AI regulation

Horizon scanning

Are we seeing increased international
co-ordination in AI regulation?

What is happening?
A key theme of the Bletchley Declaration, made at the UK's AI Safety Summit in November 2023, was the importance of international collaboration in identifying AI safety risks.

In September 2024, countries including the US, the EU member states, and the UK, made further progress in this regard, by signing the Council of Europe's Convention on Artificial Intelligence (AI), the first legally binding treaty on AI. Also in September, the United Nations and the Organisation for Economic Cooperation and Development (OECD) announced a new enhanced collaboration on global AI governance.

Further, in November, the International Network of AI Safety Institutes met in San Francisco to consider how increased international alignment might be achieved on subjects such as AI standards, risk assessments, guidance and AI governance.

In the context of these examples of increased international collaboration, there are also noteworthy developments on the domestic front in many of the world's major economies. For an update on what is happening in the UK, see our AI Guide.

In the US, while many commentators are predicting a relaxation of regulation across the board once the incoming President enters the White House in January 2025, there are important incremental developments being made at state level.

In September 2024 alone, the following AI-related bills have been signed into law in California:

Bill	Requirements	Effective from
The California AI Transparency Act	Requires certain publicly accessible AI systems to protect consumers by implementing specific requirements related to the "watermarking" of AI generated content, and for their providers to make AI detection tools available	January 2026
The Generative AI: Training Data Transparency Act	Requires AI developers to publish summaries of training datasets used to train Generative AI systems	January 2026
The Contracts against Public Policy: Personal or Professional Services: Digital Replicas Act	Aims to protect actors and performers against digital replicas of their voice or visual likeness	January 2025
Generative Artificial Intelligence Accountability Act	Requires various government departments that utilise generative AI to implement risk analysis and transparency measures	January 2025

While there is currently no general or overarching AI law in China, China has been seen as a regulatory frontrunner with its Interim Measures for the Management of Generative AI Services having been effective since August 2023. These measures place strong emphasis on the transparency, quality and legitimacy of both training data and the generated content. Generative AI service providers are required to respect intellectual property rights and only use training data and foundational models that have lawful sources.

More recently in China, the National Cybersecurity Standardisation Technical Committee released version 1.0 of its AI Safety Governance Framework on 9 September 2024.

The Framework's principles include:

prioritisation of AI innovation
prevention and mitigation of AI safety risks
effective safeguarding of national sovereignty, security and development interests
protection of the legitimate rights and interests of citizens.

The Framework adopts a risk-based approach, similar to what has been seen in other jurisdictions (most notably with the EU's AI Act). In particular, the Framework identifies a broad range of different risks, including those related to/stemming from: (i) models and algorithms (eg algorithmic bias); (ii) data collection and management; and (iii) cybersecurity.

Why does it matter?
In our article in the January edition of Regulatory Radar we considered several emerging themes from the various principles, guidelines and draft legislation that had been published at that time. These included: a particular focus on foundation models; the emphasis on risk-based approaches; and efforts to develop authentication and provenance mechanisms.

Almost one year on, many of these themes continue to play a key role in shaping AI regulation. While risk-based approaches still dominate, we are also seeing specific legislation aimed at allowing users and consumers to readily identify whether content is AI generated and its provenance.

There is now also a broadening consensus around key concepts such as AI and generative models. This in itself may be regarded as progress towards a more unified international approach.

What action should you take?

Continue to monitor the developments in AI regulation, both on the international and domestic front.
Consider whether current (and expected future) practices comply with principles such as transparency, explainability, and the mitigation of algorithmic bias.
Ensure that existing legal requirements, for example in respect of data protection and equality laws, are being complied with, relating to the development and deployment of AI systems. In this respect it is important to look out for updated guidance on existing laws. For example, regulators such as the UK ICO have clarified various requirements including how to apply the concepts of data protection law when developing or deploying AI, including generative AI.

Key dates
January 2025 onwards - when the new US administration will confirm its approach to AI regulation.

Caroline Tuck
Partner
+44 7355 674502
caroline.tuck@rpclegal.com

Ricky Cella
Senior Associate
+44 7895 301115
ricky.cella@rpclegal.com

Joshy Thomas
Knowledge Lawyer
+44 7927 578065
joshy.thomas@rpclegal.com

Horizon scanning

The UK AI industry: going “pro-reg”

What is happening?
The King's Speech in July 2024 stated that the government will "seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models." Similarly, Keir Starmer emphasised that his new government would "strengthen safety frameworks" in order to "harness the power of artificial intelligence" indicating the Labour government's appeal for regulating the UK's AI industry.

