We log UK and EU AI compliance changes by date

The DILR.ai compliance changelog is a dated log of UK and EU rule changes that affect voice AI and enterprise AI, from the ICO, the FCA, the EU AI Act, NHS DTAC and the courts. Each entry names the regulator, says what changed in plain English and gives one practical step.

Updated . Corrections to four earlier entries were added on this date.

What changed in UK and EU AI rules in 2026?

We have logged five changes so far

The newest is at the top. Entries that turned out to be wrong keep their date and show a correction with the primary source.

Show changes from
  1. EU AI Act

    The Digital Omnibus moves EU AI Act high-risk deadlines to December 2027 and August 2028

    Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moves the obligations for stand-alone high-risk systems listed in Annex III, such as AI used in hiring, credit scoring and education, from 2 August 2026 to 2 December 2027. High-risk AI built into products covered by Annex I moves to 2 August 2028. The Article 50 transparency duties and the Commission’s enforcement powers over general-purpose AI providers were not delayed and applied from 2 August 2026.

    What to do

    If you run voice AI in the EU, make sure callers are told they are speaking with an AI system, because that duty already applies. Re-plan any Annex III high-risk work, such as AI that screens job applicants or assesses credit, against the 2 December 2027 date.

    Source: Regulation (EU) 2026/1744, EUR-Lex, EU AI Act Article 113, entry into force and application

  2. EU AI Act

    Second wave of EU AI Act GPAI obligations applies from 2 August 2026

    The second wave of EU AI Act obligations on General-Purpose AI (GPAI) systems comes into force on 2 August 2026. Voice AI deployments that incorporate third-party GPAI models become accountable for upstream transparency obligations (training-data summaries, copyright disclosures, model documentation). Deployers should document which GPAI providers underpin each agent and confirm provider compliance attestations are on file.

    Correction, 26 October 2026

    This entry was wrong. The general-purpose AI rules in Chapter V of the EU AI Act have applied to model providers since 2 August 2025, and models already on the market before then have until 2 August 2027. What began on 2 August 2026 was the Commission’s power to enforce those rules against GPAI providers, together with the Article 50 transparency duties, such as telling people they are interacting with an AI system. Training-data summaries, copyright policies and model documentation are duties of the model provider, not of a business that deploys a voice agent built on that model. Keeping a record of which models each agent uses is still sensible practice.

    Source: EU AI Act Article 113, entry into force and application, Regulation (EU) 2024/1689, EUR-Lex

    What to do

    Add a GPAI provenance column to your model inventory. Request the provider transparency summary from each LLM vendor in your stack and store the date received.

  3. ICO

    ICO publishes refreshed guidance on automated decision-making in customer phone calls

    The ICO refreshed its guidance on UK GDPR Article 22 (automated decision-making with legal or similarly significant effects) as it applies to voice AI handling customer service, claims intake, and credit-related calls. The clarification narrows the read-out of "human in the loop": passive monitoring is no longer sufficient; reviewers must have the authority and time to alter the outcome before it is communicated to the caller.

    Correction, 26 October 2026

    The ICO did not publish final guidance on this date. On 31 March 2026 it opened a consultation on draft guidance about automated decision-making, including profiling. The consultation closed on 29 May 2026, and the guidance was still a draft when we checked on 26 October 2026. The draft is general guidance and does not single out voice AI, claims or credit calls. The point about meaningful human review is long-standing ICO doctrine, so the action below still stands.

    Source: ICO consultation on draft guidance about automated decision-making, ICO guidance on automated decision-making

    What to do

    For any voice-AI workflow that materially affects a customer (claim acceptance, credit, account closure), confirm the human reviewer is empowered to override before customer notification, and that review SLAs are documented.

  4. FCA

    FCA Dear-CEO letter to consumer credit firms on AI in customer interactions

    The FCA wrote to consumer credit firms reiterating that Consumer Duty applies in full to AI-mediated customer interactions, including outbound voice campaigns. Specific call-outs: foreseeable harm assessments for vulnerable customers, clarity of disclosure that the customer is speaking with an AI agent, and the ability for the customer to request escalation to a human at any point without friction.

