AI Providers: UK Cyber Security Docs

For UK cyber security compliance, AI providers must document their risk assessments under the NIS Regulations, their data protection impact assessments under the UK GDPR, and the technical and organisational measures they use to secure AI systems. This article explains the specific documents required, who must produce them, and how they fit together.

Background: The UK Regulatory Landscape

The UK does not yet have a single AI-specific cyber security law. Instead, AI providers must comply with a patchwork of existing regulations that apply to digital services and data. The most relevant are the Network and Information Systems (NIS) Regulations 2018, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 for connected devices. The NCSC (National Cyber Security Centre) also publishes voluntary guidance, such as the “Guidelines for Secure AI System Development,� which, while not mandatory, is widely treated as the baseline for good practice.

Core Documentation Requirements

There is no single “AI compliance document.� Instead, providers must maintain a set of records that demonstrate they have identified and mitigated cyber risks. The essential documents are:

• Risk Assessment (NIS): If you are an operator of essential services or a relevant digital service provider, you must document a risk assessment that covers the AI systems you use or provide. This should identify threats, vulnerabilities, and the likelihood and impact of a cyber incident.
• Data Protection Impact Assessment (DPIA): Under UK GDPR Article 35, a DPIA is required where processing is likely to result in a high risk to individuals’ rights and freedoms. Many AI systems that process personal data—especially those involving profiling, large-scale monitoring, or sensitive data—trigger this requirement. The DPIA must describe the processing, assess necessity and proportionality, and identify and mitigate risks.
• Technical and Organisational Measures (TOMs): You must document the security measures you have in place. This includes encryption, access controls, logging, monitoring, incident response, and staff training. The documentation should be specific enough to show how these measures apply to the AI system’s lifecycle, from development to deployment and decommissioning.
• Incident Response Plan: While not always explicitly required, a documented incident response plan is a critical part of demonstrating compliance. It should outline how you will detect, report, and recover from a cyber incident affecting your AI systems.

How It Works: What the Regulators Expect

The documentation is not a one-time exercise. Regulators expect it to be a living set of records that are updated as the AI system evolves. For example, if you add a new data source or change the model’s decision-making logic, you should review and update your risk assessment and DPIA. The UK’s Information Commissioner’s Office (ICO) has stated that it expects organisations to be able to demonstrate accountability—meaning you can show, with evidence, that you have taken steps to comply. That evidence is your documentation.

For NIS, the relevant competent authority (such as Ofcom for telecoms or the ICO for some digital services) can request to see your risk assessment and TOMs. For UK GDPR, the ICO can request your DPIA and any related records. In practice, this means your documentation should be clear, accessible, and detailed enough to be audited.

How to Choose What to Document

Not every AI provider needs every document. The key is to determine which regulations apply to you. Ask yourself:

• Are you a “relevant digital service provider� under NIS? This includes online marketplaces, online search engines, and cloud computing services. If yes, you need a NIS risk assessment.
• Do you process personal data with your AI? If yes, you likely need a DPIA, especially if the processing is novel or high-risk.
• Is your AI part of a product that connects to the internet? If yes, the PSTI Act requires you to document security requirements for the product, including how you will handle vulnerabilities.

If you are unsure, it is safer to document more rather than less. A risk assessment that covers both NIS and GDPR is often a good starting point, as it will identify the other documents you need.

Common Problems and Misconceptions

A frequent misconception is that “AI� is exempt from these rules because it is “just software.� That is not the case. If your AI processes personal data, the UK GDPR applies regardless of the technology. Another common problem is that providers treat documentation as a box-ticking exercise, producing generic policies that do not reflect the actual system. Regulators are increasingly looking for substance, not just paper. For example, a DPIA that does not identify specific risks related to the AI’s training data or decision-making is likely to be criticised.

Another issue is the assumption that documentation is only needed at the start. In reality, documentation must be maintained. If you update your AI model, you should update your risk assessment. Failure to do so could leave you non-compliant without realising it.

Comparison: UK vs. EU AI Act

The EU’s AI Act, which is now in force, imposes more explicit documentation requirements for high-risk AI systems, such as technical documentation and logging. The UK has not adopted the AI Act, and its approach is more sectoral. This means that a provider operating in both markets may need to produce separate sets of documents to satisfy each regime. However, the UK’s NCSC guidelines align closely with international standards, so many of the same principles apply. For a UK-only provider, the focus remains on NIS, GDPR, and PSTI (if applicable).

Costs and Practical Considerations

The cost of producing and maintaining this documentation varies widely. For a small startup, it might involve a few days of work for a data protection officer or external consultant. For a large enterprise, it could be a significant programme involving legal, security, and engineering teams. There is also the cost of the security measures themselves, which must be documented. However, the cost of non-compliance can be much higher: fines under UK GDPR can reach up to £17.5 million or 4% of global turnover, and NIS breaches can also result in substantial penalties.

Frequently Asked Questions

Do I need a DPIA for every AI system?

No. A DPIA is only required when processing is likely to result in a high risk to individuals. Many simple AI systems that process minimal personal data may not need one. However, if you are unsure, it is best to carry out a screening exercise and document why a DPIA is or is not needed.

What is the NCSC’s role in compliance?

The NCSC is the UK’s national cyber security authority. It does not regulate AI directly, but its guidelines are considered best practice. Following them can help you meet the requirements of NIS and GDPR, and they are often referenced by regulators as a benchmark.

Can I use a template for my risk assessment?

Yes, but you must adapt it to your specific system. A generic template that does not mention your AI’s data flows, algorithms, or threats will not be sufficient. Regulators expect to see a system-specific analysis.

What happens if I don’t document my AI’s cyber security?

If you fall under NIS or UK GDPR, you could face fines, enforcement notices, and reputational damage. Even if you are not directly regulated, poor documentation can make it harder to win contracts or pass due diligence.

Is documentation enough to be compliant?

No. Documentation is evidence of compliance, but you must actually implement the measures you describe. If you document strong encryption but do not use it, you are not compliant.

Related

• Dig Ruby Guide: How to Use It
• Multi Site Hosting: What to Check Before Buying
• Malware Protection If You Turn Off S Mode