Since then, a new Private Member's Bill was introduced to the House of Lords; the Public Authority Algorithmic and Automated Decision-Making Systems Bill, focused on regulating the use of AI in the public sector. If passed, the Bill will require measures to be taken before public authorities use AI systems, including the publication of an algorithmic impact assessment, including a mandatory bias assessment to ensure compliance with the Equality Act and Human Rights Act.

The Bill also promotes transparency, in line with the EU's approach, by requiring authorities to publish a record of the automated decision-making processes of the AI system being deployed.

In contrast, regulation in the private sector has come to a standstill with the previous Artificial Intelligence Bill (introduced in November 2023) being dropped when parliament was dissolved at the end of May 2024 ahead of the general election that heralded the new Labour government. That bill aimed to implement a set of regulatory principles to be followed by all businesses that develop, deploy, or use AI with a particular focus on advanced AI models, ie generative AI tools like ChatGPT.

Currently, the government is further seeking to formalise the previous voluntary agreements between the former Conservative government and "Big Tech" companies including Amazon, Microsoft, Meta, and Google DeepMind.

In May 2024, those tech companies signed up to a voluntary commitment that AI models will not be deployed or developed if severe risk could not be mitigated. As these are currently "voluntary", tech companies can decide not to adhere to their commitments if commercially beneficial to do so. If the government is successful, these agreements will become legally binding.

The CMA's approach to AI Foundation Models
The CMA conducted a review in 2023 of the UK's AI Foundation Model market. AI Foundation Models (FMs) are large machine learning models, which are trained on vast datasets to use for chatbots, search engines, code writing assistants, image generators, healthcare research, etc. The review focused on the fast development of the FM market, which saw a

significant increase in demand from both consumers (ie 31% of UK adults use generative AI for personal, educational, or professional purposes) and businesses (46% of large businesses use AI to improve operations and delivery).

To meet this rising demand, over 100 more FMs have been released since September 2023 – with large amounts of data from text, audio, image and video being input, and the FM being integrated into different digital products. The review highlighted the CMA's "strongest concerns" that competitive development will be stifled, leaving only the few largest tech companies able to develop FMs. This is because of various factors, including the limited availability of AI accelerator chips, access to computing resources via the cloud, access to data sources, and technical expertise (ie the "war for talent").

This bottleneck to resources was identified as a risk to fair, open and effective competition. The few tech companies operating in this space will control access to "critical inputs" to develop FMs. Further, they could use their already-strong positions in the market to distort choice of FM services and establish partnerships within themselves to increase market power throughout the value chain. The CMA has subsequently published an updated set of principles for FM development firms to address this issue, emphasising the importance of monitoring market integration through acquisitions and partnerships.

Why does it matter?
The UK's AI regulation landscape is changing; interest is building on whether a Bill will be introduced for regulating AI systems in the private sector, following positive indications for a more "pro-regulatory" approach by the Labour government, and particularly since the introduction of an AI Bill for the public sector.

The CMA's report on the AI FM market also signals the proactive approach that the CMA's Digital Markets Unit will take on regulating the UK AI market, relying on the new enforcement powers under the Digital Markets, Competition and Consumer Act (DMCCA). This includes issuing specific conduct requirements and interventions on conduct that is potentially adverse to competition.

Another point of interest will be how the UK's regulatory regime will work alongside the EU's AI Act, which analyses the "risk to society" of specific AI technology and places stricter regulations where there is perceived to be greater risk of harm.

What action should you take?
Organisations developing or using AI tools should closely follow any new developments such as the introduction of an AI Bill, and the potential effect of legally binding commitments to their AI tools and business. Large technology companies in the FM development space should update their practices to align with the CMA's principles, so that the appropriate competition and consumer standards are met.

Oliver Bray
Partner
+44 7981 232447
oliver.bray@rpclegal.com

Hettie Homewood
Senior Associate
+44 7759 524371
hettie.homewood@rpclegal.com

Lewis Manning
Associate
+44 7821 636371
lewis.manning@rpclegal.com