United Kingdom: a sector-based approach to AI with onus on established regulators

The UK has to date steered away from adopting any specific AI legislation. The Conservative administration published its AI regulation strategy in a 2023 White Paper, which set out the then government's intention to "leverage the expertise of our world class regulators", who "understand the risks in their sectors and are best placed to take a proportionate approach to regulating AI."

The new administration

It was anticipated by some that the election of a Labour government in July 2024 might signal a change in approach and, perhaps, a move towards a more prescriptive "EU-style" mode of regulation in the UK. However, apart from setting out an intention to regulate developers of the "most powerful" AI models – supposedly within the next year - and to ban sexually explicit deepfakes, there is no indication that Labour intends to legislate further to create a separate AI regulatory regime. It is unknown at this stage what regulation in the UK of the "most powerful" AI models will look like – for example, whether the UK will assess an AI model's power according to risk (as in the EU), or according to computational power (as in the US).

Other proposed legislation could have a specific impact on AI. Changes are set out under the Product Safety and Metrology Bill which aims to enhance consumer protection with particular reference to technological advances, such as AI. Likewise, the Digital Information and Smart Data Bill promises "targeted reforms" to some areas of data law where a lack of clarity impedes the safe development of some new technologies, which might impact AI systems. It is also possible that trade unions will push for legislation for enhanced employment rights to address risks posed by AI in the workplace.

With Labour yet to propose significant changes, the cross-sectoral, regulator-led approach promulgated by the Conservatives continues as the default position on AI regulation in the UK.

Cross-sectoral principles

Recognising the need for some consistency across the AI landscape, the 2023 White Paper proposed five cross-sectoral principles for existing regulators to interpret and apply within their remits in order to promote safe, responsible AI innovation. These are:

• Safety, security and robustness
• Appropriate transparency and explainability
• Fairness
• Accountability and governance
• Contestability and redress

These principles – which are based on the OECD principles and are therefore not entirely novel - are to be implemented in accordance with existing legislation. Regulators were invited to impose additional guardrails suitable for their specific industries sectors. Official guidance, Implementing the UK's AI Regulatory Principles, was published in February 2024 to overlay and bring some coherence to the sector-specific rules.

Regulators at the forefront

Current UK regulators, the Competition and Markets Authority (CMA); the Information Commissioner's Office (ICO); the Office of Communications (Ofcom) and the Financial Conduct Authority (FCA) have all have started taking action in line with the requirements of the Conservative's 2023 White Paper: the CMA has published a report on AI foundation models; the FCA has published its approach and engaged in various discussions with the Bank of England and the Prudential Regulation Authority on AI and machine learning; and Ofcom's Strategic Approach to AI was published in March 2024. The ICO has issued guidance on the interplay between AI and data protection, with a consultation series centred on GenAI, and has also revamped its audit toolkit to include an AI component.

Central oversight

Recognising the need to co-ordinate the various approaches, the CMA, the ICO, the FCA and Ofcom have combined to work together through the Digital Regulation Co-operation Forum to review digital regulation generally and promote a coherent and cohesive approach between them.

Other central bodies include:

• a central function set up by the Department for Science, Innovation and Technology to support regulators' understanding of the AI risk landscape and provide expert risk analysis
• the AI Standards Hub, which aims to promote "trustworthy and responsible" AI through industry standards as a governance mechanism
• the AI Safety Institute, a directorate of DSIT, dedicated to research and testing in the field of AI with a view to mitigating risk and strengthening good practice.

The Labour government has indicated its intention to promote further central oversight with the establishment of a new Regulatory Innovation Office with a stated aim of co-ordinating cross-sector issues. As such, its role may well impact the governance of AI systems.

Current snapshot

A fear that the UK was taking too light-touch an approach led to various proposals to fill the perceived gaps. Proposals for a broad-brush new Bill were dropped once the recent general election was announced and, although the Automated Vehicles Act has reached the statute book, it applies to vehicles only and has no relevance to AI in other products or services. Given this lack of AI-specific regulation, issues raised by the development and use of AI are currently subject only to relevant parts of current legislation and guidance.