On 29 March 2023, the UK Government published a White Paper entitled “A pro-innovation approach to AI regulation” (“White Paper”). The White Paper elaborates on the approach to AI set out by the Government in its 2022 AI Governance and Regulation Policy Statement (“Policy Statement” – covered in our blog post here). This announcement comes following the Government’s commitments, in the Spring Budget 2023, to build an expert taskforce to develop the UK’s capabilities in AI foundation models and produce guidance on the relationship between intellectual property law and generative AI (for more details of these initiatives, see here).

In its White Paper, the UK Government confirms that, unlike the EU, it does not plan to adopt new legislation to regulate AI, nor will it create a new regulator for AI (for further details on the EU’s proposed AI regulation see our blog posts here and here). Instead, the UK would require existing regulators, including the UK Information Commissioner’s Office (“ICO”), to take responsibility for the establishment, promotion, and oversight of responsible AI in their respective sectors. Regulators’ activities would be reinforced by the establishment of new support and oversight functions within central Government. This approach is already beginning to play out in certain regulated areas in the UK. For example, in October 2022, the Bank of England and Financial Conduct Authority (“FCA”) jointly released a Discussion Paper on Artificial Intelligence and Machine Learning considering how AI in financial services should be regulated and, in March 2023, the ICO updated its Guidance on AI and Data Protection.  

The following is a summary of the key elements of the White Paper and the ICO’s response to the Government’s proposals.

Scope – Defining AI

The White Paper confirms the Government’s decision (initially proposed in its Policy Statement) to define AI by reference to two functional characteristics that call for a specific regulatory response:

• Adaptive systems that operate by inferring patterns in data which are often not easily discernible or envisioned by their human programmers. The ‘adaptivity’ of AI can make it difficult to explain the intent or logic of the system’s outcomes.
• Autonomous systems that can automate complex tasks and make decisions without the express intent or ongoing control of a human. The ‘autonomy’ of AI can make it difficult to assign responsibility for outcomes.

The UK’s regulatory framework will be focused on addressing the challenges created by these unique characteristics of AI. This approach stands in contrast to the EU’s proposed AI Act which adopts a general definition of AI (for further details see our blog post here).

Cross-sectoral Principles

The White Paper outlines five core principles regulators will be expected to consider to guide the safe and innovative use of AI in their industries:

• Safety, Security and Robustness – AI systems should function in a robust, secure and safe way;
• Transparency and Explainability – organizations developing and deploying AI should be able to communicate the purpose of AI systems, how they work, when they are to be used, and their decision-making processes;
• Fairness – AI systems should not discriminate against individuals or undermine their rights, nor should they create unfair commercial outcomes;
• Accountability and governance – appropriate measures should be taken to ensure effective oversight of AI systems and clarity as to those responsible for their output; and
• Contestability and redress – there must be clear routes to dispute harmful outcomes or decisions generated by AI.

These cross-sectoral principles are consistent with many of the EU AI Act’s objectives and align with international AI principles including the OECD AI Principles (2019), the Council of Europe’s 2021 paper on a legal framework for artificial intelligence (for more information, see here), and the Blueprint for an AI Bill of Rights proposed by the White House’s Office of Science and Technology Policy in 2022 (for further details, see here).

Over the next 12 months, regulators will be expected to issue guidance for businesses on how the principles apply in practice and cooperate with each other by issuing joint guidance in cases where their remits overlap. The Government may later impose a statutory duty on regulators to have regard to the cross-sectoral principles in the performance of their tasks.

Central Coordination and Oversight

The White Paper recognizes that there are risks with a de-centralized regulatory framework, including inconsistent enforcement or guidance across regulators. To address this, the White Paper proposes to create new functions in central Government to encourage regulatory consistency and support regulators in implementing the cross-sectoral principles. The support functions include:

• assessment of the effectiveness of the de-centralized regulatory framework, including a commitment to remain responsive and adapt the framework if necessary;
• central monitoring of AI risks arising in the UK;
• public education and awareness-raising around AI; and
• testbeds and sandbox initiatives for the development of new AI-based technologies.

The White Paper also recognizes the likely importance of technical standards as a way of providing consistent, cross-sectoral assurance that AI has been developed responsibly and safely. To this end, the Government will continue to invest in the AI Standards Hub, formed in 2022, whose role is to lead the UK’s contribution to the development of international standards for the development of AI systems.

ICO’s Response to the White Paper

On 11 April 2023, the ICO issued its response to the Government’s consultation on the White Paper. The ICO recognises that, given that a substantial portion of AI systems are ‘powered’ by personal data, the development and use of AI where processing personal data takes place will fall under the ICO’s remit.

The ICO’s response welcomes the opportunity to work with Government to ensure that the AI White Paper’s principles are interpreted in a way that is compatible with existing data protection principles. It requests clarification of how the White Paper’s proposals interact with Article 22 of the UK GDPR. In particular, whereas the White Paper sets out that, where automated decisions have a legal or significant effect on a person, regulators must consider the suitability of requiring AI system operators to provide an appropriate justification for that decision to affected parties, the ICO response suggests that, if Article 22 UK GDPR applies, this justification is required, rather than simply a consideration. The ICO response therefore requests clarification on this point, to ensure that this does not create confusion and contradictory standards.

Next Steps

The Government is inviting AI sector participants to provide feedback on the White Paper until 21 June 2023 (for details of how to respond to the public consultation, see here). Following this, the Government will respond to the consultation and publish an AI Regulation Roadmap. Regulators are expected to issue guidance on how to apply the White Paper’s principles within the next year.

—-

Covington regularly advises the world’s top technology companies on their most challenging regulatory, compliance, and public policy issues in the UK, EU and other major markets. We are monitoring developments in AI policy and regulation very closely and will be updating this site regularly – please watch this space for further updates.