CASRAI Dictionary

Tag: UK AI regulation

  • Pro-Innovation AI Regulation: Three Years On

    A pro-innovation approach to AI regulation delivered exactly what its title promised for UK research institutions: no new AI regulator, no statutory duty, and continued reliance on existing bodies. Three years on, universities gained substantial research funding and an AI sandbox model, but the dedicated AI Act many assumed would eventually follow has still not arrived — even as the EU quietly loosens its own.

    A pro-innovation approach to AI regulation is the UK government’s March 2023 white paper setting out a non-statutory, principles-based framework in which existing sector regulators — rather than a new central AI authority — apply five cross-sectoral principles to AI use within their own remits.

    What the white paper actually promised research institutions

    Published by the Department for Science, Innovation and Technology on 29 March 2023, the white paper explicitly rejected an EU-style AI Act. Instead, it committed to five non-statutory principles — safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress — for regulators to interpret within existing remits.

    For research institutions, three commitments mattered most: a central government function to monitor cross-cutting AI risk, AI “sandboxes” allowing controlled real-world testing, and an explicit acknowledgement that foundation models developed or fine-tuned inside universities would fall under the same principles as commercial deployments. The paper also floated a fallback: if voluntary compliance proved insufficient, government reserved the option to introduce a statutory duty requiring regulators to have regard to the principles.

    What has materialised, three years on

    Judged against its own text, the framework has been substantially delivered — but the research-funding side of the ledger moved faster and further than the regulatory side.

    2023 white paper commitment Status by mid-2026 Detail
    Five non-statutory principles applied by existing regulators Delivered ICO, CMA, FCA and Ofcom apply the principles via the Digital Regulation Cooperation Forum; no new central AI regulator was created
    Central risk-monitoring function Delivered, narrowed The AI Safety Institute launched in November 2023 was renamed the AI Security Institute in February 2025, with bias and fairness work explicitly dropped from its remit
    AI sandboxes for controlled testing Delivered via new vehicle Cross-economy AI sandboxing powers now sit in the Regulating for Growth Bill, announced in the May 2026 King’s Speech, rather than in standalone AI legislation
    Statutory duty on regulators (fallback option) Not introduced No statutory duty to regard the principles has been legislated; the non-statutory model remains in force
    Research funding to build AI capability Delivered and exceeded UKRI committed £80 million to nine AI research hubs (February 2024) and £117 million to 12 AI Centres for Doctoral Training training around 900 PhD students, plus up to £60 million for two further labs at Oxford and UCL
    Dedicated AI Act Not delivered As of July 2026, no AI Bill has been laid before Parliament by government

    The research-funding commitments arguably over-delivered relative to the white paper’s own modest framing, which discussed capability-building only in general terms. The regulatory commitments, by contrast, tracked the white paper almost exactly: light-touch, sector-led, and still without primary legislation.

    Does the UK have an AI Act yet?

    No. The House of Commons Library’s research briefing, last updated 10 June 2026, states plainly that “the UK does not have any AI-specific regulation or legislation covering AI as a technology” — AI is instead regulated only through the lens of whatever sector or use case it appears in.

    The clearest signal of intent came in the May 2026 King’s Speech, where government introduced the Regulating for Growth Bill rather than a standalone AI Act. The Bill creates cross-economy sandboxing powers — explicitly covering AI-enabled products and services — and strengthens regulators’ existing “growth duty.” This is the 2023 white paper’s sandbox-and-existing-regulators architecture, carried into the one piece of legislation government did choose to bring forward, rather than superseded by it.

    The contrast with the EU sharpened rather than narrowed in 2026. Under the Digital Omnibus on AI, agreed by the Council and Parliament on 7 May 2026 and formally endorsed on 16 and 29 June 2026, the EU deferred applicability of high-risk obligations for standalone Annex III AI systems from 2 August 2026 to 2 December 2027 — a sixteen-month delay — and for product-embedded Annex I systems to 2 August 2028. The bloc that legislated first is now easing its own timetable in the same direction the UK chose from the start: slower, more sector-specific, less prescriptive. For research institutions running UK-EU collaborative projects, this means the compliance gap between the two regimes has narrowed in practice even as it remains wide in principle — EU partners still face a statutory Act; UK partners still do not.

    Answer-first Q&A

    Is there any regulation on AI in the UK?

    Yes, but not AI-specific regulation. AI use is governed by existing sectoral law — UK GDPR and the Data Protection Act for data processing, equality law for discrimination, and regulator guidance from the ICO, CMA, FCA and Ofcom applying the white paper’s five principles within their own remits.

