In a landmark shift for British digital regulation, the Information Commissioner’s Office (ICO) has formally transitioned into the Information Commission under the provisions of the Data (Use and Access) Act 2025. Simultaneously, legal regulators across England and Wales have issued urgent conduct warnings holding solicitors and barristers strictly liable for artificial intelligence inaccuracies and confidentiality breaches in judicial proceedings.
The Information Commission and frontier AI oversight
Replacing the historical single-commissioner governance model with a corporate regulatory board, the new Information Commission possesses expanded statutory powers tailored to frontier foundation models:
- Statutory Regulatory Sandbox (SRS): The Commission has inaugurated an AI regulatory sandbox, enabling vetted technology developers to trial cutting-edge models under controlled conditions with temporary regulatory derogations.
- Mandatory audit powers: Regulators now hold explicit statutory authority to inspect model training data pipelines, assessing copyright compliance, web scraping practices, and personal data minimization before commercial deployment.
- Enhanced enforcement: The board model streamlines cross-regulator cooperation with the Competition and Markets Authority (CMA) and Ofcom under the Digital Regulation Cooperation Forum (DRCF).
SRA and Bar Standards Board: strict personal accountability
In parallel, the Solicitors Regulation Authority (SRA) and the Bar Standards Board (BSB) have issued joint guidance addressing the growing use of generative AI tools in litigation and commercial practice:
- Non-delegable duty of care: Legal professionals cannot outsource their professional judgment, due diligence, or statutory duties to artificial intelligence models.
- Tribunal sanctions for hallucinations: Following recent disciplinary hearings involving fabricated judicial precedents generated by large language models, regulators emphasized that submitting unverified AI citations to court constitutes a grave breach of professional conduct.
- Client confidentiality and cloud leaks: Uploading unredacted client instructions, privileged correspondence, or corporate records to commercial AI services without end-to-end encryption and contractual protections violates legal professional privilege and statutory data protection rules.
The message from the judiciary and regulators is unequivocal: while artificial intelligence offers powerful efficiencies, the legal burden of integrity, accuracy, and client protection remains entirely human.