    Correction, 26 October 2026

    We could not find this letter. When we rechecked on 26 October 2026, the FCA had published no 2026 Dear CEO letter to consumer credit firms about AI, and this entry should not have been listed as one. Consumer Duty applies to how a regulated firm treats retail customers in every channel, including calls handled by AI, so the action below remains good practice. It is not based on a new FCA letter.

    Source: FCA, Consumer Duty

    What to do

    Audit the opening disclosure on every outbound campaign and inbound IVR. Confirm an escalation phrase ("speak to a person") is recognised and honoured by the agent without justification.

  5. NHS DTAC

    DTAC v3.2 adds explicit voice-AI section

    The NHS Digital Technology Assessment Criteria (DTAC) v3.2 adds a dedicated voice-AI subsection covering clinical safety case requirements, recording-consent flows, and human-handover SLAs for clinical triage use cases. Suppliers responding to NHS procurement should expect explicit voice-AI questions in DTAC submissions from Q3 2026.

    Correction, 26 October 2026

    We could not find a DTAC version 3.2 or any voice-AI section. What NHS England actually published, on 4 March 2026, was a refreshed DTAC form and guidance with about a quarter fewer questions and a scope aligned with NICE, with the old form retired by 6 April 2026. It has no version number and no AI-specific section. A clinical safety case under DCB0129 is still expected for clinical software, so having one ready remains sensible.

    Source: NHS Innovation Service, updated DTAC form and guidance

    What to do

    Update your DTAC response template with the new voice-AI subsection responses. Have clinical safety case (DCB0129) ready for clinical-adjacent voice deployments.

AI governance and operating model designTalk to us about one of these changes

When do EU AI Act obligations apply?

The EU AI Act applies in stages from 2024 to 2028

Four stages already apply. The two high-risk stages were pushed back by the Digital Omnibus in July 2026.

  1. The Act enters into forceApplies now
  2. Banned AI practices and AI literacy duties applyApplies now
  3. Rules for general-purpose AI model providers, governance and penalties applyApplies now
  4. Most of the Act applies, including Article 50 transparency and GPAI enforcementApplies now
  5. Stand-alone high-risk systems in Annex III, moved by the Digital OmnibusNext deadline
  6. High-risk AI inside regulated products in Annex I, moved by the Digital OmnibusLater
Dates from Article 113 of Regulation (EU) 2024/1689, with the two high-risk dates as amended by Regulation (EU) 2026/1744. Status as of 26 October 2026.
Map your AI systems against these dates in a Placement DiagnosticVoice AI architecture for regulated industries

Which AI regulators does this changelog track?

We track five sources of UK and EU AI rules

Each entry links the regulator’s own page so you can check it yourself.

What else do people ask?

Short answers to common questions about UK and EU AI rules

Short answers drawn from the dated entries above.

Ask us about AI compliance

  • What changes on 2 August 2026 under the EU AI Act?

    On 2 August 2026 most of the EU AI Act began to apply. The Article 50 transparency duties started, including telling people when they are interacting with an AI system, and the European Commission gained its powers to enforce the general-purpose AI rules, which have applied to model providers since 2 August 2025. The high-risk obligations that were also due on that date were moved by the Digital Omnibus, Regulation (EU) 2026/1744, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I.

  • Does the UK have an AI law like the EU AI Act?

    No, the UK has no single horizontal AI statute equivalent to the EU AI Act. Obligations for enterprise AI in the UK come from existing regulators: the ICO applies UK GDPR rules on automated decision-making, the FCA applies Consumer Duty to AI-mediated customer interactions, and sector frameworks like the NHS DTAC assess digital technology in clinical and care settings. This changelog tracks all of them.

  • How often is this compliance changelog updated?

    The DILR.ai compliance changelog is updated when a UK or EU rule that affects AI deployment changes, and the last-updated date is shown at the top of the page. Each dated entry names the regulator, summarises the change in plain language and ends with a practical step for teams running voice AI and enterprise AI in production. When an entry turns out to be wrong, it keeps its date and gets a dated correction with the primary source.

Need help putting these rules into practice?

We design AI governance into the work from the start

Governance is stage 03 of DATS, our AI consulting method. Thirty minutes is enough to see where you stand.

Book a free 30 minute callAI operating model service