    What are the guidelines for AI in the UK?

    The core guidelines are the white paper’s five cross-sectoral principles: safety, transparency, fairness, accountability and contestability. Regulators translate these into sector guidance; the ICO’s AI guidance and UKRI’s generative-AI guidance for grant applications and peer review are two research-relevant examples.

    Does the UK have any laws on AI?

    The UK has no AI-specific statute. AI-related legal obligations instead arise from existing frameworks — data protection, product safety, equality and sector regulation — applied to AI as a use case, a position the Commons Library confirmed again in its June 2026 briefing.

    What is the AI legislation in 2026?

    The main 2026 development is the Regulating for Growth Bill, announced in the King’s Speech, which creates cross-economy AI sandboxing powers and strengthens regulators’ growth duty. It is not a dedicated AI Act and does not replace the 2023 white paper’s non-statutory model.

    What this means for research administrators

    For institutions managing research integrity, ethics review and international collaboration, the practical position has not changed since 2023: there is still no single AI compliance regime to point to. Research offices assessing AI use in grant applications, peer review or data processing must continue mapping obligations across data protection, funder policy and sector guidance individually, rather than against one statute.

    • UKRI’s generative-AI guidance for grant applications and peer review remains the most directly applicable research-specific rule set.
    • The AI Security Institute’s narrowed remit means bias and fairness concerns in research AI tools sit with the ICO and funders, not a national safety body.
    • Cross-border projects with EU partners should track the Digital Omnibus’s revised 2027–2028 timetable separately from any UK sandbox rollout under the Regulating for Growth Bill.
    • No statutory duty exists yet requiring UK regulators to apply the five principles consistently, so guidance can still vary by sector and by regulator.

    The verdict, three years on

    The 2023 white paper’s central bet — that voluntary, principles-based, regulator-led governance would prove durable rather than a stopgap before statute — has held. Government has repeatedly reaffirmed rather than abandoned that bet, most recently by routing AI sandboxing through the Regulating for Growth Bill instead of standalone legislation. Research institutions received the funding side of the promise in full and then some; they received the regulatory side almost exactly as written, for better or worse. Whether that remains defensible depends on what the EU’s now-softening Act ends up looking like once its delayed obligations finally bite in December 2027 — at which point the UK’s three-year wait for clarity may look either prescient or merely prolonged.

    Research administrators tracking these obligations alongside authorship, funder mandates and evolving research-integrity standards can find related context in CASRAI’s research administration resources.

  • AI Growth Lab: What the UK’s Regulatory Sandbox Means for University-Led AI Research

    The AI Growth Lab is the UK government’s proposal for a cross-economy regulatory sandbox that lets firms and, potentially, universities trial AI-enabled products under supervised, time-limited exemptions from rules that would otherwise block deployment. The Department for Science, Innovation and Technology (DSIT) ran a call for evidence on the proposal from 21 October 2025 to 7 January 2026, and an advisory version of the Lab launched on 8 June 2026 with legal services as the first live sector. For research offices, the question is no longer whether the Lab will exist, but how sandbox pilots intersect with university spinouts, clinical AI trials, and research infrastructure such as the AI Research Resource.

    What Is the UK AI Growth Lab?

    DSIT describes the AI Growth Lab as a “pioneering cross-economy sandbox” that would oversee controlled deployment of AI-enabled products and services in live market environments, granting participating firms time-limited regulatory exemptions known as sandbox pilots. The rationale is economic: DSIT’s call-for-evidence document cites OECD modelling suggesting AI could add 0.4 to 1.3 percentage points to UK productivity growth over the next decade — equivalent to £55 billion to £140 billion in additional annual output by 2030 — while only 21% of UK businesses currently use AI, and 60% of respondents to an earlier call for evidence identified regulation as a barrier to adoption.

    The Lab builds on precedent. The UK pioneered the modern regulatory sandbox model with the Financial Conduct Authority’s 2016 fintech sandbox, since echoed by the EU, US, Japan, Estonia and Singapore. DSIT’s proposal also references the FCA’s Innovate Project, the Bank of England/FCA Digital Securities Sandbox, the ICO’s Data Protection Sandbox, and the MHRA’s AI Airlock — the last of which is already piloting oversight of ambient voice technologies (AI tools that transcribe clinician-patient conversations) through its “TORTUS” case study.

