ICO and CMA publish article concerning safeguards to protect data privacy and consumer rights

Foundation models

Large-scale base AI systems such as GPT, Flamingo and Grok are rapidly reshaping the digital landscape. Their ability to generate ever convincing text, code, images, and more is driving innovation across industries, from healthcare and legal to education and entertainment. As these models become increasingly embedded in digital products and services, their impact on society and the world’s economies is growing at a rapid rate.

This transformative technology has caught the eye of the regulators. Foundation models raise complex questions around data protection, market competition, and consumer safety. Governments and regulators worldwide are grappling with how to harness the benefits of these technologies while mitigating their risks. 

The Digital Regulation Cooperation Forum (“DRCF”) - comprising the CMA, Ofcom, the ICO, and the FCA - recently published an article titled “Harnessing Innovation and Growth Opportunities from AI Foundation Models,” which explores the differing strategies adopted by foundation model developers in making their technologies available for further development and use.

The DRCF article explores the differences between open access and closed access foundational models:

• Open-Access Foundational Models - these models make their core components - such as architecture, source code, model weights, and biases -publicly available. This transparency enables downstream developers to inspect, modify, and build upon the models and offering greater visibility into their inner workings.
• Closed-Access Foundational Models - closed-access foundation models restrict access to key assets such as architecture, code, and model weights, limiting visibility into their internal workings. This approach allows developers to maintain tighter control over intellectual property, security, and commercial deployment, but can reduce transparency and opportunities for external innovation.

The CMA and the ICO make clear that they do not favour one approach over another. Both approaches present distinct benefits and risks. A diverse ecosystem, they argue, is essential to fostering innovation, competition, and resilience in the AI landscape. 

The regulators are of the view that existing UK legal frameworks - covering data protection, competition, and consumer rights - are sufficiently robust to govern either approach, provided that developers comply with their requirements. This neutrality supports the UK's dedication to innovation supported by regulatory safeguards. 

The emphasis is very much on proactive risk mitigation, responsible development and transparency. 

Developers of open-access models are expected to implement safeguards to manage downstream use. Practically this is achieved via appropriate licensing terms, acceptable use policies, and clear documentation. They are also expected to keep data protection in mind during the development, ensuring that personal data used in training is handled lawfully from the outset.

In contrast, closed-access models - typically accessed via Application Programming Interfaces (“APIs”) - allow developers to control the end users use via technical controls and monitoring such as gated access, usage monitoring, and content moderation tools. While such mechanisms can offer stronger oversight it is only effective if the model align with relevant legal standards.

Whichever approach a developer takes, the regulators highlight that transparency is always an expectation. Developers should disclose meaningful information about how the model was built, what data was used, and what its limitations and risks are. Such information allows those deploying the model, and ultimately end-users, to make informed, accountable decisions.

Our views and next steps

The article is positive and supports the need for innovation, however the regulator’s underlying assumption that the current legal framework is sufficient to regulate foundational models is not without critique. While UK data protection, competition and consumer laws are broad and far reaching they were designed at a different time and in many respects, in a different world. They were not drafted with the complexity and scale of foundational models in mind. 

Foundational models and their ability to convincingly produce misleading and harmful content introduces new and novel risks. It must be questioned whether AI Specific legislation is needed, for example to bolster the general duty for transparency under data protection laws.

As the regulatory landscape continues to evolve, it will be interesting to see how the UK’s principles-based, light touch approach to AI regulation compares to the EU’s more prescriptive, rules-based framework and how both approached foster or stifle innovation.