Reference

UK horizon scan

Changes already announced or under way that will shape AI designs in the UK between now and 2030, and what a delivery team can do about each one today. Dates move, so check the source before you commit a plan to one.

Dates can move. A design guide, not legal advice. Only changes that are real and announced, or already under way, are listed. Check the current position with your compliance team and the regulator before you commit. Checked on 9 November 2026.

Show

2026

  1. 30 November 2026, then 2027
    AnnouncedSector rules
    Awaab's Law: phases 2 and 3

    From 30 November 2026, social landlords' fixed timescales extend from damp and mould and emergency hazards to excess cold and heat, falls, fire and explosion, electrical hazards, hygiene and pests, and structural collapse. Phase 3, due in 2027, covers the remaining hazards except overcrowding.

    Design repairs triage around every hazard, not just damp and mould, so you don't rebuild it in 2027. Make sure each report starts the clock in your housing system, whatever a model predicts.

    GOV.UK: Safer homes for 4m tenants with quicker action on dangerous homes
  2. 2 December 2026
    AnnouncedEU rules
    EU AI Act: content marking deadline and new prohibitions

    Transparency duties have applied since 2 August 2026: people in the EU must be told when they are dealing with an AI system. Under the Digital Omnibus, machine-readable marking becomes due on 2 December 2026 for AI content tools placed on the market before 2 August 2026, and new prohibitions on AI that generates non-consensual intimate images or child sexual abuse material apply from the same day.

    If EU customers use your chatbots or content tools, check the AI disclosure is clear, that generated images, audio and text carry the required marking, and what stops each generative feature being misused.

    European Commission: AI Act
  3. December 2026 to spring 2027
    AnnouncedHealth and care
    MHRA programme for AI medical devices

    The government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare on 6 October 2026. The MHRA plans draft guidance on managing changes to AI devices by December 2026, a consultation on how software and AI devices are qualified and classified by spring 2027, and a fuller roadmap in spring 2027.

    Write a clear intended-purpose statement for each clinical AI tool and keep a change log for model and prompt updates. Watch for features drifting from admin support into diagnosis or treatment.

    GOV.UK: Government response to the National Commission's recommendations

2027

  1. Late 2026 to 2027 (expected)
    ExpectedData and AI law
    ICO code of practice on AI and automated decisions

    Regulations in force since 12 May 2026 (SI 2026/425) require the ICO to write a statutory code. Its draft guidance on automated decision-making, consulted on from 31 March to 29 May 2026, will inform the code. No date for the draft code has been announced.

    Design against the draft guidance now: human involvement that is meaningful, not a rubber stamp, and a record of why each decision was made.

    ICO: Automated decision-making, including profiling
  2. Late 2026 to 2027 (expected)
    ExpectedHealth and care
    Revised clinical safety standards

    NHS England reviewed DCB0129 and DCB0160 in a consultation that ran from 29 June to 11 September 2026. It asked about scope, including medical devices, and whether other risk management standards should be used. Revised versions are expected.

    Keep safety cases current under the existing standards, and structure hazard logs so they can be mapped to a new version without starting again.

    NHS England: National review of DCB0129 and DCB0160
  3. January 2027 (planned)
    ExpectedSector rules
    Subscription contracts regime

    New DMCC Act rules for consumer subscriptions: clearer information, reminders, cooling-off periods and easy exit, including online cancellation where the customer signed up online. Draft regulations give a start of 1 January 2027; the final legislation and guidance are still being made.

    Make sure a retention agent can't block or delay cancellation. Build a simple exit route the agent can't override, and log every retention offer.

    GOV.UK: Government response on the subscription contracts regime
  4. 1 January 2027
    AnnouncedTax and finance
    UK carbon border adjustment mechanism

    A charge on imports of aluminium, cement, fertiliser, hydrogen, and iron and steel goods. The first accounting period is calendar 2027, with returns and payment due by 31 May 2028.

    Teach customs document processing to tag goods in scope and to request embedded emissions data from suppliers with each shipment.

