Tracking the EU and UK’s approaches to AI regulation

On 21 April 2021, the European Commission introduced its proposal for a regulation laying down harmonised rules on AI throughout the European Union (the “AI Act”). Its status as a regulation means that the AI Act applies directly in each of the 27 EU member state countries.  It came into force on 1 August 2024, with its obligations coming into force in phases, with key compliance timelines recently postponed by the EU’s 2025 Digital Omnibus.

The AI Act applies to:

• providers placing on the market or putting into service AI systems in the EU, irrespective of where those providers are established;
• users of AI systems located in the EU; and
• providers and users of AI systems that are located in a third country, where the output of the system is used in the EU.

The AI Act therefore has a broad extra-territorial reach and will need to be considered by providers and users of AI systems globally.

A “risk based” approach to regulating AI

The AI Act takes a “risk based” approach, classifying AI systems according to separate tiers:

• prohibited;
• high-risk;
• limited risk;
• all other systems (in effect, minimal risk).

The rules applicable to AI systems will vary depending on whether they fall into specific tiers or not.

1. Prohibited (including AI systems using techniques to manipulate individuals and cause harm):

The European Commission describes these types of AI systems as posing “a clear threat to the safety, livelihoods and rights of people”. Article 5 imposes bans on systems that use subliminal or purposefully manipulative or deceptive techniques to materially distort users’ behaviour in harmful ways or is likely to cause significant harm; exploit the vulnerabilities of specific groups; allow for “social scoring” by governments; create or expand facial recognition databases through untargeted scraping of facial images from the internet; infer emotions of people in the workplace or in educational institutions, or use real-time remote biometric identification in public spaces for law enforcement purposes (subject to narrowly defined exceptions).

2. High risk (i.e. systems subject to additional safeguards, including human oversight):

These systems include those used for:

• biometric identification and classification of natural persons;
• management or operation of critical infrastructure;
• education and vocational training,
• employment and worker management; and
• access to and enjoyment of essential public and private services (including creditworthiness and credit scoring).

These systems will be subject to strict additional obligations, such as the need to undergo a “conformity assessment”, a prior registration regime, adequate risk management and mitigation systems and ensuring appropriate human oversight. Requirements differ depending on whether the high risk AI is embedded as part of a wider system (e.g. in a medical device) or is a free standing tool.

A system will not be high risk where it does not pose a “significant risk” to the health, safety or fundamental rights of persons, including by not materially influencing the outcome of decision making (different rules apply for safety components).

3. Limited risk:

Certain AI systems that are not “high risk” but interact with and/or could manipulate human behaviour, such as chat bots or emotion recognition systems, will be subject to specific transparency obligations, e.g. users must be made aware that they are interacting with a machine.

4. All other AI systems (low risk):

These are systems posing a minimal risk to users’ rights or safety, such as AI enabled spam filters.

5. Foundation models:

These models are also subject to regulation under the AI Act, if a model poses a ‘systemic risk’. This will be the case where: (i) it has high impact capabilities (on the basis of an evaluation); or (ii) the European Commission issues a decision that a particular model has these capabilities, with these being capabilities that ‘match or exceed’ the capabilities recorded in the most advanced general-purpose AI models. Systemic risk is assessed by reference to the impact the model has on the EU market, given its reach, or due to actual or reasonably foreseeable negative effects on public health, safety, public security, fundamental rights, or the society as a whole, that can be propagated at scale across the value chain. 

High impact capabilities will be assumed when the cumulative amount of computation used for its training measured in floating point operations is greater than 25.  

Implementation and key developments timelines

 

 

EU AI Act in force on 1 August 2024, with key obligations originally due to come into force after 24 months in August 2026

• From February 2025, providers and deployers of AI systems have been required to ensure staff have a sufficient level of AI literacy (although the full extent of this obligation is likely to be diluted by the Digital Omnibus)
• February 2025: Publication of Guidelines on prohibited AI practices & ‘AI system’ definition
• June 2026: Publication of Code of Practice on marking and labelling of AI-generated content
• 2 December 2026: Requirement for providers to implement transparency solutions for AI-generated content
• 2 August 2027: Requirement for establishment of AI regulatory sandboxes by national Member State authorities
• 2 December 2027: Obligations for stand-alone high risk AI systems come into force (following issue of harmonized standards, common specifications, and Commission guidelines which are expected in December 2026)
• 2 August 2028: Obligations for high risk AI systems embedded into products to come into force

What are the possible fines?

Fines are proposed on a sliding scale, with the most serious contraventions (including breaches of obligations applicable to prohibited and high-risk systems) carrying fines of up to:

• EUR 30 million; or
• 6% of total worldwide annual turnover for the preceding financial year (whichever is higher).

