Sixty years plus in the making Artificial intelligence (AI) is now centre stage in our present and future. It influences who gets a job, who receives a loan, how patients are treated, what children learn, how organisations make decisions, how we work, and in some cases play and so much more.
So, trust, governance and regulation in and of AI is a potent question. Whilst President Trump says that he is smart enough to protect the world against AI killing everyone in the world others call for a more hands on approach to deal with existential and everyday risks.
In January, I gave oral and written evidence to Parliament’s Joint Committee on Human Rights. I argued that the United Kingdom needed mandatory transparency, clearer accountability for foundation model developers, better public oversight, AI literacy and a legal framework that puts people first.
The committee’s final report, Human Rights and the Regulation of AI, reaches many of the same conclusions. It calls for a dedicated AI Bill, a statutory AI oversight body, mandatory transparency, obligations across the AI supply chain and meaningful remedies for people harmed by AI. Parliament should now implement those proposals.
Existing UK AI regulation is not enough
The UK does not begin with an empty statute book. The Human Rights Act, Equality Act, data protection legislation and sector-specific rules already provide some protections. But they were not designed for systems that operate at extraordinary speed and scale, produce unpredictable results and can be embedded in thousands of downstream products.
The committee describes the existing legal landscape as fragmented, difficult to navigate and unable to address preventable human rights risks comprehensively. It also concludes that current regulators cannot deal effectively with AI-related harms using their present powers and resources.
This matters because AI can affect human dignity, autonomy, privacy, equality and the right to an effective remedy. If an AI system helps decide whether you receive medical treatment, an interview, a mortgage or a public benefit, you must be able to discover that it was used, understand its role and challenge the result.
At present, that cannot be assumed.
Transparency must be the starting point
In my evidence, I made a simple recommendation: people should be told when AI is being used.
If an employer uses AI to review a job application, the applicant should know. If a healthcare provider uses it to create clinical notes or recommend treatment, the patient should know. If a public authority uses it to influence a decision about an individual, that person should know what the system did and how it affected the outcome.
Without that knowledge, there can be no meaningful right to challenge the decision. A theoretical right to a remedy is of little value when the person does not know that AI played a part in causing the harm.
The committee agreed. Its report recommends mandatory transparency requirements across the AI lifecycle. Where AI may have a significant impact on individuals, groups or communities, organisations should be required to disclose its use, explain its purpose comprehensibly and provide information about the sources of data on which it relies.
This should become law. It should not be left to voluntary good practice or buried in terms and conditions that few people read.
Responsibility must sit with those able to prevent harm
Much of today’s legal and commercial risk is pushed down the AI supply chain.
A large company may develop a foundation model and make it available to thousands of other businesses. Those businesses then use the model in recruitment, healthcare, finance, education, and more. Contracts may attempt to leave the downstream organisation responsible when something goes wrong, even though it did not create the underlying model, select its training data or determine its fundamental limitations.
That is not a defensible approach to AI accountability.
In my evidence, I argued that foundation model developers should owe a duty of care where their systems could cause harm. Parliament should not allow the organisations with the greatest knowledge, resources and technical control to pass responsibility to smaller deployers or, ultimately, to the people affected.
The committee makes the same essential point. Its report says obligations should apply to actors at every stage of the AI lifecycle and supply chain, differentiated according to their role and the seriousness of the risk. Responsibility should be placed where risks can best be identified, prevented and controlled.
This is both fair and practical. We would not allow a car manufacturer to transfer all responsibility for defective brakes to the dealership that sold the car. We should not take that approach to powerful AI systems.
The UK needs a dedicated AI Bill
The committee recommends that the Government introduce the AI Bill promised in the 2024 King’s Speech. That Bill should establish a proportionate, risk-based system of AI regulation.
Low-risk uses should face lighter obligations. Higher-risk systems should be subject to stronger testing, due diligence and oversight. Uses that are fundamentally incompatible with human rights should be prohibited. High-risk systems should require approval before deployment.
This is not an argument for regulating every spam filter or calendar tool as if it were a medical diagnostic system. AI is not one single product, and sensible regulation must recognise the enormous differences between applications.
But where AI can materially affect somebody’s liberty, livelihood, health, education etc., asking organisations to identify risks before deployment is not excessive. It is the minimum we should expect.
The committee also recommends due diligence obligations throughout the supply chain. These would require those designing, developing and deploying high-risk AI to assess potential human rights consequences and take appropriate steps to prevent unacceptable risks.
An AI regulator and ombudsman are now essential
I recommended a properly funded and staffed AI regulatory institution, coupled with an ombudsman or similar route through which people could seek help when harmed.
The current system expects an individual to identify that AI was involved, determine which law might apply, find the correct regulator and, in many cases, contemplate expensive litigation. That is not effective protection, especially when the organisation on the other side may be one of the world’s largest technology companies.
The committee proposed an independent statutory AI oversight body. It would serve as a point of contact for concerns, coordinate existing regulators, monitor incidents, identify patterns of harm and enforce the new AI Bill.
Importantly, the proposed body would be able to test high-risk systems, stop systems from being launched, order their withdrawal where unacceptable risks are identified, investigate alleged breaches, impose sanctions and provide remedies without forcing an individual to incur prohibitive legal costs.
That is the level of authority an AI regulator needs. Oversight without investigative and enforcement powers would leave us dependent on voluntary cooperation from the very organisations being supervised.
AI literacy is the missing layer of protection
Legislation alone will not create a society capable of using AI wisely.
People must understand that generative AI can confidently produce false information, reflect biases in its training data and create the appearance of understanding without possessing human judgement, empathy or experience.
AI literacy should therefore begin in schools. Children need more than lessons about how to use AI. They need to understand what it cannot do, how it may influence their judgement, why its answers must be checked and how excessive dependence on it could affect learning.
The same applies in the workplace. Responsible AI training should be required for public servants using these systems and expected in organisations deploying AI in consequential settings. Boards should understand their responsibilities, senior executives should be accountable and employees should know how to recognise and report failures.
The committee’s formal recommendations do not develop AI literacy as fully as I proposed. Parliament should therefore go beyond the report by creating a national AI literacy programme, including education for children, workforce training and accessible guidance for citizens affected by automated decisions.
Good AI regulation will support innovation
The familiar objection is that regulation will slow innovation. It is a false choice.
Good regulation can create the conditions in which responsible innovation succeeds. Safety requirements did not destroy the motor industry. They helped produce safer vehicles, increased public confidence and made safety itself a source of innovation.
AI regulation can do the same.
Businesses need certainty. Consumers need confidence. Public bodies need clear procurement and governance standards. Developers need to know what evidence will be required before high-risk systems enter the market. Trust will not be created by asking people to accept risks they cannot see and decisions they cannot challenge.
The committee concluded that an appropriate regulatory regime would strengthen human rights protection while reinforcing the UK’s international leadership in AI.
The UK now has a credible blueprint: an AI Bill, mandatory transparency, proportionate duties across the supply chain, meaningful developer accountability, prior scrutiny of high-risk systems, an empowered regulator and accessible remedies.
Parliament should implement it, and it should add the AI literacy programme that citizens urgently need.
AI is not a magic wand. It is a powerful tool built by imperfect humans, trained on human data and deployed within human institutions. The purpose of AI regulation is not to prevent progress. It is to ensure that progress serves people.
The technology may be artificial. The rights at stake are not.
