AI news that matters for UK SMEs: September 2026 roundup
Easy Insight Team ·
Three things worth an SME's attention this month, none of them a model release. The UK's automated decision-making rules changed in February and most small businesses have not noticed; a statutory AI code of practice is on its way; and the adoption data suggests almost everyone is using AI shallowly rather than not at all.
This post describes regulatory developments in general terms. It is not legal advice — take advice on your own position.
The automated decision-making rules changed, quietly
This is the item with the most direct consequences, and it landed quietly.
Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, replacing Article 22 of the UK GDPR. Legal commentators describe the effect as a reframing rather than a tightening: automated decision-making moves from a prohibition with narrow exceptions to a right of challenge with safeguards. A broader range of automated processes now fall outside the strictest rules, provided the conditions on human involvement are met.
For a small business the practical reading is permissive, conditionally. If you use AI to screen applications, prioritise customers, set prices or triage complaints, the question is no longer only "are we allowed to" — it is whether a person can meaningfully intervene and whether the individual affected can contest the outcome.
The homework takes an afternoon: list every automated decision you already make about a person, and write down who can overturn each one. Most businesses find that list longer than expected, because decisions embedded in software rarely feel like decisions.
A statutory AI code of practice is coming
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force on 12 May 2026, requiring the Information Commissioner to prepare a statutory code of practice covering the processing of personal data in the development and use of AI and automated decision-making, including provisions on children's data.
The code is still in development, so this is a plan-for item, not a comply-by-Friday one. The direction of travel favours businesses that can already document what their systems do. In the meantime the ICO's guidance on AI and data protection remains the reference point, and its position that most AI processing triggers a DPIA has not changed.
The adoption data says: wide, not deep
Around 35% of UK businesses with 10 or more employees reported using at least one AI technology in June 2026, alongside 28% of those with fewer than 10 employees. But the average adopter runs only about 1.6 AI technologies, up from 1.4 in late 2023 (ONS, published 20 July 2026).
The strategic read for an SME is encouraging. The competitive bar is not "adopt AI" — most competitors have done that in the trivial sense. It is depth: changing how one process runs, end to end, and measuring it. That remains rare, so it is still available as an advantage.
If you want a structured way to work out whether you are ready to do that, our twelve-question readiness assessment scores it in about an hour.
Also worth a glance
Agent pricing is consumption-based, and consumption grows with success. Microsoft's Copilot Studio bills in Copilot Credits rather than seats — as of September 2026, a pre-purchase pack is £153.80 a month for 25,000 credits, excluding VAT. If you are piloting an agent, set a budget cap on day one, not after the first invoice.
The Power BI August release carried a deadline, not just features: from October, Desktop versions from March 2026 or earlier lose the ability to save and share to OneDrive and SharePoint — what to do about it.
What we would do this month
Make the list of automated decisions. Nothing else here has a deadline attached, and that list is what every future obligation will be built on — and it is useful for running the business regardless of regulation.
If AI governance is live for you, our AI strategy and readiness work covers it alongside the commercial case, and the AI practice page sets out how we scope engagements.
Frequently asked questions
Did the UK rules on automated decision-making actually change?
Yes. Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, replacing Article 22 of the UK GDPR. Legal commentators describe the effect as reframing automated decision-making from a prohibition with narrow exceptions into a right of challenge with safeguards — a liberalisation, but one that comes with obligations around human involvement and the ability to contest a decision.
Is the ICO's AI code of practice in force yet?
No. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force on 12 May 2026 and require the Information Commissioner to prepare the code. The code itself is still being developed, so this is a plan-for item rather than a comply-by-Friday one.
What should a small business actually do this month?
Write down every automated decision you already make about a person — credit checks, application screening, pricing, prioritisation — and record who can overturn each one. That list is the foundation of any compliance position, and most businesses discover they have more automated decisions than they thought.
Easy Insight is a UK consultancy for AI, web, apps and data — senior specialists only, no juniors.
Next step
Wondering where AI would actually pay in your business?
An AI strategy and readiness review (from £2,500) tells you where AI pays, where it doesn't, and what to leave alone. The price is fixed in writing before we start, and the advice comes from a team that runs AI in its own products.