AI security and governance for UK enterprises
The UK regulates AI through existing regulators rather than one act, which makes evidence the currency. Kapālins gives UK boards an inventory of every AI they run and proof, control by control, that each behaves as approved.
What changes for the UK enterprises, and when.
UK groups with European entities meet the EU AI Act's transparency duties from August 2026 and its high-risk obligations from December 2027, DORA since January 2025 and NIS2 through their EU operations. At home the ICO enforces UK GDPR on automated decision-making and ISO/IEC 42001 certification has become the board's shorthand for AI governance. The question boards ask is not which law, but whether anyone can list the AI the company runs.
- In force
EU AI Act Article 50 transparency duties apply (for UK groups with EU operations). Not delayed by the Digital Omnibus. Chatbots and generated content must be disclosed. Source (secondary)
- In force · upcoming
EU AI Act Annex III high-risk requirements apply (as amended by Regulation (EU) 2026/1744). Deferred from August 2026, not cancelled. Risk management, data governance, human oversight and cybersecurity requirements for high-risk systems. Source (secondary)
Dates: each entry links to its source. A source marked secondary is a law firm, analyst or vendor summary; check the primary text before relying on the date. The full calendar is on the AI regulation tracker.
Mapped on the platform for the UK.
Every framework page says which controls are proved by a live signal from the gateway, probes or device sensor, and which by assessment evidence. Both are exported in the regulator evidence pack.
Hosting and residency.
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Industries and cities.
Questions buyers in the UK ask.
Is Kapālins available in the UK?
Yes. Kapālins is delivered remotely from Melbourne, Australia, and through partners in the Authorised, Premier and Elite tiers. Organisations in London, Manchester, Edinburgh are served in the same way: a briefing on your own estate, then onboarding.
Which the UK frameworks does the platform map?
GDPR, ISO/IEC 42001, ISO/IEC 27001, SOC 2, DORA, NIS2, EU AI Act, OWASP LLM Top 10, NIST AI RMF. Each framework page lists the controls mapped and whether a control is proved by a live platform signal or by assessment evidence.
Where is our data hosted?
Today the platform and its data are hosted in Australia. A Sovereign plan for on-premises or air-gapped deployment is announced as coming soon.
Does the platform cover UK GDPR separately from EU GDPR?
The GDPR framework page maps the articles both regimes share. UK-specific guidance from the ICO is tracked on the AI regulation tracker; ask if a UK-only crosswalk is needed.