The Country That Won't Write an AI Act — UK DUA Act Section 80 and the AI Growth Lab: Light-Touch Reality

Hello, this is Ryuta Hamamoto from TIMEWELL.

The EU AI Act's general application date is 2 August 2026. What starts that day is the transparency obligations (Article 50), the harmonised-standards, conformity-assessment, CE-marking and registration provisions (Chapter III Section 5), and the Commission's power to fine general-purpose AI (GPAI) providers (Article 101) — not the substantive high-risk obligations, which apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. While Europe works through that staged schedule, the UK used the 2026 King's Speech to choose "no AI Act." No standalone AI Bill. What appeared instead was a Regulating for Growth Bill: a bill to loosen regulation, not write more of it.

Same Europe, Dover Strait, opposite roads. EU: risk-based comprehensive law. UK: sandbox plus sectoral regulation. Easy looks can mislead Japanese companies. Easy is not safe.

I want to walk through three pieces: DUA Act Section 80, AI Growth Lab, AI Security Institute, and how Japanese firms should engage without falling into the "UK looks light, so we're fine" trap.

TL;DR

• DUA Act Section 80: force 5 February 2026. Replaces UK GDPR Article 22 with 22A–D; ADM flips from ban to allow with guardrails
• AI Growth Lab: cross-economy sandbox announced October 2025; temporary regulatory relief for AI pilots
• Regulating for Growth Bill: 2026 King's Speech; no standalone AI Bill; cross-regulator coordination instead
• AI Safety Institute → AI Security Institute rebrand; language shift from Safety to Growth/Security
• Japanese trap: light UK rules do not cancel EU AI Act extraterritoriality

DUA Act Section 80 — 180° from ban to allow

To understand UK AI policy, start with data protection reform. The operational rules for AI live less in an "AI Act" label than in UK GDPR amendments.

Data (Use and Access) Act 2025 became law in July 2025; Section 80 took effect 5 February 2026. It fully replaces UK GDPR Article 22 with Articles 22A–D.¹

Old Article 22 mirrored EU GDPR Article 22: protection from automated decision-making.

• Data subjects have the right not to be subject to solely automated decisions
• Three exceptions: contract necessity, consent, legal authorization
• ADM based on special-category data generally banned

Structure: generally banned, exceptionally allowed.

New Articles 22A–D flip that:

• ADM is generally allowed
• Four mandatory guardrails: provide decision information, right to contest, right to human intervention, right to object
• Only special-category-based ADM remains generally banned

Government calls it a modern balance enabling ADM while protecting rights. Major firms such as IAPP commentary and Herbert Smith Freehills call it substantive ADM liberalization.² I lean that way too.

One detail boards miss: penalty scale stays full UK GDPR. 4% of turnover or £20 million, whichever higher, also for guardrail breaches. Looks light. Breach the relaxed zone and GDPR-scale fines still apply. Classic UK two-step design.

Further reading: EU side in EU AI Act and Digital Omnibus simplification. The EU pushing back its high-risk application dates and the UK unlocking ADM are the same deregulatory wave on different tracks.

AI Growth Lab — temporary relief to try AI

Beside Section 80, the strategic core is AI Growth Lab.

Announced 21 October 2025 by Technology Secretary Liz Kendall at the Times Tech Summit, it is a cross-economy sandbox.³ Classic sandboxes (FCA financial, MHRA medical) stay inside one regulator. AI Growth Lab spans the economy.

How it works:

• Firms whose AI product conflicts with existing rules apply
• A lead regulator is named; multi-sector cases form a regulatory consortium
• Temporary relief for real-world testing
• Successful pilots can drive permanent regulatory reform

"Test, then change the law if it works." Regulators that learn. I pair it with Utah's Regulatory Mitigation Agreement as two flagship learning-regulator designs.

Red lines stay out of relief: consumer protection, safety, fundamental rights. A deliberate message about what light-touch will not trade away, including EU and WTO relations.

Target sectors:

Sector	Illustrative AI uses
Health	Diagnostic support, drug recommendation, remote monitoring
Housing	Tenant screening, rent prediction
Professional services	Legal AI, accounting AI, legal tech
Transport	Autonomous driving, logistics optimization
Advanced manufacturing	Line optimization, quality inspection AI

For Japanese firms, a UK market pilot platform is real. A legal-tech company colliding with Solicitors Regulation Authority rules can apply, get SRA as lead regulator, and pilot under time-boxed relief.

Call for Evidence closed 2 January 2026; government is refining design. Full operation expected H2 2026.

Regulating for Growth Bill — choosing not to write an AI Bill

The May 2026 King's Speech formal bill list did not include an AI Bill.⁴ Instead: Regulating for Growth Bill. Odd name, but it is the UK AI regime:

• Statutory confirmation of sectoral regulators' AI oversight (Ofcom, CMA, ICO, FCA, MHRA)
• New cross-cutting coordination among them
• Statutory backing for the AI Security Institute (ex AI Safety Institute)
• Deliberately no single AI super-regulator

No AI Office-style super-regulator contrasts sharply with the EU. I call it a British regulatory portfolio strategy: AI keeps changing, so avoid locking to one domain silo.

And vocabulary: rebrand from AI Safety Institute to AI Security Institute is not cosmetic. Partnership with the Biden-era US AISI became harder under Trump's coolness (or hostility) toward "Safety," so "Safety" itself got awkward.

"Security" is neutral enough for Trump-era US policy; "Growth" in the bill title locks light-touch branding. Strategic vocabulary under political constraint is a UK governance trait I find hard not to admire, even when it makes the map harder for foreign counsel.

