Authored By: Anastasiia Sosnovska
Southampton Solent University
I. Introduction
Regulation of Artificial Intelligence is one of the biggest legal issues of the twenty-first century. As machine learning systems, large language models (LLMs), and autonomous agent networks are incorporated into decision-making infrastructure in public services, employment, health, and finance, states have already started adopting radically different legislative approaches to address algorithmic bias, opaque decision-making, and systemic risk.
For instance, since 2 August 2026, every reply that a new Claude model generates would carry an invisible signature. The watermark cannot be seen, does not change what the text says, and survives being copied and pasted elsewhere. It exists for one reason: Article 50(2) of the EU AI Act requires it.[1] Anthropic, the company behind Claude, decided to apply the mark everywhere Claude is used worldwide, not only inside the European Union. [2] On the other hand, no UK statute demands anything comparable. A user in Manchester receives the same invisible mark as a user in Munich, not because any UK regulator required it, but as a by-product of externalized scope written for an entirely different jurisdiction.[3] Although the case is minor, it illustrates a much wider structural question: can a legal system composed of distinct, industry-specific statutes ever require, or even properly evaluate, a transparency measure that a single centralized EU provision pulled in a single legislation from a worldwide AI provider?
This article argues that, although the UK’s sector-led model offers genuine advantages in doctrinal familiarity and interpretive flexibility[4], the case law generated under that model, together with live regulatory disputes such as the Ofcom-TikTok investigation[5], reveal deficiencies in structure that are better addressed by a horizontal statute or statutory cross-sectoral powers.
The article proceeds as follows: Section II sets out the primary statutory architecture in each jurisdiction. Section III analyses the case law testing that architecture. Section IV critically evaluates the UK’s sectoral model considering that case law. Section V situates the EU-UK divide within a broader international trend, with Section VI providing conclusion.
II. Legal Framework
The EU Model
The EU AI Act[6] is the world’s first comprehensive regulatory framework for artificial intelligence adopted on a product-safety legal basis under Article 114 TFEU[7]. Its aim is to promote the uptake of human-centric and trustworthy artificial intelligence, ensuring a high level of protection of health, safety and fundamental rights (e.g. democracy and rule of law)[8], with phased implementation being up to August 2027. [9]It creates a four-tiered hierarchy of risk. Prohibited practices (Unacceptable risks) [10] include cognitive-behavioral manipulation that subverts free will[11], untargeted scraping of facial images for recognition databases[12], social scoring[13], and real-time remote biometric identification in public spaces for law enforcement,[14] subject to narrow exceptions.[15] High-risk systems[16] ( covering critical infrastructure[17], medical devices[18], recruitment[19], administration of justice [20] and access to essential services such as credit scoring[21] ) that pose a risk of harm [22]must undergo mandatory conformity assessment[23], maintain technical documentation[24], and guarantee human oversight before entering the market.[25] General-purpose AI models (Limited risk) are subject to dedicated transparency obligations[26], such as training and testing[27] , and those posing “systemic risk” face model evaluation[28]and mandatory incident reporting.[29]
Enforcement operates through the European AI Office at Union level[30] and national competent authorities at Member State level[31], with administrative penalties of up to €35 million or 7% of global turnover for prohibited practices.[32] Following industry criticism that ex ante conformity assessment imposes disproportionate costs on smaller developers, the European Commission introduced the Digital Omnibus package in November 2025, simplifying documentation and softening initial compliance timelines without altering the Act’s underlying statutory mandates.[33]
The UK Model
The UK has deliberately avoided a single AI statute, except where domestic providers or distributors that make AI systems available in the EU market. [34] Its Department for Science, Innovation and Technology instead set out five cross-cutting principles (safety, transparency, fairness, accountability, and contestability) for existing regulators to apply within their own statutory jurisdictions.[35] In practice, enforcement is anchored in ordinary primary legislation. One of them is new Data (Use and Access) Act 2025, which embeds additional articles to UK’s General Data Protection Regulation[36] on automated decision making[37] restrictions[38] and safeguards[39].
