AI Policy Wiki
Dashboard
⚲

Ada Lovelace Institute

medium confidence · updated 2026-09-19

UK independent research institute on data and AI policy. Argues that UK AI regulation leaves upstream developers largely shielded from legal risk, that deployed systems inherit the flaws of their base models ('risk proliferation'), and that UK regulators, especially the EHRC, are under-resourced for AI; critic of the Data (Use and Access) Act 2025's automated-decision reforms and of the AI Security Institute's lack of enforceable authority.

The Ada Lovelace Institute is a UK research institute working on data and AI policy. It gave oral and written evidence to the Joint Committee on Human Rights' 2025–26 inquiry into AI and human rights, whose report cites it more than a dozen times, and its positions centre on allocating legal responsibility to upstream AI developers, strengthening individual rights around automated decisions, and resourcing regulators.

Positions

Upstream responsibility and liability. In evidence to Parliament's Joint Committee on Human Rights, Michael Birtwistle, the Institute's Associate Director (Law and policy), said "[t]he major gap in our regulatory system is managing risk upstream with those building the tech," and that "AI is regulated in the UK, but only incidentally and not well." In written evidence the Institute argued that liability risk "should be fairly distributed between the relevant actors (upstream developers, downstream developers, deployers)," but that "legal risks are primarily pushed to downstream actors through the use of contracts and standard terms & conditions," leaving upstream foundation-model developers "largely shielded from risk" and "not ... optimally incentivized to invest in precautionary measures" (Human Rights and the Regulation of AI (Joint Committee on Human Rights, HC 160, September 2026)). See AI Liability.

Risk proliferation. The Institute described government chatbots and similar tools as usually built on a general-purpose large language model, so that "without careful audit for risks and further finetuning, such systems will inherit all the flaws, biases and risks of their base LLM model. This is known as 'risk proliferation'." It said a risk-based regime would make systems "more likely to be rights-compliant at the point of deployment, helping address risk proliferation" (Human Rights and the Regulation of AI (Joint Committee on Human Rights, HC 160, September 2026)). See Risk-Based AI Regulation.

Individual rights. It told the committee that people subject to automated decision-making are usually given only the "general logic" of a system rather than a personalised explanation, that meaningful routes to "understanding harm" and "knowing when their rights have been infringed" are preconditions for redress, and that case law is "a slow, unresponsive mechanism" for emerging technologies. It warned of "a new generation of equally invasive inferential ... technologies" that claim to infer emotions, intentions or truthfulness "often with low levels of scientific validity," and it has published a proposed legal framework for biometric technologies, An Eye on the Future (May 2025) (Human Rights and the Regulation of AI (Joint Committee on Human Rights, HC 160, September 2026)). Earlier, it warned that the automated-decision-making reforms in the Data (Use and Access) Act 2025 weaken protections and that the Act's innovation duty on the reconstituted Information Commission weakens regulator independence on AI (Data (Use and Access) Act 2025 (UK)).

Regulators and the AI Security Institute. The Institute said UK regulators "are not well resourced or empowered to address AI" and that the EHRC is "critically under-resourced to address AI." Birtwistle said the AI Security Institute's 2025 change of focus from "safety" to "security" showed "the deregulatory flavour of the government's attitude towards AI" (Human Rights and the Regulation of AI (Joint Committee on Human Rights, HC 160, September 2026)). The Institute is among the civil-society groups that argue AISI's voluntary access arrangements leave it without enforceable authority (UK AI Safety Institute (AI Security Institute)).

Relationships