There is no UK AI Act and no general duty to declare AI use on a website. If someone has told you otherwise, they were selling you something. What does apply is narrower, duller and genuinely worth fixing — and it happens to be the same work that gets you named by ChatGPT.
This review compares what your website publishes against what your regulator requires it to publish, fixes the technical layer, and flags anything else for your compliance officer. Twelve points, one afternoon of my time, and no scaremongering.
The UK regulates AI through the rules it already had, enforced by the regulators you already answer to. Nothing here is new legislation aimed at you; all of it is checkable today.
If AI touches personal data anywhere in your business — triaging enquiries, drafting correspondence, transcribing consultations — UK GDPR transparency duties require your notice to say so and explain how. Most practice privacy notices predate the tools they now use.
Articles 22A–22D of the UK GDPR, inserted by the Data (Use and Access) Act 2025, govern significant decisions made solely by automation, with safeguards including information, human intervention and a right to contest. Relevant if you screen enquiries, applicants or claims automatically.
Since May 2026 the ICO has had a statutory duty to produce a binding Code of Practice on AI and automated decision-making. Final ADM guidance is expected over summer 2026 and the Code is likely to follow in 2027. When it lands it will be cited directly in enforcement — worth being ahead of, not panicked by.
The ICO's expectation is that this is obvious from the interface, not buried in a privacy policy. A customer-service chatbot also engages consumer protection law on the answers it gives, and your sector rules where a regulated service is being discussed.
SRA transparency rules on price and complaints information. SRA publicity rules requiring accuracy. GDC, CQC and MHRA restrictions on health claims and prescription-only treatments. FCA financial promotion rules. The CAP Code over all of it, plus the ban on fake or incentivised reviews.
Research published in July 2026 found AI chatbots returning false information about roughly half of London's small businesses — wrong hours, wrong services, out-of-date prices. In a regulated practice, publicity accuracy is a regulatory expectation, and the engines are now a publication channel you do not control but can influence.
The transparency duties in Article 50 apply from 2 August 2026, with machine-readable marking of synthetic content following on 2 December 2026. Penalties reach €15 million or 3% of worldwide turnover. It reaches UK businesses — but it follows the users and the content, not your postcode.
The four duties are specific: systems that interact with people must make clear they are machines; generative outputs must be marked as artificially generated; people exposed to emotion-recognition or biometric categorisation must be told; and deepfakes, plus AI text published to inform the public on matters of public interest, must be disclosed.
Because a Birmingham practice with UK-only clients and no AI assistant is very unlikely to be in scope, and I would rather be the person who told you that than the one who sold you a compliance package on the strength of a headline. If you are in scope, you'll want to know before Sunday.
A chatbot, an AI phone assistant, an automated triage form on a page EU clients use. If yes, the chatbot disclosure duty is engaged.
Marketing campaigns count. Synthetic media depicting real people carries the deepfake disclosure duty on top.
Narrower than it sounds, and there is a carve-out where a human has reviewed the text and someone holds editorial responsibility for it — which is how your content should be produced anyway.
An AI engine will not confidently recommend a practice whose prices it cannot find, whose practitioners it cannot verify, whose regulated status is locked inside a footer image, and whose details contradict the public register. Those are the same four things your regulator wants published clearly. Seven of the twelve points below raise your visibility score as a side effect.
Every one is verifiable on a public website, fixable technically, and evidenced with a screenshot in your report. Points marked ▲ also raise your AI visibility score.
This review is a technical and editorial comparison of published website content against publicly available regulatory requirements. It is not legal, regulatory or compliance advice, and AEO-REX is not a regulated adviser.
Findings are provided for your compliance officer or solicitor to consider. You remain responsible for the content published on your website, and everything I draft goes to you for approval before it goes live.
I don't issue certificates, badges or “compliant” marks, and I'd be wary of anyone who does.
In the UK, no. There is no UK AI Act and no general labelling duty. The nearest real obligations are that your privacy notice explains AI processing of personal data, and that a chatbot is obviously a machine. Anyone telling you there is a blanket duty is selling fear.
Only if your AI reaches people in the EU. Article 50 duties apply from 2 August 2026 and follow the users and the content, not where you're based. The three-question triage above settles it in a couple of minutes, and I record the answer with reasons.
No. I'm not a solicitor or a regulated adviser and I don't pretend to be. I check what your website publishes against what your regulator requires, fix the technical layer, and flag the rest for the person qualified to advise you.
Because it's the same work. Clear prices, verifiable credentials, accurate service descriptions and honest reviews are what regulators require you to publish and what AI engines need in order to name you. I do it once and you get both.
I tell you plainly, in writing, with the evidence and the relevant published requirement — and I recommend you take it to your compliance officer or solicitor before we touch anything. I'd rather lose a fix than have you publish something on my say-so.
Yes — the twelve points are published above precisely so you can run them yourself. If you'd rather do it in-house, do. The paid version is me doing it, evidencing it, and fixing the technical half.