    GOV.UK: CBAM policy summary
  5. Late 2026 to 2027 (expected)
    ExpectedSector rules
    EU GMP Annex 22 on AI

    The EU and PIC/S consulted in 2025 on a new GMP annex for AI and a revised Annex 11. The draft expects a documented AI lifecycle, performance monitoring and change control, and says large language models shouldn't be used in critical GMP applications. A final text is expected.

    For sites that supply the EU or follow PIC/S, keep AI in deviations and documentation advisory, record its intended use, and plan validation as if the draft were final.

    European Commission: Consultation on Chapter 4, Annex 11 and Annex 22
  6. 18 March 2027
    AnnouncedFinancial services
    Operational incident and third-party reporting

    New FCA, PRA and Bank of England rules (FCA PS26/2, PRA PS7/26) set thresholds and a single process for reporting operational incidents. Firms must notify material third-party arrangements and keep a register of them.

    Add cloud AI services to the third-party register, and make sure an AI failure, such as wrong outputs at scale, feeds your incident process like any other outage.

    FCA PS26/2: Operational incident and third party reporting
  7. 15 March 2027, then 15 March 2029
    AnnouncedCyber and resilience
    Shorter TLS certificate lifetimes

    Public TLS certificates have lasted at most 200 days since 15 March 2026. The limit falls to 100 days in March 2027 and 47 days in March 2029, under a CA/Browser Forum decision.

    Automate certificate renewal for every API, EDI and agent endpoint. Manual renewal will not keep up.

    CA/Browser Forum: Ballot SC081v3
  8. 31 March 2027, then 2028 and 2029
    AnnouncedSector rules
    Telecoms security code: next deadlines

    Version 1.1 of the Telecommunications Security Code of Practice was issued on 14 July 2026 and aligned with version 4.0 of the NCSC Cyber Assessment Framework. For large and medium providers, a group of measures is due by 31 March 2027, with new measures due by 31 March 2028, 31 December 2028 and 31 December 2029.

    Treat any AI operations tool that can reach the management plane as privileged access. Put it in the threat model and the supplier assurance work now.

    DSIT: Telecommunications Security Code of Practice 2026 (version 1.1)
  9. 7 May 2027
    AnnouncedSector rules
    Electricity settlement moves to half-hourly

    Under market-wide half-hourly settlement, suppliers must migrate all their meters to the new arrangements by 7 May 2027. The switch to the new settlement timetable is planned for July 2027.

    Billing exception models trained on the old patterns will drift. Plan retraining and new checks for half-hourly data before the deadline, not after.

    Ofgem: P487 decision on the MHHS migration milestone
  10. During 2027 (expected, date not set)
    ExpectedSector rules
    Employment Rights Act 2025: shift rights

    Qualifying zero-hours, low-hours and agency workers gain rights to guaranteed hours, reasonable notice of shifts, and payment when shifts are cancelled, moved or cut short at short notice. The government's consultation on the detail closed on 25 August 2026.

    Build notice periods and short-notice payments into scheduling models as hard constraints and costs, so the optimiser doesn't save money by breaking them.

    Employment Rights Act 2025
  11. 2027 (expected)
    Going through ParliamentTax and finance
    Commercial Payments Bill: late payment reforms

    The Bill would cap most business payment terms at 60 days, make late-payment interest mandatory, and let the Small Business Commissioner investigate and fine persistent late payers. It finished its Lords stages in October 2026 and is now in the Commons. Detail will follow in secondary legislation.

    Hold payment terms as data, not in contract PDFs. Make sure invoice matching and dispute handling are fast and logged, so an AI-assisted accounts payable process helps you pay on time rather than hiding delays.

    UK Parliament: Commercial Payments Bill [HL]
  12. 2 December 2027
    AnnouncedEU rules
    EU AI Act: Annex III high-risk duties

    High-risk duties begin for uses listed in Annex III, including credit scoring of individuals, recruitment, and risk assessment and pricing for life and health insurance. This only matters to UK firms whose systems are used in the EU.

    Work out whether you are the provider or the deployer. Then plan risk management, data governance, logging, human oversight and technical documentation for each in-scope system.

