King's Speech set out broad digital policy agenda

On Wednesday, 13 May 2026, the King's Speech set out an extensive list of bills and draft bills for the Labour government's second legislative agenda of the parliamentary session following the election. 

While there is uncertainty regarding the policy focus due to an anticipated leadership contest within the Parliamentary Labour Party, the Speech included several bills addressing digital infrastructure, healthcare modernisation, national security, and law enforcement. One notable omission is the lack of a comprehensive artificial intelligence (AI) Bill. However, this was expected after we learned in March that its introduction had been postponed until 2027 due to significant backlash from the creative industries. 

Together, the legislative package represents a diverse range of policy initiatives, reflective of a range of data protection and cyber risks and opportunities.

The Digital Access to Services Bill introduces a voluntary digital identity scheme. Moving away from the mandatory system, the government explains that it will use the "latest security technology" to allow citizens to access public services and the wider digital economy while maintaining control over their data. 

Healthcare reform is addressed through the NHS Modernisation Bill, which proposes a single patient record accessible across all healthcare providers. The Bill will require GPs and hospitals to share patient data, as well as to invest significantly in technology and cybersecurity. 

The Police Reform Bill introduces a legal framework for the use of facial recognition and similar technologies for law enforcement purposes, outlining the specific circumstances in which their use can be justified. 

To stimulate economic development, the Regulating for Growth Bill aims to reduce the burden of complex regulations. Central to this is the creation of regulatory sandboxes, including an AI Growth Lab, where rules can be temporarily relaxed to test new technologies. The Bill also strengthens the growth duty of independent regulators, including the Information Commissioner's Office (ICO) and Ofcom. 

The government also reaffirmed its commitment to the Cyber Security and Resilience Bill (CSR Bill), which was announced two years ago but did not complete its passage through Parliament. 

Training Announcement: Find out more about our range of independent accredited data protection and AI governance qualifications from IAPP and BCS that support practitioners in adopting emerging technologies such as facial recognition.