Initially proposed by the European Commission on 28 September 2022, the draft AI liability directive (the “AI Liability Directive”) aimed to modernise the EU liability framework by introducing rules specific to damages caused by AI systems, and was seen as complementary to the EU’s draft AI regulation (the “AI Act”). It was withdrawn from the Commission’s work programme in 2025.  The EU has instead targeted the harms posed by digital technologies through its Product Liability Directive (EU) 2024/2853 which expands the EU’s product safety rules to software driven products, digital manufacturing files, and integrated digital elements, whilst also broadening the chain of operators who are responsible for products placed on the EU market.  It also broadens the type of harms for which an operator may be liable to cover destruction or corruption of data, as well as psychological harm and has removed the previous EUR 500 threshold for property damage. Online platforms may also attract liability where a platform presents the product in a way that may lead an average consumer to believe that the product is supplied by the platform itself or by a trader acting under the platform’s authority or control.  This directive is required to be implemented into national EU member state law by 9 December 2026.

To date, the UK Government’s approach to AI is principles-led, with the Department for Science, Innovation and Technology (“DSIT”) publishing a white paper  (the “AI White Paper”) on 29 March 2023.  This defined a set of cross-sectoral advisory principles which should govern AI development, deployment and use in the UK, whilst it assesses development of the AI landscape. With this paper setting the strategic direction, UK regulators were then required to consider the impact of AI on a sector by sector basis and to set out their strategic approach to AI regulation. The paper and consultation response represent a light-touch approach consistent with the UK’s National AI Strategy published in September 2022.  Legislation is not currently being proposed, in stark contrast with the advent of the EU’s AI reforms which have been phased in since February 2025 (although with compliance deadlines being adjusted in the EU’s Digital Omnibus to reflect awareness that businesses want to see more guidance from the EU regulators before the substantive rules come into force).

The AI White Paper proposes a flexible definition of AI systems, based on their inherent adaptability and autonomy characteristics. It also suggests a principles-based framework for existing regulators to interpret and apply to AI within their remits.  Regulators have issued guidance on how the principles interact with existing legislation, in order to support compliance in their sectors. This reflects the UK Government’s view that AI is a general purpose technology, likely to cut across numerous regulatory remits (with  cooperation between regulators is likely to be fundamental).  Financial, data protection and competition regulators have launched the Digital Regulation Co-operation Forum’s AI and Digital hub (which offers an informal multi-agency advice service and access to the CMA, FCA, ICO and Ofcom). 

The five cross-sectoral principles to be applied by regulators are:

1. safety, security and robustness;
2. appropriate transparency and explainability;
3. fairness;
4. accountability and governance; and
5. contestability and redress.

The principles have not yet been placed on a statutory footing.  Legislation may be passed in the future to impose a duty on regulators to have due regard to the principles, if it is found that they are not being applied appropriately. AI assurance techniques and technical standards are also intended to play a major role.  DSIT has also indicated that the challenges posed by AI technologies will ultimately require legislation to be passed in the UK to address potential AI-related harms and ensure public safety (once the risks of AI are more fully understood). It is clear the government is particularly concerned about the challenges posed by highly capable general-purpose AI systems and already envisages the need for further targeted binding requirements on the small number of organisations developing these types of system, to ensure accountability for making these technologies sufficiently safe.  

DSIT has published an introductory guide to AI assurance, aiming to assist organisations and regulators in understanding and implementing effective governance around AI systems. It has also published initial voluntary guidance to support regulators’ implementation of the UK’s AI regulatory principles.  The UK’s AI Security Institute has set out its approach to the conduct of AI safety evaluations for advanced AI systems (which outlines techniques such as automated capability assessments and red-teaming to assess potential risks associated with AI systems).  Its focus is on areas like AI misuse, societal impacts, and security risks posed by autonomous systems. The selection of AI systems for evaluation will be based on their potential for harmful capabilities, with support from companies developing advanced AI.

The AI White Paper does not seek to allocate liability for harm caused by AI. This issue will be left to existing legal frameworks and monitored further; however, future legislative intervention has not been ruled out. A recent influential statement from the UK Jurisdiction Taskforce on liability for AI harms indicates that English law in it's current form can already address many of the harms posed by AI, and sets out the key legal basis on which liability for harm caused by AI could be conceptalised, in the absence of specific legislation governing the risks.

In tandem, the ICO has consulted on its updated guidance on automated decision-making (ADM), including profiling. The update follows the introduction of the Data (Use and Access) Act 2025 and focuses on provisions specific to this area. It is aimed at data protection officers, compliance professionals and technical leads. The ICO explains that the new guidance provides more detailed information on automated decision-making as defined in Articles 22A–22D of the UK General Data Protection Regulation (UK GDPR), where decisions are based solely on automated processing and have legal or similarly significant effects on individuals. It is intended to support organisations in understanding and meeting their obligations in this context, including when profiling is involved, and will inform the development of a statutory code of practice on artificial intelligence and automated decision-making.

And from an intellectual property rights perspective, the government has also had to consider if it should legislate to permit creators of large language models to train their models on copyright works.  Following consultation, the government has elected not to broaden the current text and data mining exception to permit this form of training, in light of concerns raised by the UK creative industry. It will instead pause to allow industry-led licensing models to evolve and engage further with stakeholders to explore best practices before considering any legislative changes, as well as consulting on options to tackle the harm caused by deepfakes, including the possibility of a new digital replica or personality right.  It will also be establishing a taskforce to consider the labelling of AI-generated content.