What Should AI Regulation Look Like – It’s Time To Start Answering The Big Questions

Careful consideration and lengthy public discourse are important when addressing novel issues. But equally important is recognising that there is no easy answer and the difficult questions cannot be put off forever. How to regulate AI is surely one of the most complex, and now urgent, questions of our generation.

Nearly three and a half years ago we considered the approach the Government of the time was proposing to regulation of AI and noted how it differed from traditional models of regulation in its lack of a specific regulator or legislative scheme. Flexibility, agility and encouraging innovation were the reasons given, but we queried whether it would mean uncertainty for businesses, inconsistency and issues falling between the gaps. Despite the debate gathering momentum, two years ago we acknowledged that there were still more questions than answers.

No-one could have predicted the pace at which AI development and usage would grow. But it was predictable that decisions about appropriate and effective regulation of this game-changing technology would be difficult, attract strong views on opposing sides and be overtaken by the technology itself.

It does appear however that calls for tighter regulation are gaining traction and urgency, including from within the industry in dramatic press headlines in recent weeks. With impeccable timing therefore, the Joint Committee on Human Rights recently published a report (the Report) examining both the risks that AI poses to human rights in the UK and proposed strategies to address them.

Against the backdrop of rapidly evolving AI models and a UK Artificial Superintelligence Security Bill being introduced into Parliament (the latest in a succession of private members’ bills seeking to curb or control AI development), the Report calls on the Government to take immediate action by introducing a dedicated AI Bill and establishing a new AI-specific regulator, neither of which, the Report emphasises, should compromise AI's potential to generate economic growth.

The Report

The Report addresses (i) key human rights issues raised by AI; (ii) deficiencies in the existing regulatory and policy landscape; and (iii) proposed strategies to address those deficiencies.

1. Key risks to human rights posed by AI

The Report outlines numerous key risks to human rights posed by AI, most of which have already been discussed in the AI policy sphere. These include:

• Equality and discrimination issues: Inherent human-generated and unrepresentative biases in the data on which AI models are trained are replicated in their outputs, resulting in potentially discriminatory practices. In addition, the certainty of tone of AI outputs in decision-making risks unfairness or abuse.
• Privacy and personal data violations: Training AI models on publicly available online sources, which may include personal data, creates privacy risks, including the potential re-identification of individuals from ostensibly anonymous data.
• Restricted rights to effective remedies against AI-related harm: Evidence suggests that individuals often do not know when AI has been used in decisions affecting them, or that such use can be challenged. Lack of transparency is a key concern. Even where individuals are aware, they may lack sufficient information to mount an effective challenge.
• Complexity and unpredictability of AI systems: Witnesses to the Committee spoke of the danger of large language models whose behaviour cannot be fully understood or predicted, and of instances demonstrating disturbing behaviour and/or misalignment with human values.
• Risk proliferation beyond human control: AI systems can rapidly propagate harms if left unchecked and can ignore or override instructions, as evidenced by the OpenAI security incident in July 2026. Absent adequate oversight mechanisms, powerful AI systems can be deployed at scale before risks are identified or addressed.

2. Limitations in the existing regulatory and policy landscape

Current legal protections focus on AI use at deployment, not development

Witnesses identified what was described as a major gap in current regulation: the absence of risk management obligations for actors further upstream in the AI supply chain building the technology itself. Deployers are said to currently bear primary responsibility for AI-related harms under existing protections that could apply to AI. The Report argues that existing laws fail to account for the complexity of the AI supply chain and do not direct obligations to the actors best placed to identify and mitigate risks at source.

Unclear liability for human rights-critical AI uses

The Report outlines what it considers deficiencies of current regulators or legal frameworks in addressing AI abuses of human rights, including:

• The Equality Act 2010, which protects against discriminatory practices, applies only to persons providing services to the public and does not extend to business-to-business relationships, meaning it may not reach upstream developers.
• The Human Rights Act 1998 applies only to public authorities and therefore does not cover the private sector, where nearly all AI development occurs.
• Upstream developers may also limit their exposure through contractual terms that exclude liability for harm, even where it can be attributed to the provider's actions or omissions.
• Strict liability for producers of defective products applies only to AI systems integrated into physical products and covers only limited categories of harm.

No cross-economy regulator with systematic powers

No cross-economy regulatory body exists with systematic powers to monitor and assess risks in AI systems. The AI Security Institute (AISI) has some responsibility for assessing risks arising at the development stage but has no regulatory authority and cannot demand access to foundation models either before or after their deployment. The Report suggests that a dedicated regulatory body could identify incident patterns indicating systemic problems in AI systems and coordinate appropriate cross-sector responses. It also notes the increasing prominence given to AI by the new Government and the apparent shift in focus from safety to narrower security concerns with the aim of encouraging innovation (an issue we previously discussed here).

