What UK regulations apply to AI vendor claims?

Three main regulatory bodies have oversight relevant to AI vendor claims in the UK. The CMA (Competition and Markets Authority) enforces the Consumer Protection from Unfair Trading Regulations 2008, which prohibit misleading commercial practices—including AI product claims that give buyers a false impression of capability. The ICO (Information Commissioner's Office) enforces UK GDPR, which requires transparency when AI processes personal data, including explanations of automated decision-making. ASA/CAP enforces advertising standards for AI-related claims in UK ads. Each applies in different contexts: CMA covers commercial practices broadly, ICO covers data processing, ASA/CAP covers advertising specifically.

What does the CMA expect from AI product marketing claims in the UK?

The CMA applies the Consumer Protection from Unfair Trading Regulations 2008 to AI product marketing. Under these rules, a commercial practice is misleading if it gives the average consumer a false impression of the product's characteristics, including its accuracy, scope, or results. This means an AI product claim that implies a broader capability than the product delivers—or omits material limitations—can be a misleading commercial practice without being a formal advertisement. The CMA has been active in reviewing AI-enabled digital markets and has published communications on AI and consumer protection.

What does the ICO require vendors to disclose about AI that processes personal data?

Under UK GDPR, vendors that use AI to process personal data must disclose the lawful basis for processing; what data categories the AI accesses; whether the AI makes automated decisions that significantly affect users (Article 22); and how users can query or object to those decisions. If a vendor's AI claim involves personalization, profiling, or automated recommendations, the vendor should be able to point to their DPIA, privacy notice, and Article 22 disclosure. An AI claim like 'AI-personalised for you' without these disclosures visible is a signal to ask for the UK GDPR documentation behind it.

How is UK AI claims regulation different from US FTC rules?

The FTC focuses on whether an AI claim is backed by competent and reliable evidence before it is published—primarily a substantiation standard for the claim itself. UK regulation adds two additional dimensions: the CMA's consumer protection rules cover the overall commercial impression created (not just the literal claim), and the ICO's UK GDPR requirements apply whenever AI processes personal data, requiring transparency beyond just claim accuracy. UK buyers also benefit from ASA/CAP's specific AI advertising standards. In practice, a UK buyer asking for evidence about an AI vendor claim may need to consider all three contexts depending on whether the claim is in an ad, on a product page, or involves personal data processing.

What questions should I ask a UK AI vendor about ICO compliance?

Ask: Does this product process personal data using AI, and if so, what is the UK GDPR lawful basis? Has a Data Protection Impact Assessment (DPIA) been completed for the AI feature? What personal data does the model access, and how long is it retained? If the AI makes or influences decisions about individuals, do Article 22 automated-decision-making rights apply, and how does the vendor support them? Where is the AI processing conducted, and is the data transferred outside the UK? These questions are separate from product performance claims—they go to the data protection foundation of an AI product sold or used in the UK.

What is the ASA/CAP standard for AI claims in UK advertising?

The ASA November 2024 report on AI as a marketing term found that many UK ads use 'AI-powered' or 'AI-enabled' without explaining what the AI actually does or produces. For UK advertising, the ASA/CAP standard requires that AI-related claims give viewers an accurate impression of the product: what the AI does, what it does not do, and what limitations apply. Specific claim types—accuracy figures, no-limits creative claims, and professional-replacement language—carry a higher substantiation burden. The existing ASA/CAP AI advertising claims guide on this site covers those patterns in detail.

UK AI claims: CMA and ICO context for buyers

Last reviewed July 9, 2026

AI vendor claims in the UK are subject to consumer protection law enforced by the CMA, advertising standards enforced by ASA/CAP, and data protection requirements enforced by the ICO. This guide explains what each regulatory context means for buyers evaluating AI vendor claims—not what is legal advice, but what the UK regulatory framework says evidence should look like.

Check a UK AI vendor claim How the evidence method works

Fastest path: copy one exact vendor sentence that matches this pattern, then open the checker. Add the public URL only if you want readable page context recorded alongside the wording. The result is an evidence-burden note you can reuse in vendor follow-up or internal review, not a verdict. Not sure what a result looks like? See a sample receipt.

What to verify before you rely on the claim

Exact claim text as it appears in the product page, ad, or sales material.
Which UK regulatory context applies: ASA/CAP (advertising), CMA (consumer protection), or ICO (data protection).
For ICO context: lawful basis, data categories, automated-decision disclosure, and DPIA status.

