safeguards the law now requires?
- Have we tested our recruitment and HR tools for bias?
- Can we show where our training data came from and that we had rights to use it?
- Do staff know which tools they may use and how to verify outputs?
- Does the board receive regular reporting on AI incidents and risk?
AI law in the UK will keep evolving through regulator guidance, court decisions and, eventually, legislation. Organisations that build sound governance now will adapt more easily to whatever comes next.
Frequently asked questions
01Is there an AI law in the UK?
There is no single AI statute. AI is regulated through existing laws, including the UK GDPR and Data Protection Act 2018, the Equality Act 2010, copyright and patent law, consumer protection law and the Online Safety Act 2023, and through sector regulators applying their own rules. The government has discussed legislation for the most capable models, but no government AI Bill had been introduced by October 2026. Businesses should therefore map AI risks against each relevant area of law.
02Can we use AI to make decisions about customers or staff?
Generally yes, but with safeguards. Since 5 February 2026 solely automated decisions with legal or similarly significant effects are permitted if individuals are told about them, can make representations, can obtain human intervention and can contest the outcome. Stricter limits apply where special category data, such as health data, is used. You will also need a lawful basis, a DPIA for high-risk processing and checks for discrimination under the Equality Act 2010.
03Can we train an AI model on content we find online?
Not safely without analysis. UK copyright law has a text and data mining exception only for non-commercial research, and the government dropped a broader commercial exception with an opt-out as its preferred option in March 2026. Website terms, database right and data protection law may also restrict scraping. The Getty v Stability AI decision addressed whether a trained model is an infringing copy, but did not decide the lawfulness of training in the UK. Licensed or owned data is the lower-risk route.
04Who owns content created using generative AI?
It depends on the human contribution and the provider's terms. Works created with meaningful human creative input can be protected by copyright in the usual way. UK law currently gives a special form of protection to computer-generated works with no human author, but the government has proposed removing it. Provider terms usually assign or license outputs to the user, but may not warrant that outputs are free of third-party rights. Keep records of human input for valuable content.
05Does the EU AI Act apply to UK companies?
It can. The Act applies to providers placing AI systems or general-purpose models on the EU market, wherever they are established, and to some non-EU providers and deployers whose system outputs are used in the EU. Prohibited practices and general-purpose model obligations already apply. The main high-risk obligations were the subject of a provisional 2026 agreement to delay them, so check the adopted text and timetable when planning compliance.
06What should an AI vendor contract cover?
At a minimum: what data the vendor may use and whether it can train on your inputs, where data is processed, security standards, ownership of outputs and fine-tuned models, IP indemnities and their exclusions, accuracy and performance commitments, audit and information rights, incident notification, liability caps and exit arrangements. For higher-risk uses, require technical documentation and testing information that lets you meet your own regulatory duties.
07Can an AI system be named as an inventor on a UK patent?
No. In Thaler v Comptroller-General [2023] UKSC 49 the Supreme Court held that an inventor under the Patents Act 1977 must be a natural person. AI-assisted inventions can still be patented if a human qualifies as the inventor and the invention meets the usual requirements. Following Emotional Perception in 2026, the approach to excluded subject matter for computer-implemented and AI inventions is closer to that of the European Patent Office.
Sources and official materials
- AI Opportunities Action Plan (GOV.UK) — UK government AI strategy, January 2025
- Data (Use and Access) Act 2025 — Automated decision-making reforms
- Getty Images v Stability AI [2025] EWHC 2863 (Ch) — High Court judgment on AI models and copyright
- Emotional Perception AI v Comptroller-General [2026] UKSC 3 — Supreme Court on patentability of AI inventions
- Report on Copyright and Artificial Intelligence (March 2026) — Government report under the 2025 Act
- Regulation (EU) 2024/1689 (EU AI Act) — Official text of the EU AI Act
- AI Security Institute — UK government body evaluating advanced AI
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.