The Equality Act 2010 provides the principal safeguard of protected characteristics against discrimination[40], prohibiting AI-driven recruitment or service decisions that disadvantage protected groups.[41] The Financial Services and Markets Act 2023 empower the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) over AI in credit scoring and algorithmic trading.[42] The FCA has confirmed it does not intend to introduce an AI-specific regulatory regime, relying instead on existing tools such as the consumer Duty and Senior Managers and Certification Regime.[43] The Communications Act 2003 and the Online Safety Act 2023 give Ofcom oversight of algorithmic content moderation[44] and, as the TikTok investigation illustrates, of child-safety systems.[45] The Enterprise Act 2002 and Competition Act 1998 give the CMA powers over algorithmic market distortion.[46]
This structure allows sector-tailored regulation. For example, Medicine and Healthcare Regulatory Agency (MHRA) evaluates AI-driven diagnostic software through established medical-device approval pathways rather than a generic conformity regime.[47] But it also means that no single regulator holds general authority over an AI system that crosses sectoral lines.
III. Case Law Analysis
Automated Decision-Making: SCHUFA Holding
In Case C-634/21 SCHUFA Holding (Scoring), the Court of Justice of the European Union gave its first interpretation of Article 22 GDPR, holding that a credit reference agency’s automated generation of a creditworthiness score itself constitutes a “decision” within Article 22 , with lender drawing heavily on that score to grant or refuse credit, even though the agency does not make the final lending decision itself.[48] In order to extend Article 22’s rights upstream to the entity generating the automated output rather than just the business acting on it, the Court adopted a broad, purposeful interpretation of decision. The case demonstrates the EU judiciary’s readiness to interpret a horizontal instrument broadly to account for the realities of algorithmic decision-making.
Biometric Surveillance and the Limits of Human-Rights Review: Bridges
The leading UK case on AI-driven surveillance is R (Bridges) v Chief Constable of South Wales Police[49], in which the Court of Appeal held that despite the fact that police force’s use of live automated facial recognition (AFR) breached Article 8 ECHR of private life by collecting large amount of sensitive images coming from disinterested people, failed to comply with its public sector equality duty (PSED) by not properly assessing the risk of indirect discrimination ( inherent racial or sex biases[50]) built into the underlying algorithm.[51], the court rules that general using AFR technology can be proportionate under Article 8(2) for public safety if proper safeguards are in place, being legally sufficient under Data Protection Act 2018. This means the claimant succeeded, but on narrow procedural grounds (inadequate policy documentation and an incomplete equality assessment), rather than on a substantive finding that biometric surveillance of this kind is unlawful in principle. The case illustrates that courts can find defects without determining the underlying legal status of the technology because AI-specific protection is based on procedural compliance with a broad human-rights and equality framework.
Jurisdiction and Delay: The Clearview AI Litigation
The prolonged dispute between the Information Commissioner’s Office (ICO) and Clearview AI[52] illustrates a different structural weakness. The ICO issued an enforcement notice to US-based company Clearview and a £7.5 million penalty in May 2022 for unlawfully processing UK residents’ facial images to build a recognition database. Whilst First-tier Tribunal (FTT) allowed Clearview’s appeal, The Upper Tribunal (UT) overturned that decision in October 2025, finding that Clearview’s processing did relate to the monitoring of UK residents’ behavior and so fell within scope after all under UK GDPR.[53] Even though the judgment is legally binding, the UT still directed that this case should be sent back to the FTT to determine the substantive appeal on the basis that the Commissioner had jurisdiction to issue the monetary penalty notice and enforcement notice. [54] , leaving UK residents temporarily exposed to unlawful data scraping while postponing the enforcement of a £7.5 million fine against Clearview AI.
IV. Critical Evaluation
A fundamental criticism of the UK’s sectoral model is supported by the case law in Section III, which assumes that AI risk can be cleanly divided inside pre-existing regulatory borders, even though modern AI deployment is intrinsically cross-sectoral.
