CASRAI Dictionary

Tag: uk ai regulatory framework

  • Pro-Innovation AI Regulation: Three Years On

    A pro-innovation approach to AI regulation delivered exactly what its title promised for UK research institutions: no new AI regulator, no statutory duty, and continued reliance on existing bodies. Three years on, universities gained substantial research funding and an AI sandbox model, but the dedicated AI Act many assumed would eventually follow has still not arrived — even as the EU quietly loosens its own.

    A pro-innovation approach to AI regulation is the UK government’s March 2023 white paper setting out a non-statutory, principles-based framework in which existing sector regulators — rather than a new central AI authority — apply five cross-sectoral principles to AI use within their own remits.

    What the white paper actually promised research institutions

    Published by the Department for Science, Innovation and Technology on 29 March 2023, the white paper explicitly rejected an EU-style AI Act. Instead, it committed to five non-statutory principles — safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress — for regulators to interpret within existing remits.

    For research institutions, three commitments mattered most: a central government function to monitor cross-cutting AI risk, AI “sandboxes” allowing controlled real-world testing, and an explicit acknowledgement that foundation models developed or fine-tuned inside universities would fall under the same principles as commercial deployments. The paper also floated a fallback: if voluntary compliance proved insufficient, government reserved the option to introduce a statutory duty requiring regulators to have regard to the principles.

    What has materialised, three years on

    Judged against its own text, the framework has been substantially delivered — but the research-funding side of the ledger moved faster and further than the regulatory side.

    2023 white paper commitment Status by mid-2026 Detail
    Five non-statutory principles applied by existing regulators Delivered ICO, CMA, FCA and Ofcom apply the principles via the Digital Regulation Cooperation Forum; no new central AI regulator was created
    Central risk-monitoring function Delivered, narrowed The AI Safety Institute launched in November 2023 was renamed the AI Security Institute in February 2025, with bias and fairness work explicitly dropped from its remit
    AI sandboxes for controlled testing Delivered via new vehicle Cross-economy AI sandboxing powers now sit in the Regulating for Growth Bill, announced in the May 2026 King’s Speech, rather than in standalone AI legislation
    Statutory duty on regulators (fallback option) Not introduced No statutory duty to regard the principles has been legislated; the non-statutory model remains in force
    Research funding to build AI capability Delivered and exceeded UKRI committed £80 million to nine AI research hubs (February 2024) and £117 million to 12 AI Centres for Doctoral Training training around 900 PhD students, plus up to £60 million for two further labs at Oxford and UCL
    Dedicated AI Act Not delivered As of July 2026, no AI Bill has been laid before Parliament by government

    The research-funding commitments arguably over-delivered relative to the white paper’s own modest framing, which discussed capability-building only in general terms. The regulatory commitments, by contrast, tracked the white paper almost exactly: light-touch, sector-led, and still without primary legislation.

    Does the UK have an AI Act yet?

    No. The House of Commons Library’s research briefing, last updated 10 June 2026, states plainly that “the UK does not have any AI-specific regulation or legislation covering AI as a technology” — AI is instead regulated only through the lens of whatever sector or use case it appears in.

    The clearest signal of intent came in the May 2026 King’s Speech, where government introduced the Regulating for Growth Bill rather than a standalone AI Act. The Bill creates cross-economy sandboxing powers — explicitly covering AI-enabled products and services — and strengthens regulators’ existing “growth duty.” This is the 2023 white paper’s sandbox-and-existing-regulators architecture, carried into the one piece of legislation government did choose to bring forward, rather than superseded by it.

    The contrast with the EU sharpened rather than narrowed in 2026. Under the Digital Omnibus on AI, agreed by the Council and Parliament on 7 May 2026 and formally endorsed on 16 and 29 June 2026, the EU deferred applicability of high-risk obligations for standalone Annex III AI systems from 2 August 2026 to 2 December 2027 — a sixteen-month delay — and for product-embedded Annex I systems to 2 August 2028. The bloc that legislated first is now easing its own timetable in the same direction the UK chose from the start: slower, more sector-specific, less prescriptive. For research institutions running UK-EU collaborative projects, this means the compliance gap between the two regimes has narrowed in practice even as it remains wide in principle — EU partners still face a statutory Act; UK partners still do not.

    Answer-first Q&A

    Is there any regulation on AI in the UK?

