UK proposes “light touch” approach for regulating artificial intelligence

Like an elephant, the essence of AI is difficult to put into words, but you know it when you see it.* This poses a challenge for policymakers looking to use regulation to support the safe development of artificial intelligence. In a new policy paper, the UK Government chooses not to pin down what AI means and emphasises the flexibility of its approach. But the EU’s first-mover proposal for an AI-specific Act may end up setting the global standard.

Pro-innovation regulation

In its policy paper, the Department of Digital, Culture, Media and Sport has put forward a “pro-innovation” vision for the future regulation of artificial intelligence. The paper sets out the building blocks of a cross-sectoral regulatory framework.

As the paper points out, the UK does not have laws written explicitly to regulate AI. This means that businesses rolling out AI systems must make sure they fit within existing legal and regulatory regimes. For example, the Information Commissioner’s Office (ICO) has taken action against Clearview for its facial recognition tech and has promised to investigate concerns over the use of algorithms to sift recruitment applications. See also our note on how AI in financial services is regulated in the UK.

The lack of AI-specific regulation may, however, lead to confusion and hinder innovation. Respondents to a 2019 survey of financial institutions suggested that additional guidance on how AI fits within existing rules could encourage more firms to adopt AI.

To steer consistency across different industries, the DCMS intends to set cross-sectoral principles tailored to AI and ask regulators to contextualise these for the sectors they oversee.

Principles and guidance, not rules

The DCMS has produced six guiding principles for regulators to consider when overseeing the use of AI in their sector. These are:

1. Ensure that AI is used safely
2. Ensure that AI is technically secure and functions as designed
3. Make sure that AI is appropriately transparent and explainable
4. Embed considerations of fairness into AI
5. Define legal persons’ responsibility for AI governance
6. Clarify routes to redress or contestability

DCMS does not expect these principles necessarily to translate into new obligations. Instead, it plans to encourage regulators to consider lighter touch options in the first instance, such as guidance or voluntary measures. Regulators are told to adopt a proportionate and risk-based approach focusing on high-risk concerns.

This flexible approach is likely to be applauded but by choosing not to regulate in this area it could be that the EU’s stricter rules become the de facto standard for AI regulation.

EU divergence

Unlike the EU, the UK is not preparing to introduce AI-specific legislation. Instead, the DCMS suggests that responsibility should be delegated to regulators for designing and implementing proportionate regulatory responses.

The European Commission’s bold proposal for an AI Act aims to regulate AI systems across the EU according to the level of risk they present. The draft legislation seeks to ban AI systems that present unacceptable risks, impose strict requirements on those considered to be high risk (such as systems used to evaluate credit risk or provide credit scores), and potentially subject lower risk systems to transparency requirements.

The EU’s regime could bring about sweeping changes, requiring businesses to assess the riskiness of their AI systems and comply with the relevant obligations. Failing to meet the requirements for high-risk AI systems could lead to fines of up to EUR 30 million or 6% of global turnover, whichever is greater. Read more in our blogpost on what the EU is doing to foster human-centric AI.

Another distinction between the EU and UK is the approach to defining AI. Whereas the EU AI Act includes a very broad definition, the DCMS policy paper chooses not to define AI. Instead, it notes core characteristics of AI technology which existing regulation may not be fully suited to address.

These characteristics are:

• Adaptiveness ie the logic behind an output can be hard to explain
• Autonomy ie the ability to make decisions without express intent or human involvement

It is the combination of these characteristics that demand a bespoke regulatory response for AI. By focusing on these core characteristics, the DCMS argues that a detailed universally applicable definition of AI is not needed.

The DCMS acknowledges that its proposals diverge from the vision of AI regulation set out by the EU but argues that the EU’s approach of setting a “relatively fixed definition” in legislation would not be right for the UK because it does not capture the full application of AI and its regulatory implications.