Artificial Intelligence | UK Regulatory Outlook July 2025

UK updates 

Getty Images v Stability AI trial 

The closely watched UK High Court case took place over some three weeks, concluding in early July 2025.

Getty Images operates a large commercial image database. Stability AI is the provider of Stable Diffusion, an AI tool which generates images in response to users entering request prompts. Getty claimed that Stability trained its AI model on images scraped from internet sites, including images for which Getty owns/has licences of the copyright, allegedly leading to some generated images reproducing substantial parts of Getty's images, sometimes including Getty's trade mark. The trial considered whether Stability had infringed Getty's IP, including copyright, trade marks and database rights, with Stability AI denying liability. 

In the latter stages of the case, Getty narrowed its claims, dropped its case on primary infringement of copyright and database rights, apparently because of difficulties showing that any training of the Stable Diffusion model had taken place in the UK. This left Getty with claims of secondary copyright infringement plus trade mark infringement and passing off. Judgment is expected in early October 2025, around the beginning of the court term following the summer recess. The case may have an impact on the government's views on possible changes to the law following its consultation on AI and copyright. 

UK AI regulation some way off 

The Guardian has reported that AI-specific regulation is likely to be at least a year away, saying that technology secretary Peter Kyle intends to introduce a "comprehensive" AI bill in the next parliamentary session. It is not yet known when the next session will begin, but some point between late this year and spring or summer of 2026 is currently thought to be most likely. 
 
The report also quotes government sources as saying that the legislation will focus not only on AI safety but also include provisions to deal with any legislative changes that might emerge from the UK's consultation on AI and copyright. 

Government to invest over £2 billion in the UK's AI ecosystem 

AI and related computing tech did well in the much-heralded spending review. Some £2 billion is being allocated over the next four years, much of it aimed at implementing the 50 recommendations of January’s AI Opportunities Action Plan. 
 
See this Insight for more information. 

The government has also published its new Industrial Strategy, part of which is the digital and technologies sector plan which details action plans for the boosting of six cutting-edge technologies, including AI. The AI aspect of the sector plan seems to consist largely of implementing the AI Opportunities Action Plan. 

Civil Justice Council sets up AI working group 

The Civil Justice Council, responsible for overseeing and co-ordinating the modernisation of the civil justice system, has established an AI working group. The group will consult and report on whether rules are needed to govern the use of AI by legal representatives for the preparation of court documents, including pleadings, witness statements and expert reports. 
 
The Law Gazette reports that judges in England and Wales now have access to a large language model (LLM) AI tool, and that the AI guidance provided to them was updated recently to explain concepts such as "hallucination" and "AI agent" and includes top tips for spotting AI-generated court submissions. 

FRC publishes guidance on the use of AI in audit  

The Financial Reporting Council (FRC), the UK's regulator of auditors, accountants and actuaries, has published its first guidance on the use of AI in audit. 
 
It is structured in two parts: an illustrative example of a potential use case of AI in an audit, and guidance on documenting deployment of tools that use AI. The FRC uses a broad definition of AI which encompasses any machine learning or deep learning models, including generative AI. 

EU updates 

Final draft of EU AI Act GPAI code of practice published 

The final draft of the EU AI Act general-purpose AI code of practice has been published, not far in advance of 2 August 2025, when the relevant parts of the Act come into effect. See here for the announcement and links, plus the press release. The next step will be for it to be endorsed by the EU Commission and EU member countries, likely to be just a formality. 

The draft code has three chapters: (i) transparency, (ii) copyright and (iii) safety and security (the latter applying only to providers of GPAI models with "systemic risk"). 

The code is voluntary, but adherence to it is likely to enable compliance and has benefits in that enforcement by the authorities would then focus on monitoring the developer's adherence to it, rather than wider compliance issues. In light of the current debate around IP rights and model training (for example the recent Getty Images case and the government's consultation on AI and copyright), it is worth noting that: 

• The model documentation form in the transparency chapter has a section entitled "How data was obtained and selected" in which the developer has to include a description of "the methods used to obtain and select training, testing, and validation data" and for data obtained from third parties, "a description of how the provider obtained the rights to the data if not already disclosed".
• The copyright chapter aims to help the developer create the copyright policy which is a requirement of the AI Act – this being a policy to ensure that the developer complies with EU copyright law and which must in particular address how the developer will comply with any rights reservations (that is, opt-outs) made by copyright holders under the EU Digital Single Market Directive. 

Commission seeks experts for AI scientific panel 

The European Commission is looking for independent experts to support the implementation and enforcement of the AI Act. Selected members will form a scientific panel focused on general-purpose AI models and systems, and will advise the AI Office and national authorities on systemic risks, model classification, evaluation methodologies and cross-border market surveillance. It will also inform the AI Office of emerging risks. Applications are open until 14 September 2025. 

Irish DPC fines government department for unlawful use of facial matching technology 

The Irish Data Protection Commission (DPC) has announced a final decision following its inquiry examining the processing of biometric facial templates and the use of facial matching technology by Ireland's Department of Social Protection (DSP). 

highly sensitive personal data, including biometric facial templates. The processing by the AI system was

These processes are a part of "SAFE 2 registration", mandatory for anyone wishing to apply for a Public Services Card, which is required to access various services, including welfare payments. The DPC says that the rollout of this registration has resulted in the ongoing large-scale collection, storage and processing by the DSP of  so extensive that it entailed creating biometric data relating to 70% of the population.

The DPC found that the DSP was in breach of the EU GDPR in failing to: 

• Identify a valid lawful basis for the collection of biometric data in relation to SAFE 2 registration at the time of the inquiry, or for the ongoing retention of the biometric data collected.
• Implement suitably transparent information to data subjects about SAFE 2.
• Include certain details in the data protection impact assessment that it carried out in relation to SAFE 2 registration. 

The DPC reprimanded the DSP, fined it €550,000 and required it to stop processing biometric data in connection with SAFE 2 registration within nine months unless the DSP can identify a valid lawful basis.