The IAPP analyzed the 2026 King's Speech for digital policy signals. The headline: no dedicated AI bill, but multiple incremental measures across financial conduct, online safety and data protection. For SaaS that sells to UK customers, the post-Brexit divergence from EU is now visible enough to plan for.
Where UK aligns with EU
- UK GDPR remains closely aligned with EU GDPR in core principles
- Cookie consent rules mirror ePrivacy Directive interpretation
- Children's data protection follows EDPB-style approach
Where UK diverges
- No equivalent to EU AI Act; instead, sectoral regulators (FCA, Ofcom, MHRA) apply existing powers to AI use cases
- Online Safety Act focuses on user-generated content with stronger duty-of-care obligations
- Different cross-border transfer regime: the UK-EU adequacy decision is in renewal limbo through 2026
| Topic | UK posture | EU equivalent |
|---|---|---|
| AI regulation | Sectoral, no horizontal bill | AI Act |
| Online content | Online Safety Act | DSA |
| Data transfers | UK adequacy decision (in review) | EU SCC |
| Cookies | PECR aligned with ePrivacy | ePrivacy Directive |
What to add to your privacy policy
- UK GDPR specific contact (the ICO, not the EU EDPB)
- Designation of a UK representative if you process UK data from outside the UK
- Reference to PECR for cookie consent (UK equivalent to ePrivacy)
- If you use AI in regulated sectors (financial, healthcare), reference the sectoral regulator's stance
The UK divergence is mostly subtractive in 2026: less prescriptive AI law, more flexible sectoral application. SaaS that built for EU AI Act will over-comply for UK; SaaS built only for UK will under-comply for EU. Plan accordingly.
Conclusion
UK digital policy is not a copy of EU. The differences are tactical rather than structural in 2026, but they will widen. SaaS that sells to both blocs needs a privacy policy with clearly delineated UK and EU sections. The investment is modest and the audit clarity pays off.
To generate per-jurisdiction privacy sections that handle UK and EU divergence cleanly, try Termerly free.