Key AI themes: Regulatory divergence, practical perspectives and the age of agentic AI

After a busy few months advising on a wide range of AI related issues (as well as presenting at various AI conferences) some common themes and discussion points have emerged. 

These include the need for regulatory clarity, practical challenges of compliance and the novel legal questions raised by agentic AI.  Our key takeaways are below:

Regulatory and enforcement gaps: the recent attacks on freezers, PHP related outages and ‘summer of containment failures’ (including the widely-cited Hugging Face incident) has sharpened focus on the need for effective regulation, but the global regulatory landscape is increasingly complex as governments compete on regulatory posture.  In particular:

• UK: The UK’s sector specific approach has been criticised from various quarters. At a recent conference, Lord Holmes of Richmond MBE said it left Parliament tackling AI “bill-by-bill”, often unsuccessfully.  For example, despite AI’s significance in financial services (see our blog  on the Mills Review) and proposed AI-specific amendments, the Financial Services and Markets Bill remains silent on AI.  The result of this piecemeal approach is no cross-sector legislation, and gaps and inconsistencies within the sectoral regime.  It has been suggested the UK would be well placed to establish an AI-specific authority that supports existing regulators and acts as a horizontal thread across sectors, taking a “light touch, right touch” approach. In terms of a government response, so far we have seen discussion of the important role played by the UK’s well respected AI Security Institute, and plans to amend the upcoming Cyber Security and Resilience Bill to cover certain AI cyber risks, but nothing more generally on an AI specific Bill or authority.  
   
• EU: there is no such concern about a shortage of laws in the EU. At the 4^th Annual AI Regulation Summit in London, Kai Zenner (Head of Office and Digital Adviser for MEP Axel Voss) recently noted there are at least 171 EU digital laws, and (in his view) even the European Commission cannot say who enforces each one.  The AI Omnibus offers little relief: it has faced criticism for largely deferring, rather than simplifying, this digital rulebook. Its delay to the high risk rules should, however, enable time for the necessary standards and guidance to be published (evidenced recently by the publication of the first European standard on AI which relates to quality management systems).
   
• US and China: as the two front-runners in the race to ‘win AI’ it is interesting to see how the US has focussed on industry self-policing and ‘voluntary’ standards (at least at federal level  - see our earlier blog post for more information on the US approach) while China has been described as having one of the most comprehensive AI regimes, and is seeking to lead on international governance. 

Practical perspectives on compliance: In our article “The EU AI Act: Challenges and questions for AI Providers as the Act starts to bite”, we discussed some of the practical compliance challenges facing providers. In addition, there has been discussion across the AI value chain of a widening gap between what the EU’s AI Act requires and what organisations can practically deliver, from Commission scope creep (where the guidance and codes of conduct go further than the Act itself), to compliance costs and technical barriers (e.g. around free form text watermarking). On the latter point, when challenged at the recent AI Regulation Forum in Brussels, policymakers' response was that enforcement will focus on those who disregard their obligations rather than those making a genuine effort to achieve compliance (although we have not yet had any enforcement to test whether that is true). There is also the wider of issue of how well the AI Act fits modern risks (for example, the Hugging Face incident is arguably not in the AI Act’s scope at all, given it happened during training/development). 

Agentic AI: agentic systems sharpen the compliance challenge in a number of ways: 

• Expect incidents: agentic AI is probabilistic, so misalignment should be expected.  The same collaboration, inventiveness and persistence of the agentic systems behind OpenAI’s reported resolution of the Navier-Stokes Millennium Prize Problem can equally cause harm when an agent pursues its goals by unintended means, as the Hugging Face incident shows. 
   
• Tensions with AI Act: AI Act compliance is complicated by the nature of agentic AI. For instance, for high-risk agentic AI systems, how can appropriate human oversight “commensurate with the level of autonomy” be achieved when much of the agentic AI’s value lies precisely in its ability to act with minimal human involvement? 
   
• Accountability question: panellists at the recent 4^th Annual AI Regulation Summit in London agreed that frontier risks rest primarily with the frontier labs, but deployers should not assume that they can disclaim responsibility for unexpected outcomes, particularly when harnessing agents for their own purposes. The UNCITRAL Model Law on Automated Contracting attributes an automated system’s actions to its user, and attribution may not be denied solely because the outcome was unexpected. Although not yet enacted in any EU Member State, it signals that legal systems will not accept an “AI did it” defence that would reward deploying the least constrained systems. That said, consensus during both events was that the accountability question remains far from settled. 
   
• Practical safeguards: as contracts are not a panacea, businesses should diligence agentic systems’ guardrails, incident detection and the auditability of decisions, and invest in separate, ideally deterministic, security architecture around these systems before live deployment.

Finally, in terms of how this is all managed, we have seen renewed discussions on the importance of good AI governance, and we will be producing a more detailed article on AI governance in our upcoming horizon scanning series.