    An advisory version of the AI Growth Lab launched on 8 June 2026, bringing together the Legal Services Board, the Solicitors Regulation Authority and other regulators to trial AI products in legal services first, with the Information Commissioner’s Office issuing a supporting statement the same day. Statutory sandbox pilots, which would require primary legislation to grant regulators modification powers, remain subject to further parliamentary process; the House of Lords debated the proposal on 26 March 2026.

    How AI Growth Lab Sandbox Pilots Work

    DSIT’s proposal sets out a consistent operating logic for sandbox pilots, regardless of sector:

    • Issue-specific sandboxes target sectors with clear AI opportunity but where existing regulation impedes adoption — legal services, planning, diagnostic imaging and micromobility/robotics are the named early candidates.
    • Time-limited exemptions are granted to eligible firms and products, allowing them to operate under modified rules while under close supervision, with the Lab able to end a pilot at any time.
    • “Red lines” stay fixed. DSIT proposes that consumer protections, safety provisions, fundamental rights, workers’ protections and intellectual property rights can never be modified or disapplied during a pilot.
    • Successful pilots feed reform. Evidence from a pilot can inform permanent regulatory change — updated guidance, codes of practice, or secondary legislation — subject to parliamentary scrutiny.

    DSIT is weighing two operating models: a centrally operated Lab run by government with an Oversight Committee of sectoral regulators, better suited to cross-sector AI applications; and regulator-operated Labs, where a lead regulator runs the sandbox for its own sector — closer to the MHRA AI Airlock precedent. The table below situates the proposed Lab against sandboxes already operating in the UK.

    Sandbox Lead body Sector focus Modification power
    FCA Innovate Sandbox Financial Conduct Authority Fintech / financial services Advisory + authorisation support
    MHRA AI Airlock Medicines and Healthcare products Regulatory Agency AI as a medical device Advisory, phased case studies
    ICO Data Protection Sandbox Information Commissioner’s Office Cross-sector data protection Advisory
    AI Growth Lab (proposed) DSIT, with sectoral regulators Cross-economy, sector pilots Statutory exemptions (“sandbox pilots”), subject to red lines

    What It Means for University-Led AI Research

    DSIT’s call-for-evidence explicitly invited responses from “a research organisation, university or think tank” as a distinct respondent category, and the proposal’s own framing links the Lab to place-based AI Growth Zones, which are designed to pair university and industry AI capacity — with embodied and infrastructure-heavy AI applications potentially gaining access to the government’s AI Research Resource (AIRR), the shared compute allocation for UK AI research. That link between a regulatory sandbox and a compute-access programme is largely absent from law-firm commentary on the Lab, which has focused on commercial and professional-services angles.

    In practice, the clearest route into a pilot for most universities runs through spinouts and licensed technology transfer, since DSIT’s proposed eligibility criteria favour applicants with a near-market product, a UK nexus, and a demonstrable regulatory barrier — not early-stage research.

    • Opportunities: real-world testing routes for spinouts translating lab research into deployable tools; potential access to data and infrastructure otherwise gated by regulation; earlier sight of which regulatory barriers government is prepared to modify.
    • Risks: eligibility criteria oriented to market-ready products rather than exploratory research; unresolved questions on intellectual property and publication timing inside a supervised pilot; added administrative and ethical-review burden for institutions without dedicated regulatory-affairs capacity.

    Research offices supporting clinical AI should note that DSIT names the Ionising Radiation (Medical Exposure) Regulations as a candidate for pilot modification, given AI’s growing accuracy in interpreting scans — a live example of a pilot touching clinical research governance directly, not just commercial deployment.

    Common Questions About the AI Growth Lab

    What is an AI Growth Lab “sandbox pilot”?

    A sandbox pilot is a time-limited, closely supervised arrangement in which an eligible firm or product receives a targeted exemption from specific regulatory requirements. DSIT can end a pilot at any time, and protections such as consumer rights and safety provisions remain fixed “red lines” throughout.

    Which sector was first to join the AI Growth Lab?

    Legal services became the first sector inside the advisory AI Growth Lab, launched on 8 June 2026 with the Legal Services Board and Solicitors Regulation Authority as founding regulators. DSIT has signalled healthcare, planning and robotics as likely next candidates for issue-specific sandboxes.

    Who can apply to participate in the AI Growth Lab?

    DSIT’s proposal envisages applications from start-ups, established companies, global AI developers and public-sector innovators, with eligibility weighted toward a UK nexus, consumer benefit, and a demonstrable regulatory barrier. Final eligibility criteria were still under consultation as of the call-for-evidence close in January 2026.

    How does the AI Growth Lab differ from AI Growth Zones?

