# Compliance research checklist

Required before drafting business plan Section 10 (Compliance and regulatory positioning) for a UK-domiciled raise. Every claim must cite a primary source (ICO guidance, gov.uk, regulator strategy document) verified by WebSearch.

## UK consumer-protection regime

**For estate-agency / property:** Digital Markets, Competition and Consumers Act 2024 (DMCC Act). In force from 6 April 2025. Supersedes the Consumer Protection from Unfair Trading Regulations 2008 for estate-agency consumer protection. Under the DMCC Act, **omitting material information is automatically an unfair commercial practice regardless of whether the omission affected the consumer's decision**. CMA holds direct enforcement powers including fines without court process. Property brochures must include Part B material information.

**For other verticals:** Identify the equivalent UK consumer-protection regime (financial services → FCA Consumer Duty; healthcare → CQC; legal services → SRA; etc.). Same pattern: cite the binding statute, name the regulator, identify the enforcement mechanism.

## UK data-protection and AI regime

- **UK GDPR** sits over UK data processing. Articles 22A to 22D (added by the Data Use and Access Act) govern solely automated decision-making.
- **No UK AI-specific statute in the 2026 parliamentary session.** Labour's 2024 King's Speech committed to "appropriate legislation on the most powerful AI models" but the Bill has not been introduced. A dedicated 2026 AI Bill is not expected.
- **ICO strategy.** June 2025 strategy "Preventing Harm, Promoting Trust" frames the regulator's approach. ICO consulting on updated Automated Decision-Making and Profiling guidance during 2025–2026, with a statutory code of practice on AI and ADM in the pipeline. First substantive enforcement guidance expected later in 2026.
- **UK is not adopting the EU AI Act.** Sector-led approach via existing regulators. Starmer's stated position: *"instead of over-regulating these new technologies, we're seizing the opportunities they offer"*.

## EU AI Act (relevant only to international expansion)

- Entered into force 1 August 2024.
- Fully applicable 2 August 2026.
- Classifies AI systems used in credit and insurance (which overlap with mortgage and property-financing decisions) as **high-risk**. Most marketing and operational AI applications sit at lower risk tiers.
- High-risk obligations: risk-management systems, data-quality controls, human oversight, transparency to affected individuals, conformity assessment, post-market monitoring.
- For UK-domiciled companies, the EU AI Act binds only when serving EU customers. Document the international expansion path and confirm whether any planned product crosses into high-risk territory.

## Adjacent UK obligations to verify per vertical

- **Estate Agents Act 1979** for property: distinguish software vendor (out of scope) from estate agent (in scope).
- **Money Laundering Regulations 2017 + Economic Crime and Corporate Transparency Act 2023** for AML obligations.
- **PECR (Privacy and Electronic Communications Regulations 2003)** for electronic marketing, cookies, and tracking. Sits alongside UK GDPR. Enforced by ICO with fines up to £500,000.
- **Sector membership bodies** (NAEA / ARLA Propertymark for property; equivalents per vertical).
- **Client Money Protection schemes** where the business handles client money.

## WebSearch protocol

For each regime, search for:

1. The primary statute / regulation page on gov.uk or the regulator's site.
2. A recent (within last 12 months) legal-firm briefing summarising current state.
3. The regulator's strategy document.

Examples that worked in the reference project:

- DMCC Act + Propertymark guidance withdrawal: `https://www.propertymark.co.uk/resource/material-information-guidance-withdrawn-as-the-digital-markets-competition-and-consumers-act-takes-over.html`
- ICO AI strategy: `https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/`
- UK AI Bill status: `https://iapp.org/news/a/king-s-speech-signals-diffuse-uk-digital-policy-agenda-but-no-ai-bill`
- EU AI Act compliance for UK businesses: `https://www.rmoklegal.com/guides/eu-ai-act-compliance-uk`

Cite the actual source URLs in the business plan's reply / Sources block (per the WebSearch tool's mandatory citation rule).

## The closing argument

The business plan's Section 10 ends with "Why compliance is the moat, not the tax": cloud-CRM-bolted-AI competitors inherit the vendor's data-protection posture; the product owns the agent's data sovereignty by design, so compliance is a competitive moat (especially into EU markets where the EU AI Act amplifies the cost differential).