    Yes, but not AI-specific regulation. AI use is governed by existing sectoral law — UK GDPR and the Data Protection Act for data processing, equality law for discrimination, and regulator guidance from the ICO, CMA, FCA and Ofcom applying the white paper’s five principles within their own remits.

    What are the guidelines for AI in the UK?

    The core guidelines are the white paper’s five cross-sectoral principles: safety, transparency, fairness, accountability and contestability. Regulators translate these into sector guidance; the ICO’s AI guidance and UKRI’s generative-AI guidance for grant applications and peer review are two research-relevant examples.

    Does the UK have any laws on AI?

    The UK has no AI-specific statute. AI-related legal obligations instead arise from existing frameworks — data protection, product safety, equality and sector regulation — applied to AI as a use case, a position the Commons Library confirmed again in its June 2026 briefing.

    What is the AI legislation in 2026?

    The main 2026 development is the Regulating for Growth Bill, announced in the King’s Speech, which creates cross-economy AI sandboxing powers and strengthens regulators’ growth duty. It is not a dedicated AI Act and does not replace the 2023 white paper’s non-statutory model.

    What this means for research administrators

    For institutions managing research integrity, ethics review and international collaboration, the practical position has not changed since 2023: there is still no single AI compliance regime to point to. Research offices assessing AI use in grant applications, peer review or data processing must continue mapping obligations across data protection, funder policy and sector guidance individually, rather than against one statute.

    • UKRI’s generative-AI guidance for grant applications and peer review remains the most directly applicable research-specific rule set.
    • The AI Security Institute’s narrowed remit means bias and fairness concerns in research AI tools sit with the ICO and funders, not a national safety body.
    • Cross-border projects with EU partners should track the Digital Omnibus’s revised 2027–2028 timetable separately from any UK sandbox rollout under the Regulating for Growth Bill.
    • No statutory duty exists yet requiring UK regulators to apply the five principles consistently, so guidance can still vary by sector and by regulator.

    The verdict, three years on

    The 2023 white paper’s central bet — that voluntary, principles-based, regulator-led governance would prove durable rather than a stopgap before statute — has held. Government has repeatedly reaffirmed rather than abandoned that bet, most recently by routing AI sandboxing through the Regulating for Growth Bill instead of standalone legislation. Research institutions received the funding side of the promise in full and then some; they received the regulatory side almost exactly as written, for better or worse. Whether that remains defensible depends on what the EU’s now-softening Act ends up looking like once its delayed obligations finally bite in December 2027 — at which point the UK’s three-year wait for clarity may look either prescient or merely prolonged.

    Research administrators tracking these obligations alongside authorship, funder mandates and evolving research-integrity standards can find related context in CASRAI’s research administration resources.

  • UK AI Safety Institute vs 4 Global Peers

    The UK AI Safety Institute — renamed the AI Security Institute (AISI) in 2025 — is a research directorate of the Department for Science, Innovation and Technology that evaluates frontier AI systems and funds external safety research, distinguishing it from the US CAISI’s standards focus, Japan’s non-R&D coordination role, Canada’s CIFAR-administered grants, and the EU AI Office’s regulatory enforcement mandate. For institutions weighing where to seek collaboration or funding for AI safety evaluation work, these differences in remit, funding scale, and academic-access routes are decisive.

    The UK AI Safety Institute is one node in a wider “International Network of AI Safety Institutes,” launched at the AI Seoul Summit in May 2024, bringing together technical bodies from the UK, US, Japan, Canada, the EU and other jurisdictions to coordinate — but not centralise — frontier AI risk assessment.

    What is the UK AI Safety Institute (AISI) today?

    The AI Security Institute is a directorate of the UK’s Department for Science, Innovation and Technology (DSIT), established in November 2023 following the Bletchley Park AI Safety Summit. Its mission, per GOV.UK, is “to minimise surprise to the UK and humanity from rapid and unexpected advances in AI.”

    A UK Parliament written statement of February 2025 confirmed the rebrand from “AI Safety Institute” to “AI Security Institute,” sharpening its focus on national-security-relevant risks such as cyber, chemical and biological misuse, alongside broader model evaluation work. The rename matters for researchers: many external directories still index the institute under its original name, which can misdirect funding enquiries.

    AISI holds pre-release testing access agreements with Anthropic, Google and OpenAI, and maintains Inspect, an open-source evaluation platform that lets companies, governments and academic teams run standardised AI safety tests without a bespoke agreement with AISI itself.

    How do the five institutes’ remits compare?

    All five bodies share a broad goal of understanding advanced-AI risk, but their statutory and operational remits diverge sharply — from hands-on evaluation to pure regulation.

