The UK needs a cross-sector AI framework, to be able to seize the opportunity, embrace the transformative potential of AI and deliver greater efficiency and competitive advantage.
To do this, we need an AI framework, which balances:
- Necessary regulatory requirements, with
- Guiding standards drafted heavily by industry including technical experts, informing developers and deployers what a straightforward governance framework should include.
The UK currently has a fragmented landscape enforcing UKGDPR, the Equality Act, and financial services, consumer protection, employment, product liability, professional negligence and other regulation. Further, the EU AI Act applies where UK providers make their products or services available in the EU. These regulations overlap and there are gaps, including around legal rights, routes to redress and sector coverage, as the Ada Lovelace Institute highlights.
A single body, enforcing one clear set of high-level mandatory “Requirements”, would be easier for industry to navigate.
Requirements should reflect the Government’s AI core principles: safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress.
The Requirements need to be high-level, agile and not subject to anachronism. They should have regard to what is appropriate and proportionate for developers and deployers and be pragmatic, not weighting responsibility and risk on just one party in the supply chain. The reality is that much of industry is negotiating in a David and Goliath scenario with very powerful, mainly US providers.
Industry then needs a guiding ‘Code’ of practice: suggestions on what an entity’s governance framework might include, with general and sector-specific standards, drafted using input from UKAI industry and technology experts. This would help industry to meet the statutory and regulatory Requirements but not be mandatory. The Code would cover procurement, requiring transparency of suppliers and explainability of the AI, and deployment, suggesting the core components of governance set out below, with a central AI tools register which reflects compliance with those components.
Governance provides strategic guardrails, using technological and operational processes. Technological tools should, subject to budget, availability and where appropriate, be worked into workflows; Government might consider subsidies to assist. Governance requires:
- Responsibility, setting out who is responsible at human in command or human in the loop level for procurement, supervision, usage, outputs, agent behavioural patterns, escalations and incident management.
- Data Usage, being clear as to what data is accessed, stored or used by which agents for what tasks, with what data loss prevention (DLP), zero trust network access (ZTNA), data backup and other guardrails.
- Usage and Efficiency, with curated prompts, technological tools to audit, monitor and alert regarding model drift, incidents, inefficiency or failing validation and remediation.
- Testing, Monitoring and Reporting with unalterable logs, for efficiency tracking, tracing tools, model drift and abnormal usage, compliance and preventing security incidents.
- Security, with secure cryptographic practices and incident management.
Government, regulators and industry can be strategic, risk aware and not risk averse. Together we can unlock the potential of AI, supported by a clear governance framework for AI trust and competitive advantage.
Sphere Legal’s lawyers have extensive experience advising companies on AI. Please contact us if you would like further information.
This article does not present a complete or comprehensive statement of the law, nor does it constitute legal advice. It is intended only to highlight issues that may be of interest. Specialist legal advice should always be sought in any particular case.
