Home > Blogs > The Future of AI Regulation in the UK

The Future of AI Regulation in the UK

Rogue AI agents, discrimination, harmful content, and personal data misuse are the key risks that has put AI safety top of the agenda very recently for the UK government. The gavel may thus come down upon AI soon, but what might a ‘UK AI Act’ look like for UK businesses?

The UK, alongside its recently estranged legislative partner the EU, has been at the forefront of regulations pertaining to the digital sphere ever since COVID lockdowns have exponentially increased screentimes amongst all demographics. New laws pertaining to anti-consumer practices and online harms, such as the DMCCA and Online Safety Act, have been spurned out in the 2020s by the Labour government to combat new risks born from the increased presence of consumers and businesses in the online world. However, it has perhaps lacked behind in one major development this decade. That is, namely, generative artificial intelligence (AI).

What is AI and where did it come from?

AI comes in all shapes and sizes, but the popularised technological development which has seen rapid growth recently has been generative AI. This type of AI was developed by large technology conglomerates since the 2010s through a combination of the ease of access to cheap electronics together with massive amounts of training data. It works on a process of ‘machine learning’ whereby computerised neural networks allow for the learning of patterns – especially linguistical patterns – to predict and generate highly relevant outputs for the inputs asked of it. The process of the development of such AI models has been dubbed as ‘deep learning’ and has led to the release of mainstream models such as ChatGPT and Claude.

What is the UK’s current stance on AI regulation?

The UK government’s approach to AI regulation has so far been one of ‘wait and see’, predicated by the Sunak government’s white paper on AI in 2023 which indicated a rather ‘hands off’ approach. This was a surprising choice by policymakers as the risks AI poses were known at that point. Indeed, our EU counterpart, whom is no doubt a legislative powerhouse, were already in deliberations for their seminal ‘EU AI Act’ at that point. Nonetheless, things could be changing, as UK Chancellor Healey exclaimed at Labour’s annual conference in September, that regulation is needed for AI in relation to personal data, cyber security, and children safety. Prime Minister Andy Burham has also touted that one of the key topics to be spoken about in the 2027 G20 summit (to be hosted in Manchester – the UK’s second largest tech hub) is AI regulation. All good and well to make such announcements, but what precisely could a ‘UK AI Act’ look like for businesses? To answer this, we must first look at the risks AI generates.

AI safety

To understand how AI regulation might operate, one must look at the key risks AI poses. Such risks will be from the perspective of commerce and trade (this article will unfortunately not talk about Skynet ‘judgement day’ scenarios which are probably best placed to be dealt with by national security laws). As such, the key risks regulation will tackle in the business sector will most likely follow Chancellor Healey’s proclamations of (i) personal data misuse (including discrimination) (iii) online harms and children safety (iii) cyber security.

Data protection and discrimination

Discrimination and data protection are two closely related areas. The UK GDPR already has closely guarded rules against automated decision-making which is one of the key use cases for AI. The general logic is that because AI is trained on human data it will therefore replicate the pre-existing prejudices apparent in human behaviour thereby leading to discriminatory practices against individuals. An unfair rejection of a job application, a wrongfully turned down work visa, or an incorrect allocation of social care caused by AI are real scenarios which must be mitigated against. Discriminatory outcomes may also be exacerbated by incorrect training methodologies and poorly executed goal criteria from its developers.

Outside of automation, however, there is a broader risk of non-compliance with the seven principles of personal data processing which underpin the entire rationale of the GDPR. Those are, namely, (i) transparency, fairness, and lawfulness (ii) purpose limitation (iii) data minimisation (iv) accuracy (v) storage limitation (vi) security (vii) accountability.

For example, in relation to transparency, due to the complexity of the technology, people may not know exactly what AI is doing with their personal information. Personal data, whether used to train the AI model itself or run an operation through it, may also be siphoned in a way which minimises or avoids the need for obtaining informed consent from individuals (known as ‘invisible processing’). In turn, this lack of transparency may lead to unfair processing as people’s reasonable expectations of what businesses do with their personal information might be subverted. Further, due to the autonomous nature of AI, personal data may eventually be processed for different purposes than that originally disclosed. Demonstrably, therefore, without proper governance, AI-led personal data processing has the propensity to breach the data protection principles in a cascading fashion and cause wholesale non-compliance with data protection laws.

The ICO has also very recently opened calls for consultations in relation to ‘agentic AI’ and personal data use. Agentic AI exacerbates the point about autonomy above. The risk being that, since some forms of AI operate with minimal human intervention and can learn from neural network feedback loops overtime, this may lead to scope creep away from lawful personal data processing. In other words, and quite crudely put, these AI ‘agents’ tend to have a ‘mind of their own’ which might lead to concerted action with other AI agents in an echo chamber of seemingly self-aware willingness to breach data protection laws to achieve whatever aim they might have.