    • UK AI Security Institute (AISI): evaluates frontier models, runs foundational safety research and grant programmes, and facilitates international information exchange.
    • US Center for AI Standards and Innovation (CAISI): sits inside NIST; focuses on testing, standards and national-security assessment. Renamed from “US AI Safety Institute” in 2025, mirroring the UK’s shift.
    • Japan AI Safety Institute (J-AISI): explicitly states it is not an R&D organisation; it consolidates evaluation methods and standards from industry and academia as a coordination hub.
    • Canada AI Safety Institute (CAISI): advances AI safety science with international partners, focused on synthetic-content risk and systems that could undermine human oversight.
    • EU AI Office: sits within the European Commission with an enforcement mandate — it supervises general-purpose AI models under the EU AI Act, the world’s first comprehensive statutory AI framework.

    Only the EU AI Office carries binding regulatory enforcement powers; the other four are advisory, evaluative and research-funding bodies without statutory power to compel compliance.

    Institute Parent body Core remit Direct academic funding
    UK AI Security Institute DSIT Evaluation, foundational safety research Yes — grants £50,000–£500,000
    US CAISI NIST / Dept. of Commerce Standards, national-security testing Limited — collaborative, not grant-led
    Japan J-AISI Government-affiliated hub Coordination, standards consolidation No — information-sharing role only
    Canada CAISI Innovation, Science and Economic Development Canada Safety science, synthetic-content risk Yes — via CIFAR-administered CAISI Research Program
    EU AI Office European Commission AI Act enforcement, GPAI supervision Indirect — via Horizon Europe / Digital Europe

    How is each institute funded?

    Funding scale is the clearest differentiator for institutions assessing where a grant application or evaluation partnership is likeliest to land.

    The UK AISI traces its funding to a £100 million initial investment behind the Frontier AI Taskforce, its 2023 predecessor body, and now runs the Alignment Project, a global research fund backed by more than £15 million. Grants under its Challenge Fund and Systemic AI Safety Grants typically range from £50,000 to £500,000 per award, open to UK and international applicants.

    The US CAISI operates on a comparatively modest footing: an initial budget of roughly $10 million for the 2024/25 fiscal year, with legislative proposals since floated to raise annual funding into the $67–155 million range — proposals, not yet appropriated funding.

    Canada’s AI Safety Institute is funded at CA$50 million over five years, of which CA$27 million has been channelled to the Canadian Institute for Advanced Research (CIFAR) to run the CAISI Research Program. Canada has also committed CA$1 million to the UK’s Alignment Project through CIFAR — a direct funding link institutions can leverage for joint bids.

    Japan’s J-AISI has not published a standalone budget, consistent with its coordination-only remit rather than direct grant-making. The EU AI Office likewise discloses no ring-fenced budget of its own; EU AI research funding flows through Horizon Europe and the Digital Europe Programme, together worth well over €1 billion annually, of which only a fraction is Office-directed academic work.

    How does each body engage external academic researchers?

    Engagement models range from direct grant-making to purely consultative input, which changes what “collaboration” actually means for a university research office.

    • UK AISI: direct grants to academic institutions and non-profits in the UK and internationally through the Challenge Fund, Systemic AI Safety Grants and the Alignment Project.
    • US CAISI: collaborative research relationships with universities to develop guidelines and voluntary standards, rather than large competitive grant rounds.
    • Japan J-AISI: partnership and information-sharing with academia and industry, consolidating findings rather than commissioning new funded research.
    • Canada CAISI: funding via CIFAR’s Catalyst Projects and Solution Networks, with awards up to CA$70,000 per year for up to two years, plus ties to Canada’s three national AI institutes — Amii, Mila and the Vector Institute.
    • EU AI Office: consultative input via the AI Board and a scientific panel of independent experts shaping codes of practice for general-purpose AI models, rather than a competitive grants pipeline.

    For a research administration office, this means the UK and Canadian institutes are the two realistic direct-funding routes today; the US, Japanese and EU bodies are better approached as standards-setting or advisory partners than as grant sources.

    Common questions

    Is the UK AI Safety Institute still called that?

    No. The UK AI Safety Institute was renamed the AI Security Institute in 2025, confirmed in a UK Parliament written statement, and the US counterpart was simultaneously renamed the Center for AI Standards and Innovation (CAISI). Both retain their original evaluation and research functions under the new names.

    What is the International Network of AI Safety Institutes?

