One rulebook or several for AI content operations UK regulations

What to take away

A Manchester marketing team drafts a campaign with an AI tool, schedules emails and publishes ads. Three regimes can apply at once: data protection, advertising codes and electronic marketing rules.
The ICO's guide to PECR covers email and electronic marketing consent, so a purchased list is a poor foundation for AI-assisted outreach.
The ASA's advertising codes cover online ads whichever tool produced the draft.
The Digital Economy Act 2017 sits alongside newer data rules rather than replacing them.
England, Scotland, Wales and Northern Ireland share most of this framework, but some enforcement details differ. Individual cases need a qualified adviser.

Start with the data, not the tool

AI content operations usually begin with a prompt and a data source. If that source holds personal data, processing must comply with the UK GDPR and Data Protection Act 2018, including having a lawful basis and a clear purpose. The ICO's guidance on AI and data protection and its AI and data protection risk toolkit help organisations assess relevant risks. The ICO's guide to the Privacy and Electronic Communications Regulations explains consent for email and electronic marketing, including the soft opt-in for existing customers.

Lawful basis for AI data

Does the data source hold personal data?

Yes

Record lawful basis and purpose

Proceed, but document the source

That matters when a tool enriches a contact record or predicts who to email next. The software does not change the legal position. The controller must still show why the message is being sent and whether consent exists.

Advertising rules follow the output

The ASA's advertising codes set rules for advertising, including online content. A generated headline, image or landing page is in scope when it promotes a product or service.

The test is the effect on the audience, not whether a person or model wrote the words. For a fuller map of duties, see the AI content operations UK rules and compliance guide.

In England, whether you must label AI use depends on the sector and the claim. Misleading impressions can breach the codes even where no AI tool is mentioned. For consumer-facing claims, the CMA enforces consumer protection provisions in the Digital Markets, Competition and Consumers Act 2024; misleading claims may engage those rules as well as the advertising codes.

Where the Digital Economy Act 2017 fits

The Digital Economy Act 2017 contains provisions on data sharing and online services, which shape how public bodies and service providers handle information. It does not create a separate AI content rulebook.

Data protection law, the advertising codes and electronic marketing rules do most of the daily work. The 2017 Act matters when a project involves public sector data or online service duties.

Other UK rules and the AI policy framework

The UK government's A pro-innovation approach to AI regulation sets out a regulator-led approach, coordinated by the Department for Science, Innovation and Technology (DSIT), rather than a single AI statute. This policy approach does not replace binding laws such as the UK GDPR, PECR or the Online Safety Act 2023.

The Online Safety Act 2023 gives Ofcom regulatory duties for in-scope user-to-user and search services; it does not make every AI content workflow subject to the Act. In financial services, AI-generated promotional material must still meet applicable Financial Conduct Authority (FCA) financial promotion rules.

Contracts carry the operational risk

Regulation sets the floor. Contracts decide who carries the cost when something goes wrong. A supplier term that allows training on your content, or one silent on output ownership, can undo a careful compliance plan. Review indemnities, data processing terms and exit rights before renewal.

Our guide to AI content operations commercial contracts explains the clauses worth checking. Bring a solicitor into any live negotiation. This article is general guidance, not legal advice.

A simple operating checklist

Record the lawful basis for each data source feeding an AI tool.
Keep evidence of consent for electronic marketing, with the source and date.
Check ad claims against the CAP code and relevant consumer protection rules before publication.
Check whether the Online Safety Act 2023 or sector-specific rules, such as FCA financial promotion rules, apply to the service or content.
Ask suppliers whether your inputs are used for model training.
Review the stack when regulator guidance changes.

Glossary

PECR: Privacy and Electronic Communications Regulations, covering email, cookies and similar technologies.
CAP code: The UK Code of Non-broadcast Advertising and Direct and Promotional Marketing.
Controller: The organisation that decides why and how personal data is processed.
Soft opt-in: A limited exception allowing marketing to existing customers in some circumstances.

Common questions

Does the UK have one AI content law?

No single statute covers AI content operations. The UK GDPR and Data Protection Act 2018, PECR, advertising codes and consumer protection law can apply together. The Online Safety Act 2023 applies to in-scope services, while sector rules may add duties. The UK government's AI regulation approach is regulator-led, not a single AI rulebook. The Digital Economy Act 2017 adds data sharing and online service provisions.

Do we need consent to email AI-generated marketing?

The origin of the text does not decide consent. PECR governs electronic marketing, so you need a lawful route to the recipient, usually consent or the soft opt-in. A lawful basis under the UK GDPR does not by itself satisfy PECR.

Is AI disclosure required in advertising?

Not as a blanket rule. The CAP code requires ads to be obviously identifiable and not misleading. If AI use changes how a reasonable viewer understands the ad, disclosure may be needed. Sector rules can add duties.

Does this apply across the UK?

Most of the framework applies UK-wide. Some public body and enforcement details differ in Scotland, Wales and Northern Ireland. Check each market you serve and take advice on individual cases.