Though the ICO has published broader guidance on the use of AI for personal data processing in general, as there is no legislative regime for AI regulation in the UK (yet) and thus no real yardstick for regulators to judge by, it reads quite repetitively. It is our view, therefore, that to determine the regulatory boundaries of AI-involved personal data processing, we would have to wait for a full UK legislative regime on AI. There is currently a lacuna in the law here, therefore.

Online harms and children safety

The UK has recently adopted a strong approach to the protection of vulnerable individuals accessing and using online platforms. The Online Safety Act 2023 (OSA) is the centrepiece legislation for this area and will likely be supplemented by AI-specific regulation in the future.

We have previously seen news of AI models generating harmful materials, such as child sexual abuse material and content that encourages self-harm. AI thus increases the ability of such content from being generated and subsequently encountered by vulnerable individuals on the internet. Indeed, Ofcom, the watchdog for the OSA, has published guidance which already takes into account online harms caused by generated AI outputs. Ofcom states it makes no distinction between ‘user generated content’ (content uploaded to platforms made organically by real uses) and generative AI outputs, meaning AI is already partially regulated in this area. But, as above with data protection, actual legislation needs to be released to provide maximum clarity.  

Cyber security

AI poses a real threat to cyber security, and this is mostly in two ways. The first way is cyber attackers using AI to leverage their attacks on organisations in order to disrupt operations and/or exfiltrate sensitive data (including personal data). The second way is AI itself becoming a cyber attacker without the involvement of a human. On the second point, one can look to OpenAI’s ‘Hugging Face’ incident whereby rouge AI agents escaped their testing environment to breach into a third-party platform hosting machine learning data and even went as far as creating secret channels where they communicated with each other. As such, whether through augmented attacks or attacks originating from AI itself, there is a clear and present danger of disruption and economic harm facing businesses from an unregulated AI landscape.

What could a ‘UK AI Act’ look like?

Future legislation for AI will most likely be structured around the risks discussed above. As such, expect tight controls over AI that is used either (i) to make decisions on individuals that have a significant impact on their livelihoods (ii) to process personal data (especially large-scale processing) (iii) to generate all types of multimedia content (iv) to operate in a semi-autonomous way (especially where it acts as a key component for critical national infrastructure).

Controls will probably be along the lines of matters such as risk mitigation insofar as conducting and documenting risk assessments on the deployment of AI in such contexts. Ensuring that human oversight is always a part of the process will also likely be a key focus so that responsibility can be allocated. Obligations on record-keeping, regular auditing, staff training, cybersecurity controls and so forth will likely feature. Duties would most likely apply to both developers and deployers of AI in their business operations.

Operationally, a UK AI Act will most likely mirror the setup of the UK GDPR insofar as a single regulatory body appointed for regulatory oversight, a set of principles focussed on AI safety that underpin the entire rationale of the Act, and powers of enforcement over businesses that do not follow the rules. We may also see an arsenal of consumer rights which individuals subject to AI-led services enjoy, including potentially a right to object to use of AI in their affairs and the ability to access documentation from organisations to confirm the same.

Structurally, it would be sensible to assume the UK would look to the EU AI Act for inspiration. The EU AI Act allocates different risks categories for certain use cases of AI with the higher risk use cases receiving the most stringent controls. It obliges developers of ‘general purpose’ AI models to comply with certain transparency obligations (hence why some users may see the ‘AI generated content’ tag for certain posts on social media). It also features an outright ban on the use of AI for certain ‘Orwellian’ use cases.

We may also see more robust controls in relation to cyber security, as the UK has the benefit of hindsight here. Such controls will probably mirror that already present in existing cyber security laws insofar as duties on organisations to implement and maintain measures in relation to sufficient security, incident handling, business continuity, auditing and testing, and compliance with international standards. For providers of essential services and national infrastructure who use AI in their operations, perhaps mandatory registration with an AI regulator. 

AI regulation – to be or not to be?

From rogue AI agents and excessive data processing all the way to harmful content and unfair decision-making, AI safety is no doubt hot on the agenda as the risks are self-evident. Given the recent comments by the UK Prime Minister and Chancellor, it does therefore seem the UK is heading in the direction of AI regulation in the near future which may follow the general framework laid down in this article.

However, there could be one obstacle in the way that has taken an extremely liberal approach, going as far as even renaming AI to ‘SI’ (or ‘super intelligence’), which may deter the UK from acting as the Atlantic bridge for AI regulation with the EU. That is the USA.  Despite this, though I am no geopolitical expert, this Trumpian influence may subside, as midterms indicate a possible swing back to the Democrats (who are arguably more pro-regulatory in general). This, together with recent comments by the Labour government of establishing closer relations with the EU and possibly even reversing Brexit, may mean more AI regulation (and regulation of the online world in general) into the 2030s and beyond.  

About the author

Nabiel Junjua (CEO & Solicitor) is a commercial and technology lawyer with a keen insight into regulations pertaining to the digital sphere, having previously published articles discussing the future of online regulation. You can learn more about Nabiel here and contact him for advice on your digital business activities.