Imagine an enterprise that deploys a multimodal, general-purpose algorithm for personnel management and hiring. Employment law (unfair dismissal and worker protection[55]), equality law (indirect discrimination[56], overseen by the EHRC), data protection law (processing of biometric and candidate data, overseen by the ICO), and possibly financial regulation (performance metrics feed into compensation governed by the FCA) are all concurrently engaged by that single system. A claimant may require years of litigation to prove a procedural flaw rather than a substantive fault, and Bridges[57] demonstrates that even in cases where a single regulator has jurisdiction, he does not have the power to evaluate the entire system.
The same fragmentation can occur on a jurisdictional level, as seen by Clearview[58], where an international developer can operate for years in a true regulatory vacuum while tribunals debate whether domestic law even applies to it. The Ofcom-TikTok inquiry reveals the same vulnerability[59]– Ofcom can only inquire as to whether TikTok’s age-inference system fulfills its obligations under the Online Safety Act 2023. Consequently, regulators only see the thin slice of an AI system covered by their explicit mandate.
A reasonable response to this criticism is that UK primary legislation is flexible: the DSIT’s principles-based approach was specifically created to stay adaptable to innovations that a strict taxonomy might not anticipate[60], and the ICO, EHRC, and Ofcom can and do collaborate informally. The Digital Omnibus package was created since ex ante conformity assessment proven to be expensive for smaller companies, and horizontal regulation is not free.[61] Therefore, criticism of the EU AI Act’s own compliance burden also calls for caution. These are genuine trade-offs, not just rhetorical ones, and there are actual institutional costs associated with completely implementing the EU model in a common-law, sector-regulator system.
Nevertheless, the case law shows that informal coordination has not yet resulted in a general standard that may regulate an AI system that concurrently spans multiple legislative realms. The UK model provides claimants and regulators with multiple incomplete standards, each requiring its own litigation to determine if it applies at all, whereas the EU model gives them a single, widely applicable standard, although one that is badly calibrated.
V. Comparative Perspectives
In 2024, Colorado passed the first complete state AI law in the United States[62]. It was specifically modeled after the risk-tiered structure of the EU AI Act, imposing duties of care, risk-management programs, and impact assessments on creators and deployers of high-risk systems, such as education, employment, financial services and healthcare. [63]However, Colorado legislature revoked the system on 14th of May 2026 and replaced it with Automated Decision-Making Technology Act (ADMTA) with a narrower framework focused on increased transparency about consequential decisions and disclosures about adverse outcomes affected by automated decision-making technology (ADMT), taking effect on 1st of January 2027. [64] This demonstrates that the central regulatory choice we’re discussing is not merely centralized versus sectoral governance, but how ex-ante obligations are calibrated. Despite their different trajectories, the EU, UK, and Colorado experiences show that jurisdictions globally are being forced to revisit their initial governance architectures within two to three years of deployment, proving that AI regulation remains in an experimental phase.
VI. Conclusion
This article has argued that while the UK’s principles-based, sector-led model offers doctrinal familiarity and adaptability, its case law reveals a structural vulnerability: no single authority holds comprehensive jurisdiction over AI systems spanning multiple sectors or international boundaries. Procedural remedies under legacy statutes remain slow and fragmented. While the EU’s Digital Omnibus package shows the compliance burdens of heavy centralization, and Colorado’s legislative repeal highlights the challenges of transplanting EU-style ex-ante frameworks, the EU’s horizontal baseline successfully solves the jurisdictional vacuum by design.
The comparative lesson for the UK is not that one model should simply replace the other, but that any jurisdiction relying on sector-specific enforcement must build in explicit statutory mechanisms, whether lead-regulator designations, statutory information-sharing duties, or residual cross-sectoral oversight powers for AI systems, no single legacy statute was drafted to anticipate. Until UK primary legislation provides these tools, cases like Bridges and Clearview will remain exceptions that test statutory boundaries rather than establishing a cohesive body of AI law.