    AI Growth Zones are place-based clusters pairing infrastructure, compute and industry investment in specific UK locations, while the AI Growth Lab is a regulatory mechanism that can operate across the whole economy. DSIT’s proposal treats the two as complementary, with place-based sandbox pilots able to draw on AI Growth Zone infrastructure.

    What Research Offices Should Track Next

    The call for evidence has closed, but several decision points remain open and directly relevant to research administration teams supporting AI-related grants, spinouts and clinical trials:

    • Eligibility criteria finalisation — whether DSIT’s final rules for the Lab explicitly recognise university research organisations or spinouts as a distinct applicant category, beyond commercial firms.
    • Sector rollout order — after legal services, which sector opens next; healthcare/diagnostic imaging and planning are the most research-relevant candidates named in the proposal.
    • Oversight model — whether DSIT adopts a centrally operated Lab or regulator-operated Labs, which will determine which single point of contact a university would need to approach.
    • Primary legislation — statutory modification powers require parliamentary approval; institutions should track Hansard and DSIT announcements for the bill’s progress following the 26 March 2026 Lords debate.
    • AI Research Resource access — whether compute allocation under AIRR becomes formally linked to sandbox participation for embodied or infrastructure-heavy AI pilots.

    None of this displaces existing research governance. Institutional ethics review, data protection obligations, and research integrity processes continue to apply inside a sandbox pilot exactly as DSIT’s “red lines” intend — the Lab modifies sector regulation, not an institution’s own duty of care. Research offices that map their AI-active spinouts and clinical-AI projects against the Lab’s likely next sectors now will be better placed to respond quickly once eligibility criteria and the second wave of issue-specific sandboxes are confirmed.

  • What the EU AI Act Means for Your Research Institution: A Practical Guide for Administrators

    From 2 August 2026, the bulk of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) becomes fully applicable, closing the phased transition that began when the regulation entered into force in August 2024. For research administrators, this date matters more than most institutional calendars acknowledge. EU AI Act universities guidance has moved from policy briefing to operational requirement: several everyday campus tools are now reclassified as “high-risk” — admissions algorithms, proctoring software, recruitment screening systems — triggering documentation, oversight and conformity obligations that most procurement offices have not yet built into their workflows.

    The timing is awkward. Institutions are simultaneously absorbing REF 2029 preparation, tightening open access mandates from UKRI and NIH, and managing a wave of AI-related research integrity concerns — all while a genuinely new compliance regime lands on the desks of research offices, HR departments and IT governance committees. Unlike GDPR, which most universities have spent a decade operationalising, the AI Act’s risk-tiered structure is unfamiliar territory, and its research exemption is narrower than many assume. The AI Act 2026 universities transition has been years in the making, but the operational detail — who signs off an impact assessment, who reviews a vendor’s conformity file — has only recently reached most institutional risk registers.

    This guide sets out what changed on 2 August, which systems are affected, where the Article 2(6) research carve-out genuinely applies, and what UK institutions — inside or outside direct EU jurisdiction — need to do next.

    Prohibited Practices: What Article 5 Rules Out on Campus

    The Act’s prohibitions took effect earlier, from February 2025, but they remain the baseline every institution must revisit as enforcement matures. Article 5 bans a small number of “unacceptable risk” practices outright, with no exemption for research or education. Two are directly relevant to campus operations.

    First, emotion-recognition systems are prohibited in educational institutions except for narrowly defined medical or safety purposes. This rules out software marketed to detect student “engagement,” attentiveness or distress via facial or vocal analysis in classrooms and remote proctoring — a category that had been gaining traction in some exam-integrity and lecture-analytics products.

    Second, social scoring — evaluating or classifying individuals based on behaviour or characteristics in ways that lead to unjustified detrimental treatment — is banned, along with manipulative AI techniques that exploit vulnerabilities such as age or disability. Admissions and pastoral-care systems that build composite “risk scores” for students without transparent, justifiable criteria sit uncomfortably close to this line and warrant legal review, not just IT sign-off.

    High-Risk Systems: What EU AI Act Universities Must Assess in Recruitment and Student Tools

    The provisions taking effect on 2 August 2026 are where most research-administration workload will land. Annex III of the Act classifies AI systems used to determine access to educational institutions, to evaluate learning outcomes, to assess appropriate levels of education, or to monitor and detect prohibited student behaviour during tests, as high-risk. Separately, AI systems used to recruit or select natural persons — including targeted job advertising, applicant screening and candidate evaluation — are also high-risk under Annex III. Both categories map directly onto tools research offices and HR departments already use: automated essay scoring, admissions-ranking algorithms, AI-assisted shortlisting for postdoctoral and technician posts, and exam-proctoring software with anomaly detection.