Prohibitive cost and complexity of legal redress

The Report indicates that the opacity and technical complexity of AI systems, combined with the cost of bringing claims against private actors, limit individuals' ability to evidence harm, understand how it was caused and who is legally responsible, mount effective legal challenges and obtain redress.

Under-resourced and under-skilled regulators

Witnesses described how the overlapping roles of existing regulators confuse individuals whose rights may have been infringed by AI use, making it unclear where to lodge a complaint or commence a claim. The sectoral approach using existing regulators (discussed further here) has resulted in some areas being better regulated than others. Regulators themselves may lack sufficient funding, technical expertise and statutory powers to address AI-specific risks and undertake enforcement. Ofcom, for example, has indicated that misinformation or discriminatory content online would not fall within its remit unless it amounts to criminal activity, and there is a lack of clarity over areas such as AI chatbots.

3. Proposed regulatory and policy strategies

The Report contains a long list of recommendations, including the following:

Ratification of the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (the "Framework Convention”)

The Committee, the Law Society and Justice all call on the Government to consult publicly on a plan for ratifying the Framework Convention. It is the first legally binding international instrument targeting AI, though it has not yet entered into force. Signatories, including the UK, the USA and the EU, must "adopt or maintain measures" to (among other things) respect human dignity and individual autonomy, ensure adequate transparency and oversight, ensure accountability and responsibility, and uphold equality and non-discrimination, aiming to ensure that activities within the lifecycle of artificial intelligence systems are fully consistent with human rights.

AI-specific regulation applying across the AI lifecycle

The Report recommends that the Government introduce a principles-based AI Bill applying across the entire AI lifecycle, with more detailed guidance in codes of practice, which it considers would help to address the problem of regulatory pace, where AI develops more quickly than the regulation designed to govern it. Only necessary and proportionate obligations should be imposed on actors at all stages of the AI supply chain, with different risk levels classified, to ensure that risks are identified, evaluated and effectively addressed at the appropriate stage without placing unjustified burdens on businesses. The Bill should also prohibit some AI practices which are incompatible with human rights (e.g., subliminal techniques, emotional inference and inappropriate biometric use), following the example of the EU AI Act (Regulation (EU) 2024/1689) (see our blog here). Prior approval should be required for high-risk systems. The Report recommends imposing mandatory transparency requirements on all actors across the AI lifecycle, such as an obligation to state when AI systems are being used and information about the source of data used by the AI system.

The creation of an independent AI oversight body

The Report recommends that the Government establish a statutory, independent AI oversight body to serve as a single point of contact for concerns about AI risks or harms. Its proposed powers would include maintaining a public incident repository, publishing and enforcing mandatory codes of practice, conducting investigations, sanctioning non-compliant actors, and co-ordinating with existing sector-specific regulators.

Due diligence requirements

The Report recommends due diligence obligations on actors at every stage of the AI supply chain, differentiated based on the role of the relevant actor along the AI supply chain, and the nature and seriousness of the risk posed by the relevant AI model or system.

Safeguards around automated decision making with a ‘human in the loop’

The Report heard evidence suggesting the current protections around automated decision making in the data protection regime are insufficient. It recommends greater clarity. Simply having a human in the loop is not enough - any human moderator must be sufficiently informed and independent to reach an objective view, not improperly influenced by the automated decision. Sufficient information should be given to allow effective challenge to decisions.

Additional powers to the AI Security Institute

The Report recommends that the AISI be given statutory powers to review, evaluate and test new models (and new versions of existing models) before release. The Report further recommends that the AISI should have a duty to alert the oversight body where significant human rights risks are identified, enabling it to prevent or withdraw harmful systems from the market.

Comment

The Joint Committee on Human Rights pulls no punches in terms of its criticism of the current approach to regulation of AI and the significant changes it considers need to be made. It remains to be seen how the Government responds to the Report, but we note that the Prime Minister has suggested a renewed focus on AI safety as part of recent addresses.

If the key recommendations from the Report are taken forward, developers and deployers of AI in both the public and private sectors could face enhanced transparency obligations, including disclosure when AI is used in decision-making, due diligence requirements and obligations to ensure meaningful human oversight. AI specific legislation and a new oversight body would add further layers of regulatory complexity to businesses and organisations in all sectors, requiring careful co-ordination with their existing sectoral regulatory obligations.

Might such additional burdens stifle innovation and the potential for economic growth that AI brings? Very possibly. But many reading the news over the last few months may feel that the time has come to take that risk to ensure that any further development and deployment of AI is done within a clear, structured, effective set of rules and expectations. Public trust in AI, crucial if the technology is to be successful, is being damaged by the headlines. Without the reassurance that humans are not just in the loop, but actually in control, we risk losing the potential benefits AI may bring completely.