"UK is light" is the trap — EU AI Act extraterritoriality

If you feel "UK market looks easy," here is the main trap. Light UK rules do not cancel EU AI Act extraterritoriality.

The EU AI Act expressly applies extraterritorially. Providers placing AI on the EU market are in scope regardless of HQ.⁵ UK base does not help if you sell or supply AI into EU member states.

A London bank AI governance lead put it this way:

UK rules got flexible, but with Frankfurt or Amsterdam entities we still have to set full EU AI Act as the firm-wide baseline. Separate UK-only specs break operations.

So the real pattern is not dual light/heavy systems. It is EU AI Act as the common standard. Same for Japanese firms. Any non-zero chance of EU AI sales favors building UK products to EU AI Act specs long term.

When does AI Growth Lab still matter? UK-only AI and pre-EU pilot stages. Run light UK rules in pilot; upgrade to EU AI Act for scale-out.

Does your team still treat "HQ is London" as an EU-Act off-switch? If yes, that is the first conversation I would have.

Priorities for DUA Act and AI Growth Lab — WARP SECURITY

Three layers I work with leadership and operators:

First: data protection teams and DUA Act. Article 22 → 22A–D means processes designed around "ADM is banned so add human review" must be rewritten. Checklist: (a) decision information to data subjects, (b) contest rights, (c) human intervention, (d) objection, plus readiness for ICO's statutory code of practice (in drafting).

Second: product and BD on AI Growth Lab. If you plan UK AI services, put Growth Lab on the strategy map as the off-ramp when rules collide. Pre-map lead regulator, red lines, and application timing.

Third: executives on EU extraterritoriality. "UK is light" plus an EU entry plan produces dual-compliance failure. Decide at board level how far EU AI Act reach goes and how UK and EU ops unify.

TIMEWELL's WARP SECURITY decomposes this into checklist × strategy map × executive scenarios. ADM's four guardrails are line-item work against ICO draft code and your product design. Growth Lab readiness is template applications plus lead-regulator maps that speed entry decisions.

Not a UK-only story. Fold EU extraterritorial touchpoints into one decision flow. That is the hard part of applying the British approach to Japanese reality.

Latest developments as of August 2026

Light-touch continues in the UK; the other shore moves — in stages. The GPAI model obligations themselves (Chapter V) and the penalty provisions (Articles 99 and 100) have applied since 2 August 2025. What the general application date of 2 August 2026 newly switches on is the transparency obligations (Article 50), Chapter III Section 5 (harmonised standards, conformity assessment, CE marking, registration), and the Commission's power to fine GPAI providers (Article 101). The substantive high-risk obligations do not start that day: Annex III systems (Article 6(2)) apply from 2 December 2027, Annex I product-embedded systems (Article 6(1)) from 2 August 2028.

On penalties, prohibited AI practices (Article 5) carry up to €35 million or 7% of global turnover, and GPAI-related and other breaches up to €15 million or 3%, whichever is higher — a scale that backs the "UK-only specs break ops" practice (Regulatory framework for AI, European Commission).

The Digital Omnibus simplification package is now law as Regulation (EU) 2026/1744: adopted 8 July 2026, published in the Official Journal (OJ L 2026/1744) on 24 July 2026, in force from 27 July 2026. That amending regulation is what moved the high-risk application dates above. Japan published AI Business Operator Guidelines v1.2 on 31 March 2026 (METI). Binding UK ADM liberalization, EU, and Japan into one decision flow matters more, not less. Enterprise governance implementation: Governed enterprise AI agents.

Summary

If I were briefing a Japanese firm entering the UK, I would say: use Growth Lab for pilots, rewrite ADM processes for Section 80, and keep EU AI Act as the product baseline the moment an EU customer is on the roadmap.

• DUA Act Section 80 flips UK GDPR ADM from ban to allow with guardrails (force 5 February 2026)
• AI Growth Lab is a UK cross-economy sandbox for temporary relief and AI pilots
• Regulating for Growth Bill skips a standalone AI Bill for cross-regulator coordination
• Safety → Security Institute rebrand reflects redesigned US–UK partnership language
• "UK is light so we are fine" is a trap. EU AI Act extraterritoriality still applies

The UK differentiates from the EU by not writing AI law. Market logic still pushes full EU AI Act as the de facto global standard. The lighter your home rules, the more EU law still binds you. That paradox will define UK AI for the next few years.

Light-touch wisdom shows clearest in AI Growth Lab as a learning-regulator institution. Worth importing into Japanese policy debate, especially alongside AI Business Operator Guidelines v1.2. Growth Lab as another option to reference.

Further reading: EU AI Act and Digital Omnibus, US federal AI policy 2026, Illinois, Utah, Massachusetts state AI laws.

References

• Key aspects of the Data (Use and Access) Act take effect - Clifford Chance
• AI in the King's Speech 2026: Regulating for Growth Bill announced - Bird & Bird
• The potential and perils of the UK's AI growth labs proposal - IAPP
• The Data Use and Access Act 2025 (DUAA) - ICO

Footnotes

1. Data (Use and Access) Act 2025, Section 80 - Legislation.gov.uk ↩

2. How much does the Data (Use and Access) Act reform UK GDPR? - Herbert Smith Freehills Kramer ↩

3. AI Growth Lab - GOV.UK ↩

4. King's Speech signals diffuse UK digital policy agenda, but no AI bill - IAPP ↩

5. AI Watch: Global regulatory tracker - United Kingdom - White & Case ↩