VII. Table of Authorities
Cases
Clearview AI Inc v Information Commissioner [2023] UKFTT 819 (GRC)
Information Commissioner v Clearview AI Inc (Privacy International intervening) [2025] UKUT 319 (AAC)
R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058
Case C-634/21 SCHUFA Holding (Scoring) EU:C: 2023:957
UK Legislation & Statutory Instruments
Communications Act 2003 (c 21)
Competition Act 1998 (c 41)
Data Protection Act 2018 (c 12)
Data (Use and Access) Act 2025
Employment Rights Act 1996 (c 18)
Enterprise Act 2002 (c 40)
Equality Act 2010 (c 15)
Financial Services and Markets Act 2000 (c 8)
Financial Services and Markets Act 2023 (c 29)
Medical Devices Regulations 2002, SI 2002/618
Online Safety Act 2023 (c 50)
United Kingdom General Data Protection Regulation (UK GDPR)
EU Primary & Secondary Legislation
Charter of Fundamental Rights of the European Union [2012] OJ C 326/391
Consolidated Version of the Treaty on the Functioning of the European Union [2012] OJ C 326/47, art 114
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation) [2016] OJ L 119/1
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonized rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L 2024/1689
US State Legislation
Colorado Artificial Intelligence Act, SB 24-205 (2024) (repealed)
Colorado Automated Decision-Making Technology Act, SB 26-189 (2026)
VIII. Bibliography
Anthropic, ‘How Claude Marks AI-Generated Content’ (Anthropic Help Center, 21 August 2026) https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
Centre for Data Ethics and Innovation, Industry Temperature Check: Barriers and Enablers to AI Assurance (DSIT, 8 December 2022) https://www.gov.uk/government/publications/industry-temperature-check-barriers-and-enablers-to-ai-assurance
Department for Science, Innovation and Technology, A Pro-Innovation Approach to AI Regulation (Cmd 815, 2023 / CP 1019, 2024)
Euro news, ‘EU Compliance, Delivered Globally: Anthropic to watermark Claude’s output worldwide’ (Euro news, 11 August 2026) https://www.euronews.com/next/2026/08/11/eu-compliance-delivered-globally-anthropic-to-watermark-claudes-output-worldwide
European Commission, Proposal for a Regulation Streamlining Implementation in the Digital Single Market (Digital Omnibus Package) COM(2025) 780 final (November 2025) https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-regulation-proposal
Farrer & Co, ‘The EU AI Act – what does it mean for UK organisations that use or provide AI systems?’ (Farrer & Co Insights, 11 February 2026) https://www.farrer.co.uk/news-and-insights/the-eu-ai-act–what-does-it-mean-for-uk-organisations-that-use-or-provide-ai-systems/
Information Commissioner’s Office, ‘UK Upper Tribunal hands down judgment on Clearview AI Inc’ (ICO Media Centre, 8 October 2025) https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/
Ofcom, ‘Ofcom Investigates TikTok’s Age Assurance Measures’ (Ofcom, 16 July 2026) Case No CW/01352/07/26
Panopticon Blog, ‘Key Points from the Bridges Facial Recognition Appeal’ (Panopticon, 3 September 2020)
Skadden, Arps, Slate, Meagher & Flom LLP, ‘Colorado Repeals and Replaces Its AI Act’ (Skadden Insights, 9 June 2026) https://www.skadden.com/insights/publications/2026/06/colorado-repeals-and-replaces-its-ai-act
[1] Antrophic, ‘How Claude marks AI-generated content’ (Antrophic Help Center) https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content
[2] Euro News ‘EU Compliance, Delivered Globally: Antrophic to watermark Claude’s output worldwide’ (11 August 2026) https://www.euronews.com/next/2026/08/11/eu-compliance-delivered-globally-anthropic-to-watermark-claudes-output-worldwide