Sources behind UK AI claims: CMA and ICO context

ASA/CAP AI as a Marketing Term report ASA/CAP guidance
· November 13, 2024
ASA/CAP official report reviewing how advertisers use AI as a descriptor and what evidence is expected for AI-related claims in UK advertising.
ICO: Guidance on AI and data protection ICO guidance
· Accessed July 2026
ICO's principal guidance on how UK GDPR applies to AI systems, covering transparency, fairness, data minimisation, automated decision-making, and accountability requirements.
ICO: How do we ensure fairness in AI? ICO guidance
· Accessed July 2026
ICO guidance on fairness in AI processing, including how AI decisions should be explainable and what data subjects can expect.
CMA: Communications on artificial intelligence CMA guidance
· Accessed July 2026
CMA's official communications on AI, covering foundation models, consumer protection in AI-enabled markets, and competition considerations for AI products.
ASA ruling: Haikou Chengfa Technology Co Ltd (Aurai AI) — AI video generation ad ASA enforcement
· 2026
ASA ruling on an AI video generation tool ad for lack of visible content restrictions. Shows what UK advertising evidence is expected for AI creative-tool claims.

Documented UK AI claims: CMA and ICO context examples

"AI-personalised recommendations to improve your decisions"

Vague AI-powered

Source and date: Common AI personalization marketing pattern · Pattern relevant to ICO transparency obligations under UK GDPR
Evidence signal: Personalization claim without disclosing that personal data is processed, which model runs, or how to opt out or query the decision.
Evidence gap: Under UK GDPR, the vendor should be able to state: what personal data the AI processes, what logic the model uses, what the user can do to object or query an AI-assisted decision, and which Article 22 automated-decision rights apply.
Buyer question: For the AI-personalised recommendations claim, what personal data does the model process, how does the user query or object to a decision, and does Article 22 automated-decision-making apply?

Load this sample in the checker

"AI-powered solution trusted by UK businesses to replace manual compliance review"

Automation / Replacement

Source and date: Common AI automation marketing pattern · Pattern relevant to CMA consumer protection and ASA/CAP substantiation standards
Evidence signal: Professional-replacement language combined with UK-market trust claim, without naming what the AI cannot do or when a qualified reviewer is still required.
Evidence gap: Under CMA consumer protection (CPRs), a claim that replaces manual expert review must not give a misleading impression of the product's capabilities. The buyer needs task scope, failure handling, and a clear disclosure of what still requires human review.
Buyer question: For the replaces manual compliance review claim, which review tasks are fully automated, which still require a qualified reviewer, and what happens when the AI output is wrong?

Load this sample in the checker

"Our AI is trained on UK-specific data for accurate UK results"

Accuracy / Performance

Source and date: Common UK-targeted AI marketing pattern · Pattern relevant to ICO training-data transparency and ASA accuracy substantiation
Evidence signal: UK-specific accuracy claim without naming the dataset, date range, what UK-specific means for the model, or how the training data was sourced and processed.
Evidence gap: The buyer needs the training dataset description, time period, geographic coverage, whether personal data was used and under what legal basis, and whether the accuracy claim applies to the buyer's specific use case.
Buyer question: For the UK-specific training data claim, what dataset was used, over what period, was personal data included and under which UK GDPR legal basis, and how was the resulting accuracy measured?

Load this sample in the checker

Evidence map for UK AI claims: CMA and ICO context

Claim pattern	Evidence needed	Buyer question
AI personalization or profiling claim ('personalised for you', 'AI learns your preferences')	UK GDPR lawful basis, data categories processed, automated decision-making disclosure, right to object or query, and the vendor's ICO registration status.	Does this personalization involve automated decision-making under Article 22, and what is the user's right to query or object?
AI replacing qualified human review ('automated compliance', 'replaces manual audit')	Task scope and limits, human review boundary, failure handling, professional liability boundary, and what the product cannot do.	Which tasks are fully automated, which still require a qualified reviewer, and who is responsible when the AI output is incorrect?
AI accuracy or performance claim in UK-marketed ads ('most accurate AI', '98% accurate for UK users')	Benchmark scope, UK-specific dataset, test period, product version, error rate, and whether the claim was live at the time ASA/CAP guidance applied.	What test or dataset produced this number for UK users, and does the benchmark setup match our expected use case?
AI compliance claim in UK market ('GDPR-compliant AI', 'UK-GDPR ready')	ICO guidance alignment, DPA and UK GDPR lawful basis, data minimisation evidence, retention policy, and whether a Data Protection Impact Assessment has been completed.	Has a DPIA been completed for this AI product, and which ICO guidance on AI and data protection does the vendor align with?
AI market position or competitive claim in UK ('first AI for UK compliance', 'only UK-trained model')	Comparison set, date, source of comparison, what UK-trained or UK-specific means, and how the claim will be maintained as competitors change.	What defines the comparison set for this first or only claim, and how was it verified for the UK market specifically?

Evidence buyers need for UK AI claims: CMA and ICO context

Exact claim text as it appears in the product page, ad, or sales material.
Which UK regulatory context applies: ASA/CAP (advertising), CMA (consumer protection), or ICO (data protection).
For ICO context: lawful basis, data categories, automated-decision disclosure, and DPIA status.
For CMA/consumer context: whether the claim gives a misleading impression of the product's capabilities.
For ASA/CAP context: whether the claim explains what the AI does versus what it implies.

