AI Regulation and Ethics: Managing Governance, Oversight and Risk
Governments and international organisations around the world are looking to establish their place as AI leaders. This necessitates a difficult balance between having a pro-innovation regulatory regime, whilst exercising sufficient oversight to address potential harms and public distrust. In the UK, the government has consistently proposed a pro-innovation framework, absent an AI-specific regulatory legal framework.
How is the UK government proposing to regulate AI – a pro innovation approach to AI governance?
The original government proposals on AI regulation under its White Paper from March 2023, updated in June 2023, followed OECD principles addressing:
- Safety, security and robustness;
- Transparency and explainability;
- Fairness, accountability and governance; and
- Contestability and redress.
These principles were originally addressed in a non-statutory basis and implemented by existing industry regulators such as the Information Commissioner’s Office (ICO) and the Intellectual Property Office (IPO). In January 2025, the current government issued its “AI Opportunities Action Plan”. The government has focused primarily on the practical opportunities from AI to push investment in the AI economy, both at an infrastructure level and also to address cross-economy AI adoption in both the public and private sectors. The government is proposing a pro-innovation framework which it perceives as a source of strength relative to other rules-based jurisdictions. The Plan anticipates well-designed and implemented regulation, alongside effective assurance tools, which are aimed to fuel fast, wide, and safe development and adoption of AI. The government aims to:
- continue to support and grow the AI Safety Institute (AISI) to maintain and expand its research on model evaluations, foundational safety and societal resilience research;
- reform the UK text and data mining regime so that it is at least as competitive as the EU;
- commit to funding regulators to scale up their AI capabilities;
- ensure all sponsor departments include a focus on enabling safe AI innovation in their strategic guidance to regulators;
- work with regulators to accelerate AI in priority sectors and implement pro-innovation initiatives like regulatory sandboxes, such as in the financial sector through the AI Supercharged Sandbox, supervised by the Financial Conduct Authority (FCA) in partnership with NVIDIA;
- require all regulators to publish annually how they have enabled innovation and growth driven by AI in their sector; and
- support the AI assurance ecosystem to increase trust and adoption.
Whilst the UK government has previously indicated that it intends to introduce appropriate legislation to place requirements on those working to develop the most powerful AI models, we have yet to see any draft legislation. The recent confirmation of the Government’s pro-innovation stance has led some to press for greater legislation. In addition, the growing influence of the EU AI Act as it is implemented cannot be ignored.
What is happening in the EU on AI regulation (EU AI Act)?
The EU is leading the way in developing AI specific laws that will apply across all sectors. The EU AI Act entered into force on 1 August 2024, ushering in a comprehensive risk-based framework for the regulation of what it terms AI Systems. Anyone doing business in the EU, or using AI affecting EU citizens, will need to keep an eye on its progress. Please see our update on the EU AI Act Key Provisions. Some of its provisions have already come into effect, such as the AI literacy obligation and prohibition on certain AI Systems. Most other provisions will be applicable by 2 August 2026.
What’s next for AI regulation and ethics and what do I need to be doing now?
At present, although specific UK AI laws are not yet in force, there is significant existing legislation and regulatory guidance that applies to the world of AI. Data protection, non-discrimination and consumer legislation, including product liability, are all highly relevant in the world of AI. Regulators have also issued specific AI guidance and the government has put forward a voluntary code of practice which sets out how organisations using AI can protect themselves from a range of cyber threats such as AI attacks and system failures. An immediate priority for businesses is to consider their own internal policies regarding use and development of AI to secure compliance with both current legal requirements and regulatory guidance.
