UK Passes AI Criminal Offences Law, Regulators Issue Hiring Automation Rules

By Hector Herrera | May 28, 2026

The UK's Crime and Policing Act 2026 has introduced criminal penalties for specific AI misuse, and the country's data regulator has published binding guidance requiring human oversight in AI-assisted hiring — two moves that together define what "regulated AI" actually looks like in Britain right now.

The UK has spent years triangulating between two goals: being a home for AI innovation and protecting citizens from AI harms. This week's developments show both happening simultaneously.

What the Crime and Policing Act Does

The Crime and Policing Act 2026 creates new AI-specific criminal offences — making certain misuses of AI systems prosecutable, not just civilly actionable. The specific conduct covered was not fully enumerated in today's briefings, but the legislation targets uses of AI in criminal activity, potentially including deepfake-assisted fraud and AI-enabled harassment.

This is a meaningful step. Most countries have struggled to apply existing criminal statutes to AI-assisted crimes because the law was written before the technology existed. Codifying AI-specific offences closes that gap and gives prosecutors clearer grounds to act.

ICO Hiring Guidance: Human Eyes Required

Separately, the Information Commissioner's Office (ICO) — the UK's data protection regulator — published guidance on AI in hiring. The core requirement: any AI-assisted hiring decision must include meaningful human oversight before an outcome is applied to a candidate.

That word "meaningful" is doing a lot of work. The ICO is not simply saying a human must click approve. It means the human reviewer must actually be capable of understanding and challenging the AI's output — not rubber-stamping a recommendation they can't interrogate.

For UK employers using AI to screen CVs, rank candidates, or conduct automated interviews, this guidance has immediate compliance implications. It aligns with the EU AI Act's approach to high-risk AI in employment contexts, but applies now, in the UK, under existing data protection law.

The Sandbox Piece

The third element is the Regulating for Growth Bill, which places AI regulatory sandboxes on a statutory footing. A sandbox, in regulatory terms, is a controlled environment where companies can test new AI products with real users under relaxed rules, with regulator oversight. Putting this on a legal basis gives businesses more certainty that participating won't expose them to liability later.

The combination — new criminal offences, stricter hiring rules, and formal innovation sandboxes — reflects the UK's bet that it can hold both sides of the equation: safety and speed.

What This Means for Businesses

Employers using AI in hiring: Audit your current tools now. "The AI ranked them" is not a defensible answer under the new ICO guidance. You need a documented process showing a qualified human reviewed and could override the AI's output.

AI vendors selling to UK employers: Explainability is no longer a feature — it's a compliance requirement. Your tools need to produce output a non-technical HR professional can actually evaluate.

Companies considering UK AI pilots: The sandbox legislation makes the UK a more attractive place to test regulated applications. Formal sandbox participation provides legal cover that informal pilots don't.

What to Watch

Watch for the ICO to begin enforcement actions under the hiring guidance — the first cases will set the bar for what "meaningful" oversight actually requires in practice. And watch how the Crime and Policing Act's AI offences are applied in the first prosecutions; that case law will define the scope of the new law far more clearly than the legislation itself.

Hector Herrera covers AI policy and regulation at NexChron.