    It is a coordination body launched at the AI Seoul Summit in May 2024, joining institutes from the UK, US, Japan, Canada, the EU and other governments. Its first formal meeting took place in November 2024, and it exists to align evaluation methods, not to centralise funding or enforcement power.

    How can an academic team apply for UK AISI funding?

    UK-based and international researchers can apply through AISI’s Challenge Fund or Systemic AI Safety Grants, with typical awards between £50,000 and £500,000, or through the cross-national Alignment Project, which pools UK and partner-government contributions, including Canada’s CA$1 million pledge via CIFAR.

    Does the EU AI Office fund academic AI safety research directly?

    Not directly. The EU AI Office is primarily a regulatory and enforcement body for the EU AI Act; academic AI research funding in the EU runs through Horizon Europe and the Digital Europe Programme, with the Office instead offering academics a consultative seat via its scientific panel and the AI Board.

    What this means for institutions seeking partnerships

    Research administration offices scoping AI safety evaluation collaborations should match their proposal to the right model rather than assuming one “AI Safety Institute” template applies globally. A UK or Canadian bid should target a named grant scheme with a defined award range; a US, Japanese or EU approach should be framed as standards-development or advisory input instead.

    Because only the UK and Canadian institutes run competitive, named academic grant programmes — and already share a funding link through CIFAR and the Alignment Project — joint UK–Canada bids are, as of mid-2026, the most concrete route into public frontier-AI-safety funding for external academic groups. The EU AI Office’s enforcement powers will likely reshape this landscape as AI Act obligations mature, but its funding role stays structurally indirect for now. Institutions should track each institute’s funding cycle separately rather than treat the international network as one funding body.

  • UK AI Regulatory Framework: EU Sandboxes to 2027

    The UK AI regulatory framework relies on existing sector regulators and five cross-sectoral principles rather than a single AI law, while a related EU milestone has just slipped: Article 57 of the EU AI Act required every member state to launch a national AI regulatory sandbox by 2 August 2026, and the EU’s Digital Omnibus simplification package has now pushed that deadline to 2 August 2027. For research institutions piloting AI in admissions, exam proctoring, or research-assistant tools, the delay changes when a supervised testing route becomes available — and it puts a spotlight on what the UK offers instead.

    An AI regulatory sandbox is a supervised legal and technical environment, established by a national competent authority, in which providers can develop, test, and validate innovative AI systems under direct regulatory oversight before those systems are placed on the market.

    What is an AI regulatory sandbox under Article 57?

    Article 57 of Regulation (EU) 2024/1689 — the EU AI Act — requires each member state to ensure its competent authorities establish at least one national AI regulatory sandbox. Inside the sandbox, providers develop, train, validate, and test AI systems under a supervised programme agreed with the regulator, with derogations available for limited real-world testing before a product goes to market.

    The mechanism exists because conformity assessment for high-risk AI systems is otherwise a one-shot, post-hoc exercise. A sandbox lets a university, a health authority, or a fintech firm iterate on a system’s design with a regulator in the room, reducing the risk of building a product that fails assessment after deployment. The AI Act entered into force on 1 August 2024 and becomes fully applicable on 2 August 2026, with obligations phased in across that period.

    Why did the 2026 sandbox deadline slip?

    The original Article 57 deadline required sandboxes to be operational by 2 August 2026 — the same date the AI Act’s general obligations take full effect. By early 2026, the European Parliament’s own think tank was reporting that the European Commission had not yet adopted the implementing act setting out common rules for how sandboxes should operate, leaving member states without the technical detail needed to stand theirs up on schedule.

    Several factors compounded the delay:

    • No implementing act: member states lacked Commission guidance on common sandbox rules until late in the schedule.
    • Resourcing: newly designated national AI authorities lacked the staff and budget sandboxes require.
    • Sequencing: sandboxes matter most for high-risk systems, and those detailed obligations do not apply until August 2027 anyway.

    What does the Digital Omnibus actually change?

    The Digital Omnibus is the European Commission’s 2026 simplification package for digital-rules legislation, including targeted amendments to AI Act deadlines. Under the package, the deadline for national AI regulatory sandboxes moves from 2 August 2026 to 2 August 2027 — aligning it with the date the Act’s detailed high-risk system obligations become enforceable, rather than with the earlier general-applicability date.

    The table below sets out how the EU timeline compares with the sandbox-equivalent mechanisms already running in the UK, which is not an EU member state and is not directly bound by Article 57.