    Deployers of high-risk systems (which, for most universities, means the institution using a vendor’s product, not building one from scratch) must, among other obligations:

    • Conduct a fundamental rights impact assessment before deployment
    • Ensure human oversight with the authority to override automated outputs
    • Maintain records enabling traceability of system decisions
    • Confirm the provider has completed conformity assessment and registered the system in the EU database
    • Inform affected individuals — applicants, students, candidates — that a high-risk AI system is in use

    Institutions cannot outsource this responsibility to the software vendor. Procurement teams need updated due-diligence checklists that ask vendors directly whether a product falls under Annex III, and legal or governance teams should require conformity documentation as a contractual condition before renewal, not after an incident.

    The Article 2(6) Research Exemption — and Its Limits

    Article 2(6) exempts AI systems and models “specifically developed and put into service for the sole purpose of scientific research and development” from the Act’s requirements. This is the provision most frequently misread by research offices as a blanket exclusion for university activity. It is not.

    The exemption applies to the research and development activity itself — building, training and testing a novel model as a research output. It does not extend to that same system once it is deployed operationally, for example if a machine-learning tool developed in a computer science department is subsequently adopted by the registry to screen applications or by HR to shortlist candidates. At that point, the system’s purpose has shifted from research to a real-world high-risk use, and the exemption falls away.

    This distinction matters for institutions increasingly practising translational and applied research: an AI model that starts life as a PhD project can cross into regulated territory the moment it is put into institutional service. Research administrators should build a review checkpoint into technology-transfer and innovation-office workflows specifically to catch this handover, rather than assuming legal status is fixed at the point of creation.

    UK Divergence: A Different Regulatory Path

    UK AI regulation 2026 looks markedly different from the EU model. Rather than a single cross-sectoral statute, the UK has continued with a “pro-innovation,” principles-based approach, relying on existing sectoral regulators — the Information Commissioner’s Office, the Office for Students, and others — to apply AI-specific guidance within their existing remits, supported by the UK AI Security Institute’s technical evaluation work. No UK equivalent of the EU AI Act’s binding, tiered obligations has been enacted.

    This creates a genuine compliance gap for UK institutions with any EU-facing dimension. The Act’s extraterritorial scope catches organisations outside the EU whose AI system outputs are used within the EU — relevant to UK universities running joint degrees, Erasmus-adjacent exchange programmes, EU-based satellite campuses, or admissions processes serving EU applicants. For these institutions, the EU AI Act universities in the EU-27 must observe is not a foreign regulation to monitor from a distance; it is a direct compliance obligation running in parallel with domestic UK requirements.

    What This Means for Research Administrators

    The AI Act compliance research organisations now need is fundamentally a governance exercise, not solely a legal one. Research administration bodies such as ARMA, EARMA, NCURA and INORMS have all flagged AI governance as an emerging competency area for the profession, and institutional response should reflect that breadth. Practical steps for the months following 2 August 2026 include:

    • Inventory every AI-enabled tool used in admissions, assessment, proctoring, recruitment and grant triage, and classify each against Annex III
    • Establish a standing checkpoint where research-originated AI tools are reviewed before operational deployment, closing the Article 2(6) gap
    • Update procurement templates to require vendor conformity documentation as a condition of contract
    • Brief pro-vice-chancellors for research, registrars and HR directors jointly — this is not solely an IT or legal matter
    • For institutions with EU touchpoints, treat the AI regulatory framework universities in the EU must follow as binding, not advisory

    This work sits alongside, rather than replaces, existing research integrity obligations. The AI regulation academic research now operates under intersects directly with long-standing standards around transparent authorship, data provenance and reproducibility — areas where established identifier systems, such as ORCID and DataCite DOIs, already give institutions a documentation backbone to build AI governance on top of, rather than starting from zero.

    Looking Ahead

    The 2 August 2026 milestone is not the end state of AI regulation for universities; it is the point at which theoretical compliance planning becomes operational reality. Enforcement mechanisms, national supervisory authorities and guidance from the European AI Office will continue to mature over the following year, and institutions should expect further clarification — particularly on where the research exemption’s boundary sits in practice. Research administrators who treat this as an ongoing governance discipline, embedded in procurement, HR and research-office workflows, will be far better positioned than those who treat 2 August as a single compliance deadline to clear and forget.