The UK's approach to AI regulation - an update

By contrast to the approach adopted by the European Union, the member states of which unanimously approved the final text of the EU AI Act earlier this month, the UK Government proposed to rely on the existing regulatory framework to address the risks posed by AI, with regulators being guided by five cross-sectoral principles to be interpreted and applied within their respective sectoral remits.

For further information regarding the White Paper, please see our recent briefing here.

The consultation response largely reaffirms the Government's commitment to this approach: it remains determined "not to rush to regulate AI". Despite strong support in the consultation response for putting the five principles on a statutory footing, the Government has no plans to do so, wishing to retain flexibility.  The focus instead is on how its plans will be implemented in practice. Most notably, the Government has asked several regulators (including, the Information Commissioner's Office, the Financial Conduct Authority and the Competition and Markets Authority (CMA)) to publish an update outlining their strategic approach to AI by 30 April 2024.

This would seem to indicate that UK businesses and other stakeholders can shortly expect to receive some much welcome guidance regarding the manner and means by which regulators will seek to apply the UK's legal and regulatory framework to AI, albeit that the core message remains the same – when deploying AI, UK businesses should continue to be mindful of their existing legal and regulatory obligations.

The consultation response also expands upon the Government's plan for a new central function to "monitor and assess risks across the whole economy and support regular coordination and clarity" and the steps it intends to take to analyse and review potential gaps in existing regulatory powers and remits. Specifically, a new "multidisciplinary team" is to be established within the Department for Science, Innovation and Technology (DSIT) to monitor for cross-sectoral issues, and an additional £10 million of funding has been allocated to help regulators develop capabilities to respond to AI that some may currently lack. This resourcing issue was laid bare in the recent House of Lords Communications and Digital Committee report regarding large language models and generative AI, which identified numerous regulators including the CMA and Ofcom as, at the date of publication, having zero dedicated AI governance staff.

Signalling a potential change in direction, the consultation response does, however, make a case for "further targeted binding requirements on [developers of] highly capable general-purpose AI systems", which it seems safe to assume would capture organisations such as Open AI and Google DeepMind. The response acknowledges that, if these systems continue to develop at the current rate, voluntary measures may be "deemed incommensurate to the risk". The Government also recognises that if risks posed by general-purpose AI (which are likely to have cross-sectoral impact) are left to regulators to address within their current remits based on existing laws, this could result in these risks not being effectively mitigated.

However, the Government does not want to introduce binding measures "too soon" and the response (perhaps unsurprisingly in a general election year) puts this issue squarely within the "wait and see" box.

The White Paper also acknowledged the unwavering tension between the extent to which intellectual property rights (specifically, copyright) are being undermined via the unauthorised use of data for the training and deployment of AI and the need for high-quality training material. In the hope of finding a non-legislative solution to this issue, the UK Intellectual Property Office (UKIPO) convened a working group of rights holders and AI developers for the purpose of constituting a voluntary AI copyright code of practice intended to promote investment in creativity, whilst overcoming the barriers faced by AI developers to data mining.

However, it was announced on 5 February 2024 that the code has been shelved after the working group failed to agree on a voluntary framework. This means that responsibility for finding a route through this complex issue has now been returned to DSIT, assisted by the Department of Digital, Culture, Media and Sport. The consultation response indicates that ministers from these departments will now lead a further period of engagement with the AI and rights holder sectors.  It is looking somewhat doubtful whether a voluntary code of practice is workable and new legislation (which the UKIPO's summary of the Government's ongoing programme of work in this area, published on 29 June 2023, noted as being a possibility) may be a more realistic outcome.

A further key issue which remains unresolved is that of liability - specifically, how to fairly and effectively distribute legal responsibility across the value chain, as well as how to identify the point at which one regulator's remit ends and another's begins.  The consultation skates over the issue of liability again, admitting that there's "no easy answer".

The Government's ongoing analysis of this area and the international conversation around general-purpose AI may lead to the conclusion that - once "understanding of risk has matured" - the introduction of further legislation is unavoidable in order to maintain public trust and mitigate the risks posed by AI.  The obvious difficulty will then be developing a law (or set of laws) that successfully treads the fine line between promoting innovation (thereby encouraging investment in the UK) and protecting the public from a range of risks (some of which are known and some of which are not).