UK AI Law and Governance

The UK Pro-Innovation Approach

The United Kingdom has adopted a distinctive pro-innovation stance on artificial intelligence regulation, emphasising light-touch, principles-based governance over prescriptive statutory rules. The AI Safety Summit hosted in November 2023 at Bletchley Park marked a pivotal moment in international AI governance, producing the Bletchley Declaration signed by 28 nations, which acknowledged the risks of frontier AI and committed to international cooperation on AI safety. The summit cemented the UK’s aspiration to serve as a global hub for AI safety research and standard-setting.

AI Safety Institute

The AI Safety Institute (AISI), established in November 2023, conducts state-level safety evaluations of advanced AI systems. It produced the first pre-deployment safety tests of frontier models and publishes research on systemic AI risks. The Institute has established international partnerships, including a formal arrangement with the US AI Safety Institute, to align testing methodologies and share findings. Its remit includes both national security risks and broader societal harms from AI systems.

The AI Regulation White Paper and Cross-Sectoral Principles

The Government’s AI Regulation White Paper (March 2023, updated February 2024) sets out a framework based on five cross-sectoral principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Rather than creating a new AI regulator, the White Paper assigns responsibility to existing sectoral regulators—including the Information Commissioner’s Office, the Financial Conduct Authority, the Competition and Markets Authority, and Ofcom—to interpret and apply the principles within their domains. Regulators have been asked to publish their AI strategies, and a central monitoring function evaluates the framework’s effectiveness.

Online Safety Act and AI

The Online Safety Act 2023 imposes duties on user-to-user and search services to protect users from illegal content and content harmful to children. The Act has significant implications for AI, particularly in relation to algorithmic recommender systems, content moderation decisions, and the responsibilities of platforms deploying generative AI. Ofcom, the communications regulator, has issued enforcement guidance on how the Act applies to AI-generated content and algorithmic amplification of harmful material.

Copyright and AI: Text and Data Mining

UK copyright law provides a limited exception for text and data mining for non-commercial research under section 29A of the Copyright, Designs and Patents Act 1988. A broader TDM exception proposed by the government would permit mining for any purpose but has been delayed amid strong opposition from creative industries. The Intellectual Property Office has published guidance on the interaction between copyright and AI, including a statement of principles on training AI on copyrighted works. High-profile disputes between rights holders and AI developers over unauthorised use of copyrighted material for training remain unresolved in UK courts.

Equality Law and AI Bias

The Equality Act 2010 prohibits discrimination in employment, the provision of services, and other areas. The Equality and Human Rights Commission has clarified that AI systems deployed in these contexts must not produce outcomes that discriminate on protected characteristics. An employer using an AI screening tool that systematically disadvantages candidates of a particular race or sex will be liable under the Act, regardless of whether the discrimination was intended. The EHRC has called for mandatory equality impact assessments for high-risk AI systems.

ICO AI Guidance

The Information Commissioner’s Office has been a leading voice on AI and data protection. Its guidance on AI and data protection, including the AI Auditing Framework and guidance on explainability and AI, requires controllers to conduct data protection impact assessments, ensure lawful bases for processing, and provide meaningful information about AI decision-making. The ICO has enforcement powers, including substantial fines, and has taken action against organisations deploying AI without adequate transparency or fairness safeguards.

Tort Law and AI Liability

UK courts have begun to address how existing tort law applies to AI-caused harm. The Law Commission recommended against creating a special AI liability regime, concluding that existing tort principles—including negligence and vicarious liability—are sufficiently flexible, though it acknowledged challenges in establishing duty of care and causation where AI systems act unpredictably. Product liability under the Consumer Protection Act 1987 may also apply where defective AI causes harm, though questions remain about how to treat AI post-deployment learning as a product defect.

Outlook

The UK is expected to introduce a statutory AI bill by 2026 to codify aspects of its regulatory approach, though the broad contours of the pro-innovation, regulator-led framework are likely to persist. International alignment, particularly with the EU and US, remains an important policy objective.