The UK perspective - by Shilpen Savani
The AI landscape has changed at unprecedented pace in 2026. A year ago, the UK's approach was one of deliberate restraint, with the government's AI Opportunities Action Plan setting out an ambitious growth agenda and Prime Minister Starmer framing the UK's position as one of seizing opportunities rather than over-regulating. The international context raises the stakes: President Trump's decision on his first day back in office to revoke the Biden administration's Executive Order on AI signals a decisive shift towards a market-led, largely unregulated environment in the United States, while the EU has moved firmly in the opposite direction. Twelve months on, these divergences cannot be ignored by any business operating across borders.
Crucially, the EU AI Act is now in force and its significance for UK businesses comes down to one straightforward reality: market access. The EU remains the UK's largest trading partner and the Act follows the same extraterritorial logic that made GDPR a global compliance standard. Under Article 2, any provider or deployer of AI systems whose output is used in the EU falls within scope regardless of where they are established - expressly including third-country providers. A UK business whose AI system is used by EU customers, integrated into EU-regulated processes, or deployed by an EU-based subsidiary must comply because the EU demands it as a condition of doing business in the bloc.
The UK's own legislative picture remains unresolved. The Artificial Intelligence (Regulation) Bill, which proposed a statutory AI Authority and mandatory impact assessments, was not government-backed and has not progressed. The government's preference remains for existing sectoral regulators to apply five core principles: safety and security; transparency and explainability; fairness; accountability and governance; and contestability. In principle this is sensible, but in practice, it leaves businesses navigating a fragmented and fast-developing landscape without a map.
As Saisunder N.V. addresses, this extraterritorial reality extends beyond UK businesses. Indian businesses expanding into the EU, or servicing UK clients with EU operations, face the same compliance obligation under the AI Act regardless of where they are based.
Despite the absence of primary AI legislation, the UK's practical environment is shifting rapidly. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 place the ICO under a statutory obligation to produce a code of practice on AI and automated decision-making. Simultaneously, the Data (Use and Access) Act 2025 has replaced the former Article 22 UK GDPR framework with a new regime, redefining when a decision is ‘solely automated’ for the purposes of the enhanced safeguards that must be applied. The Employment Rights Act 2025, which will reduce the qualifying period for unfair dismissal from two years to six months, brings AI-assisted hiring, disciplinary and redundancy decisions squarely within statutory scrutiny.
On intellectual property, the government consulted on expanding text and data mining exceptions to permit AI training on copyright-protected works, then stepped back under creative industry pressure. The position remains unresolved, with no legislative clarity on whether training an AI model on copyright-protected content without a licence is lawful under UK law.
Businesses operating across the UK, EU and other jurisdictions face a growing patchwork of obligations with no domestic anchor for their compliance. There is also an equivalence risk: the UK's data adequacy status with the EU depends on ongoing alignment with EU data governance standards.
If your business has EU exposure, map your AI systems against the EU AI Act's risk tiers now. Do not wait for domestic legislation. Audit your AI vendor contracts, because liability allocation, data processing terms and IP indemnities are frequently underdeveloped in standard terms. Finally, build governance structures that can flex, because this landscape will keep evolving at a blistering pace.
The Indian perspective - by N V Saisunder
The extraterritorial logic described by Shilpen Savani has a clear Indian counterpart. To the extent that an AI service provider processes the personal data of individuals in India, the Digital Personal Data Protection Act, 2023 (DPDPA) applies wherever that processing relates to the offering of goods or services to individuals within India, regardless of where the provider is established.
India's approach to AI stands in deliberate contrast to its treatment of personal data. Like the UK, India has no dedicated AI statute and governs the technology through existing legislation. Two enactments carry the substantive burden: the Information Technology Act, 2000 (IT Act), which addresses the platform and content dimension, and the DPDPA, which governs personal data and is constructed around consent.
The DPDPA permits non-consensual processing only within a closed list of ‘legitimate uses’, among them employment, state benefits, medical emergencies and public health and contains no open ‘legitimate interests’ ground. Critically for AI developers, none extends to the training of an AI model, so consent remains the operative basis even where the underlying data is publicly available. Entities processing personal data at scale assume heightened obligations, including impact assessments, independent audits and reporting to the newly constituted Data Protection Board.
Under the IT Act, the position turns on Section 79, which confers conditional ‘safe harbour’ on intermediaries, an immunity from liability for third-party content they host, provided they observe prescribed due-diligence obligations. Generative AI fits uneasily within that scheme, as a system that produces original, synthesised output is not merely hosting content created by others. Rather than enact a specific AI statute, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 brought synthetically generated information within intermediaries' due-diligence duties, requiring it to be labelled and tagged with metadata and putting safe harbour at risk where a platform knowingly permits unlawful synthetic content. However, this strategy regulates AI by treating the platforms that generate it as intermediaries, when it is contestable whether a generative-AI system is an intermediary at all.
In the absence of legislative clarity, the question has fallen to the courts and an AI jurisprudence is slowly beginning to take shape. In IndiaMart Intermesh Ltd v. OpenAI Inc (Calcutta High Court, May 2026), the Court considered this question at the interim stage, taking the prima facie view that ChatGPT is an ‘originator’ rather than an ‘intermediary’ under the IT Act, while leaving the point to be decided finally at trial and noting that a statute drafted before generative AI will ultimately require legislative, not merely administrative, intervention. In ANI Media Pvt Ltd v. OpenAI OpCo LLC, the Delhi High Court has reserved judgment on whether training a model on copyrighted news content infringes the Copyright Act, 1957, the first substantive test of AI training data before an Indian court. Although neither decision is final, they mark the beginning of a judicial answer to questions the legislature is yet to address.
For foreign businesses, two further points are worth noting. First, India places no AI-specific restriction on foreign investment and the DPDPA's approach to cross-border data transfer is markedly more permissive than the EU's adequacy-based model. Second, for multinationals running AI development, training or data annotation operations through Indian subsidiaries or delivery centres, the unresolved copyright position illustrated by the ANI Media litigation means that contracts governing the use of India-sourced or India-processed training data should expressly allocate IP risk, rather than assume the position is settled.
The lesson from India is the same as in the UK: do not wait for dedicated AI legislation. Agreements should expressly address liability, data-processing terms and IP indemnities under Indian law, consent practices should be tested against the DPDPA and governance should be built to accommodate change.
Regulate, innovate, or both? A shared answer:
From London to Chennai, the regulatory picture shares the same essential shape: AI is transforming business faster than legislators can respond and businesses cannot afford to wait for the law to catch up.
Although the UK and India have approached AI regulation from different starting points and have so far favoured adapting existing legal frameworks rather than introducing dedicated AI legislation, both face the same reality that the EU AI Act is increasingly operating as a global compliance benchmark for organisations with European exposure.
The common challenge is how to govern a fast-evolving technology that is already deeply embedded in commercial and employment relationships. For businesses operating across both jurisdictions, the message is clear: AI governance should not be viewed as a compliance exercise triggered by legislation. Build it now, build it proportionately and build it to be flexible. In AI regulation, as in AI itself, the ability to adapt is the most valuable capability of all.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