Buyer questions for UK AI claims: CMA and ICO context

Is this claim in an ad (ASA/CAP applies), a product description (CMA/CPRs apply), or a data-processing disclosure (ICO applies)?
If AI processes personal data, what is the UK GDPR lawful basis, and has a DPIA been completed?
Does the automation claim disclose when human review is still required and who is responsible for errors?
Does the accuracy claim name the benchmark and whether it applies to UK-specific use cases?
Does the compliance label name the exact standard, scope, and auditor—or only imply UK-market readiness?

Safer wording for UK AI claims: CMA and ICO context

AI-assisted [task] for UK users, processing [named data types] under [lawful basis]; full details in our Privacy Notice.
Automates [named review steps] for UK compliance context; [other steps] require qualified reviewer sign-off.
Measured [X%] on [named benchmark] for [content type], with UK-sourced test data described in our model documentation.
'AI-enabled' in this product means [workflow step] uses [model type] to produce [output]; a [professional role] reviews each result.

UK AI claims: CMA and ICO context questions

What UK regulations apply to AI vendor claims?: Three main regulatory bodies have oversight relevant to AI vendor claims in the UK. The CMA (Competition and Markets Authority) enforces the Consumer Protection from Unfair Trading Regulations 2008, which prohibit misleading commercial practices—including AI product claims that give buyers a false impression of capability. The ICO (Information Commissioner's Office) enforces UK GDPR, which requires transparency when AI processes personal data, including explanations of automated decision-making. ASA/CAP enforces advertising standards for AI-related claims in UK ads. Each applies in different contexts: CMA covers commercial practices broadly, ICO covers data processing, ASA/CAP covers advertising specifically.
What does the CMA expect from AI product marketing claims in the UK?: The CMA applies the Consumer Protection from Unfair Trading Regulations 2008 to AI product marketing. Under these rules, a commercial practice is misleading if it gives the average consumer a false impression of the product's characteristics, including its accuracy, scope, or results. This means an AI product claim that implies a broader capability than the product delivers—or omits material limitations—can be a misleading commercial practice without being a formal advertisement. The CMA has been active in reviewing AI-enabled digital markets and has published communications on AI and consumer protection.
What does the ICO require vendors to disclose about AI that processes personal data?: Under UK GDPR, vendors that use AI to process personal data must disclose the lawful basis for processing; what data categories the AI accesses; whether the AI makes automated decisions that significantly affect users (Article 22); and how users can query or object to those decisions. If a vendor's AI claim involves personalization, profiling, or automated recommendations, the vendor should be able to point to their DPIA, privacy notice, and Article 22 disclosure. An AI claim like 'AI-personalised for you' without these disclosures visible is a signal to ask for the UK GDPR documentation behind it.
How is UK AI claims regulation different from US FTC rules?: The FTC focuses on whether an AI claim is backed by competent and reliable evidence before it is published—primarily a substantiation standard for the claim itself. UK regulation adds two additional dimensions: the CMA's consumer protection rules cover the overall commercial impression created (not just the literal claim), and the ICO's UK GDPR requirements apply whenever AI processes personal data, requiring transparency beyond just claim accuracy. UK buyers also benefit from ASA/CAP's specific AI advertising standards. In practice, a UK buyer asking for evidence about an AI vendor claim may need to consider all three contexts depending on whether the claim is in an ad, on a product page, or involves personal data processing.
What questions should I ask a UK AI vendor about ICO compliance?: Ask: Does this product process personal data using AI, and if so, what is the UK GDPR lawful basis? Has a Data Protection Impact Assessment (DPIA) been completed for the AI feature? What personal data does the model access, and how long is it retained? If the AI makes or influences decisions about individuals, do Article 22 automated-decision-making rights apply, and how does the vendor support them? Where is the AI processing conducted, and is the data transferred outside the UK? These questions are separate from product performance claims—they go to the data protection foundation of an AI product sold or used in the UK.
What is the ASA/CAP standard for AI claims in UK advertising?: The ASA November 2024 report on AI as a marketing term found that many UK ads use 'AI-powered' or 'AI-enabled' without explaining what the AI actually does or produces. For UK advertising, the ASA/CAP standard requires that AI-related claims give viewers an accurate impression of the product: what the AI does, what it does not do, and what limitations apply. Specific claim types—accuracy figures, no-limits creative claims, and professional-replacement language—carry a higher substantiation burden. The existing ASA/CAP AI advertising claims guide on this site covers those patterns in detail.

Method and limits

This guide explains the UK regulatory context for AI vendor claims. It is not legal advice, an ICO or CMA compliance certification, an advertising clearance service, or a procurement approval. For specific legal questions, consult qualified UK counsel.

Cite this page for source-backed evidence gaps and buyer questions, not as a truth finding, legal conclusion, compliance certification, company accusation, or company rating. If you have the exact vendor wording, Check a UK AI vendor claim and paste one sentence first. If a source has changed, or you have supporting evidence or a company response, send a private correction or source note.