    Mechanism Jurisdiction Legal basis Status / deadline
    National AI regulatory sandbox Each EU member state AI Act Article 57 (Regulation (EU) 2024/1689) Delayed from 2 Aug 2026 to 2 Aug 2027 under the Digital Omnibus
    FCA Regulatory Sandbox UK, financial services FCA innovation framework Running in cohorts since 2016
    ICO Regulatory Sandbox UK, data protection ICO service, independent of the AI Act Ongoing, rolling applications
    AI Growth Labs UK, cross-sector Follows the AI Opportunities Action Plan Pilot phase, sector-by-sector rollout

    Does the UK AI regulatory framework offer an equivalent?

    The UK AI regulatory framework is a pro-innovation, context-specific model set out in the 2023 white paper “AI regulation: a pro-innovation approach”. Instead of a horizontal AI statute, existing regulators — the Information Commissioner’s Office (ICO), the Competition and Markets Authority (CMA), and the Financial Conduct Authority (FCA) among them — apply five cross-sectoral principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.

    The UK has no Article 57 equivalent written into statute, but it is not starting from zero. The FCA has run a financial-services regulatory sandbox since 2016, the ICO already operates its own sandbox for organisations testing innovative, personal-data-driven products, and the government’s newer AI Growth Labs initiative is designed to pilot AI applications that existing rules would otherwise slow down. The gap is horizontal, cross-sector coverage of the kind Article 57 mandates for AI specifically — which matters because the AI Act’s extraterritorial scope catches any provider or deployer placing an AI system on the EU market or serving EU-based users, including UK universities with EU campuses, Erasmus partnerships, or platforms used by EU-resident students and researchers.

    What should research institutions piloting AI do now?

    Three categories of university AI pilot sit closest to this regulatory activity, and two of them are explicitly named as high-risk under Annex III of the AI Act: systems used to evaluate learning outcomes or assign students to institutions (admissions algorithms), and systems used to monitor or detect prohibited behaviour during tests (exam proctoring). Research-assistant models are not automatically high-risk but can trigger obligations depending on how their outputs are used in decision-making.

    Practical steps institutions can take while sandbox access is delayed:

    • Map pilots against Annex III now, since admissions and proctoring tools carry the highest compliance burden once high-risk obligations bite.
    • Use available UK sandboxes — the ICO’s service in particular — for pilots with a significant personal-data component, since that route does not depend on the EU timeline.
    • Track sandbox announcements in EU jurisdictions where the institution has a legal presence, so an application can be lodged as soon as one opens.
    • Document testing activity conducted before 2027; sandbox participation typically requires evidence of a structured development process, not a blank pilot history.

    Answer-first questions on sandboxes and the delay

    What is the deadline for AI regulatory sandboxes now?

    Under the Digital Omnibus, EU member states must have at least one operational national AI regulatory sandbox by 2 August 2027, one year later than the original Article 57 deadline of 2 August 2026. The new date aligns with when the AI Act’s detailed high-risk obligations take full effect.

    Which EU countries missed the original 2026 sandbox deadline?

    By the original deadline, most member states had not launched an operational sandbox, largely because the European Commission’s implementing act setting common sandbox rules had not been adopted in time. Newly designated national AI authorities also lacked the staffing to meet the schedule unassisted.

    Does the UK have to comply with the EU AI Act?

    The UK is not an EU member state, so Article 57 does not bind it directly. However, the AI Act’s extraterritorial scope applies to any provider or deployer placing an AI system on the EU market or serving EU-based users — a live issue for UK universities with EU partnerships or EU-resident users.

    Are university admissions and proctoring tools classified as high-risk AI?

    Annex III of the EU AI Act explicitly lists AI systems used for admission or assignment to educational institutions, and for monitoring or detecting prohibited student behaviour during tests, as high-risk applications. Both categories face the Act’s strictest conformity, documentation, and human-oversight requirements.

    Outlook: what comes next

    The sandbox delay buys implementers time, but it does not change the substance of what Article 57 sandboxes are for or which university AI pilots will eventually need them. Institutions that map their admissions, proctoring, and research-assistant pilots against Annex III now — and use existing UK routes such as the ICO sandbox in the interim — will be positioned to apply the moment national EU sandboxes open in 2027, rather than starting that process from scratch.

    Research administrators coordinating these pilots across institutional and cross-border governance structures may find it useful to review how research administration functions are adapting their compliance workflows to AI-specific regulatory requirements more broadly.