[3] Regulation (EU AI Act) 2024/1689 of the European Parliament and of the Council OJEU (13 June 2024), Art 2(1)(c)https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689,
[4] Department for Science, Innovation and Technology (DSIT), ‘A Pro-Innovation Approach to AI Regulation’ (Cmd 815, 2023) para 11 https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach/white-paper – part-2-the-current-regulatory-environment
[5] Ofcom ‘Investigation into TikTok’s compliance with duties to protect children from encountering harmful content’ (16 July) (CW/01352/07/26) https://www.ofcom.org.uk/online-safety/protecting-children/investigation-into-tiktoks-compliance-with-duties-to-protect-children-from-encountering-harmful-content-under-section-12
[6] Ibid(n3)
[7] Consolidated Version of the Treaty on the Functioning of the European Union (9 May 2008) OJ115, art 114
[8] Ibid(n3), art1(1)
[9] Farrer & Co, The EU AI Act- what does it mean for UK organisations that use or provide AI systems? (11 February 2026) https://www.farrer.co.uk/news-and-insights/the-eu-ai-act–what-does-it-mean-for-uk-organisations-that-use-or-provide-ai-systems/
[10] Ibid (n3), art 5
[11] Ibid, (1)(a)
[12] Ibid, (1)(e)
[13] Ibid, (1)(c)
[14] Ibid, (1)(g)
[15]Ibid, (1)(h)
[16] Ibid (n3), art 6
[17] Ibid, (2); Annex III, para 2
[18] Ibid, para 5(a)
[19] Ibid, para 4
[20] Ibid, para 8
[21] Ibid, para 5(b)
[22] Ibid (n3), art7(1)(b)
[23] Ibid (n3), art 9
[24] Ibid(n3), art 11
[25]Ibid, art 14
[26] Ibid, art 50
[27] Ibid, art 53(1)(a)
[28] Ibid, art 55(1)(a)
[29]Ibid (n26), (1)(c).
[30] Ibid(n3), art 56(1)
[31] Ibid, (3)
[32]Ibid(n3), art 99(3)
[33]European Commission, Proposal for a Regulation Streamlining Implementation in the Digital Single Market (Digital Omnibus Package) COM(2025) 780 final, November 2025.https://digital-strategy.ec.europa.eu/en/library/dig ital-omnibus-regulation-proposal
[34] Ibid(n9)
[35]Ibid (n4), para 10
[36] United Kingdom General Data Protection Regulation (UK GDPR)
[37] Ibid, art 22A
[38] Ibid, art 22B
[39] Ibid, art 22C
[40] Equality Act 2010, ss4-19
[41] Centre for Data Ethics and Innovation, Industry Temperature Check: Barriers and Enablers to AI Assurance (DSIT, 8th December 2022), para 7 https://www.gov.uk/government/publications/industry-temperature-check-barriers-and-enablers-to-ai-assurance/industry-temperature-check-barriers-and-enablers-to-ai-assurance
[42] Financial Conduct Authority, Written Evidence to Treasury Committee: AI in Financial Services (AIFS0031, April 2025) https://committees.parliament.uk/writtenevidence/139726/pdf/
[43] Ibid, para 2.2, 2.6
[44] Communications Act 2003 (c 21); Online Safety Act 2023 (c 50).
[45]Ibid (n5)
[46]Enterprise Act 2002 (c 40); Competition Act 1998 (c 41).
[47]Medical Devices Regulations 2002, SI 2002/618.
[48] Joined Cases C-26/22 and C-64/22 SCHUFA Holding (Scoring) EU:C: 2023:958 (Court of Justice of European Union, 7 December 2023)
[49] [2020] EWCA Civ 1058
[50] Ibid(n38), s149
[51]Ibid (n47), Lord Justice Singh, [199]
[52] [2025] UKUT 319 (AAC)
[53] Ibid(n34), art 2(1)(a); art3(2)(b)
[54] Information Commissioner’s Office ‘UK Upper Tribunal hands down judgement on Clearview AI Inc’ (8 October 2025) https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/uk-upper-tribunal-hands-down-judgment-on-clearview-ai-inc/ – :~:text=Update 19 December 2025%3A,Court of Appeal.
[55] Employment Rights Act 1996
[56] Ibid(n38)
[57] Ibid(n47)
[58] Ibid(n50)
[59] Ibid(n5)
[60] Ibid (n3)
[61] Ibid (n33)
[62] Colorado Artificial Intelligence Act (CAIA), SB 24-205 (2024) https://leg.colorado.gov/bill_files/47770/download
[63] Ibid
[64] Skadden Publication, Colorado Repels and Replaces its AI Act (June 9 2026) https://www.skadden.com/insights/publications/2026/06/colorado-repeals-and-replaces-its-ai-act
