London, 9 June 2026 — The UK Department for Science, Innovation and Technology (DSIT) published its updated generative AI (GenAI) guidance on 31 January 2026. As of June 2026, that guidance has moved from advisory to industry baseline: procurement templates, vendor contract tiers, and operational product roadmaps in the UK now routinely reflect DSIT expectations. This update explains what has changed in the past three months, which controls organisations are actually deploying, and the specific steps tech, procurement and risk teams should take this week.

Why this still matters — and why now

Treat DSIT’s guidance like a new safety standard rather than a suggestion. The core message is unchanged: GenAI systems must be managed as enterprise software that produces business‑critical data and risk. What’s different in June 2026 is enforcement by implication — auditors, insurers and procurement teams now expect documented controls. Think of DSIT as raising the speed limit: you can still drive, but there’s a patrol and cameras where there weren’t any three months ago.

What’s changed since January 2026

  • Contracts and vendor tiers: A majority of UK‑facing vendors now publish a “commercial non‑use” or data‑isolation tier that explicitly excludes customer data from model training, or offers per‑customer isolated models. Buyers can demand these tiers in RFPs.
  • Procurement uptake: Public sector procurement templates across several UK departments incorporated DSIT checklist language in Q2 2026, and private sector large buyers have adopted similar language as a default.
  • Product changes: Mainstream platforms now include configurable prompt/output retention, role‑based admin controls, redaction options, and explicit provenance metadata for retrieval‑augmented generation (RAG) systems.
  • Operational tooling: “Model observability” and governance platforms matured quickly: integrated change‑notification APIs, sandbox testing windows, and automated post‑update evaluation suites are becoming standard procurement asks.

Evidence and industry signal

AI Business Solutions ran a targeted survey of 210 UK IT, procurement and risk leaders in May 2026. Results: 78% said DSIT guidance materially changed procurement language in the prior quarter; 66% reported adding at least one GenAI‑specific technical control (retention settings, admin audit trails, or redaction) to production systems in Q1–Q2 2026. Those findings match vendor roadmaps: platform teams prioritized governance features over new consumer-facing functionality during Q1–Q2 2026.

What DSIT’s guidance covers — and practical implementation

The guidance clusters around governance and accountability, procurement due diligence, testing and monitoring, transparency, and data protection. Below are pragmatic steps you can implement in the next 7–90 days.

Governance and accountability

  • Name a single GenAI owner (CISO, Head of AI, or Chief Data Officer). Record decision rights in your risk register within 7 days.
  • Create an approvals workflow—require privacy, legal and security sign‑off for use cases handling personal or confidential data. Use a lightweight ticket for pilots and a fuller board paper for customer‑facing deployments.
  • Maintain a GenAI inventory (model, vendor/tier, purpose, inputs/outputs, data flows, retention policy, last test date). Publish an internal “model map” and refresh it monthly for production services.

Procurement expectations (what to ask for)

  • Contract clause: explicit statement on whether customer data will be used to train models, with an enforceable opt‑out or an isolation tier where feasible.
  • Change notifications: require a material model change notice (commonly 30 calendar days for major updates) and the right to run regression tests in a vendor sandbox before full roll‑out.
  • Operational evidence: admin audit logs, configurable retention, redaction tools, provenance metadata for RAG, and security attestations (SOC 2, ISO 27001) as a baseline. Ask for recent third‑party attestation reports where possible.

Risk assessment and testing

  • Build an evaluation harness: a repeatable set of prompts and ground‑truth outputs that reflect business flows and regulatory limits. Automate it to run on every model change.
  • Define SLOs (service‑level objectives) for hallucination/error rates tied to business impact (e.g., ≤0.5% unacceptable output for regulated advice workflows). Treat SLO breaches as incident triggers requiring human review.
  • Red‑team high‑impact flows. For HR, finance, legal advice or fraud detection, run adversarial tests and document outcomes in a risk register.

Transparency and user experience

Label AI interactions clearly in customer channels. Where an output affects a decision, require human sign‑off and retain prompt and response records as business documents. That keeps decisions auditable and aligns with likely regulatory expectations.

Data protection and security

Treat prompts and outputs as sensitive business data. Use encryption at rest and in transit, strict role‑based access control, and retention settings mapped to legal obligations. For RAG systems, attach provenance metadata to all retrieved sources so you can trace, validate and redact material if necessary.

Impact: who needs to act and by when

If your organisation is moving GenAI beyond internal pilots into customer support, HR screening, finance automation or developer tools, act now. Practical timeline: within 7 days name an owner and add three procurement questions; within 30 days update RFP language and require vendor sandbox testing; within 90 days deploy automated evaluation for production models.

Reactions and industry sentiment

Vendors generally welcome clearer expectations because standardised requirements shorten procurement cycles. Risk and compliance teams say DSIT’s guidance lets them operationalise “reasonable steps.” Privacy advocates remain split: some want stronger enforcement mechanisms, others appreciate that auditable controls make non‑compliance easier to spot. Insurers are beginning to price cyber/AI policies based on whether organisations can demonstrate DSIT‑aligned controls.

What’s next — rest of 2026

  • Standardisation: expect broader adoption of machine‑readable model documentation (model cards), change‑notification APIs and vendor attestations as de‑facto standards through Q3–Q4 2026.
  • Regulatory scrutiny: sector regulators and the Information Commissioner’s Office (ICO) will increasingly reference DSIT expectations when assessing incidents; treat the guidance as the baseline for “reasonable” controls.
  • Insurance and audits: expect insurers and auditors to require proof of continuous evaluation and documented procurement decisions when underwriting or certifying systems.

Who this is for (and when it’s worth the effort)

Mid‑sized and enterprise organisations deploying GenAI for customer‑facing services, HR, finance or regulated advice should prioritise compliance work now. Small teams piloting internally should adopt lightweight guardrails: an approved tool list, a prompt policy, a named owner, and simple automated tests — think of it as seat belts plus a helmet.

FAQ

Does DSIT guidance change UK law?

No. The guidance is not legislation. However, it sets expectations that influence procurement norms, insurer requirements and what regulators later deem “reasonable” behaviour during incident investigations.

What contract clause should we add first?

Start with data‑use commitments: require an explicit statement about whether customer data will be used for model training, and contractually secure an opt‑out or isolation tier where available. Follow with change‑notification and sandbox testing rights.

How do I measure “hallucination” for business workflows?

Define a business‑specific test set with known correct outputs and run it automatically after each model update. Track error rates, severity (regulatory/legal impact), and set SLOs. Require human review when SLOs are breached.

Can small businesses keep this lightweight?

Yes. Small teams should document approved tools, limit sensitive data inputs, enforce basic access controls, assign a responsible owner, and maintain one repeatable test for their highest‑impact use case.

Alex Rivera is Technology Editor at AI Business Solutions. He’s been taking apart computers since he was eight; his focus is helping organisations make practical, secure choices about emerging tech.