Clifford Chance

The King's speech of 17 July 2024, setting out the new Labour government's proposed legislative programme, included only one brief reference to digital regulation – specifically, to the need for regulation of the development of the most powerful artificial intelligence models – but, as ever, the devil is in the detail. The briefing notes accompanying the speech do not in fact propose immediate legislation to regulate AI development; but on the other hand they do propose revival and development of parts of the previous government's Data Protection and Digital Information Bill, and a new Bill to update and expand the UK's regulation of cybersecurity in the context of critical national infrastructure.

In this article we briefly identify the key proposals.

Artificial intelligence

The speech says that the government "will seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models." This appears to be a longer-term goal, however, as no actual Bill is proposed to address AI regulation.

It may be that the government will engage in consultation on possible approaches to AI regulation over the coming months, before proceeding to draft legislation. Before the speech there had been suggestions that new legislation might be introduced to require greater transparency in relation to training of large language models and related security measures, and to further restrict "deepfakes" and other potentially harmful content, all with an emphasis on regulating the AI ecosystem as it will develop over time rather than focussing on the applications of today. There may be a degree of regulatory continuity here: the previous government sought to rely on existing law to regulate the development and use of AI, but acknowledged that AI-specific legislation may ultimately be required.

Data protection and digital information

The word "data" did not feature in the speech itself, but the accompanying briefing notes announce a Digital Information and Smart Data (DISD) Bill. The DISD Bill will in practice revive and build on parts of the previous government's Data Protection and Digital Information Bill, which fell out of the legislative process when the general election was announced.

It appears – although this is not yet entirely clear - that the DISD Bill will not include all of the previous government's proposed changes to the requirements and protections of the UK General Data Protection Regulation (GDPR) and other data protection laws, designed to exploit Brexit freedoms and reduce regulatory burdens, but that it will include provisions to:

• modernise the Information Commissioner's Office and give it enhanced powers
• implement some "targeted" reforms to the UK GDPR and other data protection laws (but these will be limited to reforms addressing "lack of clarity impeding the safe development and deployment of some new technologies")
• facilitate the provision of digital verification services and promote standards for digital identities;
• establish and implement "smart data" schemes
• allow more permissive sharing of business data within government
• facilitate the use of health data for research purposes, while applying new information standards to IT suppliers in the health and social care system
• digitise the registration of births and deaths
• facilitate coroners' access to data relating to deceased children for the purposes of their investigations
• establish and allow access to a national register of pipes, cables and other underground assets.

Cybersecurity

Cybersecurity was also not mentioned in the speech itself, but the briefing notes announce a Cybersecurity and Resilience (CSR) Bill. This will propose enhancement (or replacement) of the Network and Information Systems (NIS) Regulations 2018, which regulate cybersecurity measures and incident reporting in relation to the UK's critical national infrastructure. The briefing notes point out that the EU "NIS 1" Directive, which the NIS Regulations implemented in the UK, has already been replaced by the more comprehensive "NIS 2", which is due to be implemented across the EU by October of this year.

Proposed reforms include:

• expansion to the scope of organisations to which the regulations apply, to cover a wider range of providers of digital services, and also reach into supply chains
• stronger enforcement and investigatory powers for regulators
• expanding the scope of the Regulations' incident reporting requirements.

The previous government had also proposed to make changes to the NIS Regulations, but had not yet brought specific legislative proposals forward.

Lucy Powell, the leader of the House of Commons, suggested ahead of the speech that the newly proposed bills are "fully considered, worked-up bills that we know we can get through in this parliamentary session". Clifford Chance will be closely following the first months of the new government in the upcoming parliamentary session, to further distil what lies ahead.