The Future of AI Governance in the UK

The Future of AI Governance in the UK

How UK organisations should think about AI governance as regulation, guidance and enforcement continue to develop.


Signal 


On 21 July 2026, in a written ministerial statement issued the day after Andy Burnham became prime minister, the government abolished the Department for Science, Innovation and Technology — the department created in February 2023 specifically to hold science, digital and AI policy together in one place — and split its functions three ways. Science, innovation and emerging sectors moved into a renamed Department for Business, Innovation, Science and Trade under Jonathan Reynolds. Digital foundations, inclusion, skills and online harms moved into a re-expanded Department for Digital, Culture, Media and Sport under Lisa Nandy. AI strategy, public-sector AI adoption and the AI Security Institute moved into the Cabinet Office, inside a newly created Office for the Prime Minister and the Cabinet, backed by a new AI Taskforce and a prime ministerial adviser on AI. AI minister Kanishka Narayan was simultaneously promoted to attend Cabinet — a first for the brief — while DSIT's own secretary of state, Liz Kendall, and science minister Lord Patrick Vallance both left government in the same reshuffle. Number 10 corrected its own description of Narayan's joint departmental role within twenty-four hours of the original announcement. 


Terrain 


Substantively, nothing about the UK's model changed that week. It's still principles-based and regulator-led: five cross-cutting principles applied by ICO, FCA, PRA, MHRA, Ofcom and the rest within their existing remits, no central AI statute, a position reaffirmed as recently as DSIT's own October 2025 Blueprint for AI regulation. That Blueprint's centrepiece, the AI Growth Lab, is a programme of sector-specific sandboxes in which existing regulation can be temporarily modified under licence — soon to be put on statutory footing via the Regulating for Growth Bill, which would give ministers power to suspend or vary specified rules for supervised pilots. The Data (Use and Access) Act 2025's rewrite of UK GDPR's automated-decision-making regime — new Articles 22A–22D, a "competent person" review requirement, a right to contest — came into force on schedule on 5 February 2026 and is untouched by any of this. What the reshuffle changed is the institutional scaffolding around that substantive model, not the model itself — which matters, because the scaffolding is what tells a regulated firm who inside government to actually talk to. 


Judgment 


Most of the reaction to the reshuffle — the open letter from AI sector bodies, the Institute of Directors' response, the "months of reorganisation... wastes months of people's time" warning from a former DSIT special adviser — read this as a coordination and delivery problem: will Whitehall move slower on compute strategy and skills while people get new email addresses. That's a reasonable first-order read, but it's an inputs question. The output question, and the one under-examined so far, is that policy voice and enforcement power have just been institutionally separated further than they already were. AI strategy and the AI Security Institute now sit inside the Cabinet Office, in a Taskforce backed by a prime ministerial adviser — real convening power, no independent statutory footing, and, as the IoD itself noted, no dedicated department's budget or delivery capability behind it. Every body that can actually investigate, fine or strike a firm off — ICO, FCA, PRA, MHRA, the Solicitors Regulation Authority — was left exactly where it was. In the UK's sectoral model those were never quite the same relationship, but the distance between "who sets the direction" and "who holds the power to act on you" just widened, at precisely the moment the government is asking firms to route more of their AI activity — Growth Lab licences chief among them — through the political side of that split rather than the regulatory side. 


The clearest evidence this gap is live rather than theoretical: the Legal Services AI Growth Lab — the government's first operating sandbox, and the closest thing the UK currently has to a functioning AI-governance instrument — opened for applications on 6 August 2026, sixteen days after DSIT ceased to exist, and trade press covering the launch that week was still describing it as "run by DSIT." Applications close 27 September 2026 — a date that has now arrived within this article's own writing window and still passed with no public statement on which department is accountable for the licence commitments being made inside it. Liz Kendall, the minister who championed both the Growth Lab and the Regulating for Growth Bill that would give it statutory teeth, is no longer in government. The mechanism survived its department's abolition. Its owner and its political sponsor did not — and nobody has yet said, on the record, who has picked either up. 


Course of action 


— If you're already in, or weighing, the Legal Services Growth Lab round or a future sector cohort, get explicit written confirmation of which department is accountable for the licence and any regulatory-modification commitments made inside it before you rely on them commercially. An undertaking from a sandbox mid-transition is not the same commitment as one from a settled department, whatever the application form still says. 


— Don't redirect government-relations effort toward the Cabinet Office AI Taskforce at the expense of the regulators that actually cover you. ICO, FCA, PRA, MHRA and the sector bodies kept every power they had before 21 July; the Taskforce has the Prime Minister's ear, not enforcement teeth. Route compliance engagement accordingly, per Stage 8 of your own classification methodology — the FCA Consumer Duty, PRA and ICO questions don't move because Whitehall reorganised. 


— If you have a live relationship with the AI Security Institute — voluntary model testing, pre-deployment evaluation, anything similar — confirm your point of contact and mandate survived the move to the Cabinet Office. Institutional relocation plus the departure of the two ministers who built the department around it is a continuity risk worth actively checking, not assuming away. 


— Track the Regulating for Growth Bill as live legislation, not a dormant DSIT-era proposal. It is the closest thing the UK has to primary AI legislation, it hands ministers power to suspend or vary existing regulation for licensed pilots, and it has now outlasted both the department and the minister who originated it — which says more about its momentum than the reshuffle headlines do.

Beyond advice. Into action.

Beyond advice. Into action.

MERIOL. INTELLIGENCE.

© 2026 Meriol Intelligence. All rights reserved.