UK publishes government response to its AI regulation white paper consultation

The pro-innovation approach to AI regulation government response is the Department for Science, Innovation and Technology's reply to its 2023 AI regulation white paper consultation.

On 6 February 2024, the Government published its response to the March 2023 consultation on a pro-innovation approach to Artificial Intelligence.

What it is

The original white paper was presented to Parliament by the Secretary of State for Science, Innovation and Technology on 29 March 2023.

In that document the government set out an initial, non-statutory proposal for regulating AI in the UK.

The February 2024 response followed a consultation that drew 466 individual replies, including a joint submission from local government bodies.

The white paper proposed five clear principles for existing UK regulators to follow, and these were retained in the response.

What it requires

The government confirmed it plans to stick to the context-based framework rather than introduce new cross-sector AI legislation at this stage.

It asked a number of existing regulators to publish an update outlining their strategic approach to AI by 30 April 2024.

The response also confirms a new central function to support risk monitoring, regulator coordination, and knowledge exchange across government.

It is backed by funding including over £100 million announced to help realise AI innovations and support regulators' technical capabilities.

Separately, the government said it is considering specific binding requirements for what it calls highly capable general-purpose AI systems, targeting a small number of developers.

An update on new responsibilities for those systems was expected by the end of 2024.

The government acknowledged that acting before risks and mitigations are properly understood could harm the ability to benefit from technological progress while leaving the UK unable to adapt quickly to emerging risks.

It stated plainly that we will legislate when we are confident that it is the right thing to do.

What security leaders should do

Because the UK framework relies on existing regulators interpreting shared principles rather than a single AI statute, security leaders should track sector-specific guidance from the regulators relevant to their industry rather than waiting for one central AI law. Organizations developing or deploying highly capable general-purpose AI systems should watch for future binding requirements targeting that narrow category and prepare documentation on compute usage and capability benchmarking now. Security and compliance teams should treat the five cross-sectoral principles as a baseline checklist for AI risk assessments even where no statutory duty yet applies, since regulators are being asked to show how they will apply them. Given the government's own statement that legislation will eventually follow once risk understanding matures, leaders should build governance processes that can be adapted into formal compliance programs rather than one-off voluntary measures.