Most governments looking at how to regulate AI assumed they would need to create a new regulator for it. The UK chose a different path. It asked its existing regulators, each covering a specific sector, to apply a shared set of AI principles within their own areas. Two years in, the verdict is still being written.
The dilemma
By 2023, governments around the world were trying to work out who should regulate AI. The most obvious answer was to set up a new authority dedicated to it, which is the path the European Union took. The UK government took a different view. AI was already being used across finance, health, employment, transport, and consumer markets, each of which had its own well-established regulator. Creating a new central AI authority would either duplicate the work those regulators were already doing, or weaken the expertise they had built up over decades.
The regulatory gap
What the UK government wanted was a shared set of principles that all existing regulators could apply to AI in their own areas. It also wanted shared tools, such as sandboxes for testing AI systems, monitoring arrangements, and frameworks for assuring AI safety, that any regulator could use without needing new legislation. The challenge was building this kind of cooperation across regulators that had never previously been asked to coordinate on a single technology.
The approach
In March 2023, the UK government's Department for Science, Innovation and Technology, working with the Office for Artificial Intelligence, published the AI Regulation White Paper. It set out five principles to be applied by existing regulators: safety, transparency, fairness, accountability, and the right to contest a decision. The regulators expected to apply these principles include the Financial Conduct Authority, the Information Commissioner's Office, the Competition and Markets Authority, the Medicines and Healthcare products Regulatory Agency, and others. The framework also set up central government functions to monitor how AI was developing across the economy and to coordinate between regulators. The reasoning was that letting each regulator apply the principles within its own area, supported by central coordination, would be faster and more accurate than passing a single AI law that tried to cover everything at once.
Results achieved
The White Paper drew 466 responses from industry, civil society, and academia, and the government published its formal response in February 2024. How regulators have responded has been uneven. Some, including the Financial Conduct Authority, the Information Commissioner's Office, and the Medicines and Healthcare products Regulatory Agency, have produced meaningful AI-specific tools and guidance. Others have been slower. The UK approach has also diverged from the European Union, which finalised the EU AI Act during the same period. The EU chose a more centralised path, with prescriptive rules and a single legal framework.
Two limits are worth noting. Whether the UK model produces consistent outcomes across the economy depends on two things: the capacity of individual regulators to do this work alongside their existing duties, and the strength of central coordination between them. Both are under continuing pressure as budgets tighten and AI evolves. The framework is widely cited internationally as a possible alternative to the EU's approach, but it is too early to compare the results.
The transferable lesson
A decentralised, principles-based approach to regulating AI is often described as a lighter option than passing new legislation. It is not lighter. It is different, with its own costs. The savings on writing detailed legal rules are spent instead on the sustained work of getting many regulators to coordinate, and on managing the political fallout when two regulators reach different conclusions on the same issue. Other countries considering the UK model should plan for this coordination work from the start.
