Prove
Four apply to organisations of every kind; four more to UK financial services. Who each one covers, what it asks for, and where a record of every AI tool call helps. Each rule has its own guide and report.
EU AI Act transparency duties apply from 2 August 2026; the FCA's incident and third-party rules from 18 March 2027.
A summary, not legal advice: check your obligations with your compliance team or adviser.
| For every organisation | UK financial services | |||||||
|---|---|---|---|---|---|---|---|---|
| Your organisation | UK GDPR | EU AI Act | Security reviews | ISO 42001 | Incident reporting | Third parties | SM&CR | Consumer Duty |
| Any organisation | If you use personal data | If you serve the EU | If you sell to businesses | Voluntary | – | – | – | – |
| Banks and building societies | As for any organisation | Yes | Yes | Yes | If you serve retail customers | |||
| Investment and wealth firms | As for any organisation | Yes | If enhanced SM&CR, designated or CASS large | Yes | If you serve retail customers | |||
| Insurers | As for any organisation | Yes | If a Solvency II firm | Yes | If you serve retail customers | |||
| Payment and e-money firms | As for any organisation | Yes (4-hour deadline) | If authorised | No | If you serve retail customers | |||
These apply whatever your sector: when AI apps use personal data, serve people in the EU, or when your customers check your AI before they buy.
UK GDPR Article 30 (records of processing) and Article 35 (data protection impact assessments)
EU AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)
Your customers' security questionnaires: contractual, not law
ISO/IEC 42001: AI management systems, a voluntary standard
FCA rules for regulated firms, on top of everything above. The incident and third-party rules are new and apply from 18 March 2027.
Operational incident reporting: FCA PS26/2 (SUP 15.18) and FG26/3, from 18 March 2027
Material third-party register and notifications: FCA PS26/2 (SUP 15.19) and FG26/4, from 18 March 2027
The Senior Managers and Certification Regime: the duty of responsibility
The Consumer Duty: Principle 12 and PRIN 2A
Create a free workspace and add ContextGate to your AI apps in minutes. No card required.
We'll email you a sign-in link to set up your workspace.
Rather talk it through first? Book a 30-minute call