    European Commission: AI Act

2028

  1. Late 2026 to 2028 (expected)
    Going through ParliamentCyber and resilience
    Cyber Security and Resilience Bill

    The Bill updates the NIS Regulations 2018. It brings medium and large managed service providers and data centres into regulation, speeds up incident reporting and lets regulators designate critical suppliers. The Lords finished their stages on 2 November 2026 and the Commons now considers their amendments. Many duties will come through secondary legislation by about 2028.

    If you are a managed service provider, or rely on one to run AI services, map those services, agree incident reporting paths, and start collecting supplier evidence.

    UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
  2. Expected from 2028
    Going through ParliamentFinancial services
    The PSR moves into the FCA

    The Financial Services and Markets Bill abolishes the Payment Systems Regulator and moves its functions, including APP scam reimbursement, to the FCA. It completed its Lords stages on 15 September 2026 and is now in the Commons.

    Reimbursement duties don't change yet. Keep fraud rules and limits as configuration, not code, so changes from the PSR's planned 2027 review or the move to the FCA are a settings change.

    UK Parliament: Financial Services and Markets Bill [HL]
  3. By 2028, then 2031 and 2035
    AnnouncedCyber and resilience
    Post-quantum cryptography migration

    The NCSC's milestones: a full discovery exercise and migration plan by 2028, the highest-priority systems migrated by 2031, and everything by 2035.

    Inventory the cryptography in your AI pipelines, APIs, EDI links and key stores, and ask each supplier for its post-quantum plan.

    NCSC: Timelines for migration to post-quantum cryptography
  4. 2 August 2028
    AnnouncedEU rules
    EU AI Act: Annex I product duties

    High-risk duties begin for AI that is a safety component of, or is itself, a product covered by EU product laws listed in Annex I, such as machinery and medical devices.

    If you sell machinery or devices into the EU, check whether vision inspection or predictive maintenance acts as a safety function, and fold AI into your conformity assessment plan.

    European Commission: AI Act
  5. 25 September 2028, with other dates from 2026 to 2029
    AnnouncedCyber and resilience
    Cloud AI service retirements

    Azure Custom Vision and the Azure Vision Image Analysis API retire on 25 September 2028, after which calls fail. Azure Maps Route v1 retires by 31 March 2028 and Azure IoT Central on 20 September 2029. On AWS, several AI services closed to new customers during 2026, including the original Bedrock Agents (now Agents Classic), SageMaker Model Monitor and Clarify, and SageMaker Ground Truth.

    Check every managed AI service in your design against its provider's lifecycle notices, and keep models, labels and data portable so a move is a project, not a crisis.

    Microsoft Learn: Migrate from Custom Vision
  6. Target December 2028
    Going through ParliamentHealth and care
    The Single Patient Record

    The Health Bill would give the legal basis for a Single Patient Record and move NHS England's functions into DHSC. It finished its Commons stages in September 2026 and was in Lords committee in November 2026. The government's target is to launch the record in the NHS App by December 2028, subject to the Bill passing.

    Build integrations on national standards and APIs, and clean up local records now, so joining the record later is a connection, not a migration.

    UK Parliament: Health Bill

2029

  1. 1 April 2029
    AnnouncedTax and finance
    Mandatory e-invoicing

    VAT invoices between UK VAT-registered businesses, including sales to public bodies, must be e-invoices exchanged over Peppol. HMRC's roadmap of 28 October 2026 plans a technical consultation in spring 2027, guidance on EDI and legacy systems in autumn 2027, and readiness testing in summer 2028. EDI can continue alongside.

    Map every invoice flow in and out, including EDI, PDF and email. Make invoice processing ready to read structured e-invoices first, and use AI for the exceptions that remain.

    GOV.UK: Roadmap for e-invoicing implementation
Sources, checked 9 November 2026

Building for what's coming?

It costs far less to design for an announced change now than to retrofit it later. Let's look at what affects your programme.

Book a call →The rules that apply today
Sam Naseem
Sam NaseemBirmingham, UK · UK & Europe
Available now