2024 marked a significant milestone for AI legislative developments worldwide with the introduction of the EU AI Act. As a result, establishing operational AI governance frameworks and AI-focused contracts will be a key task for many businesses and in-house legal teams in 2025.

 The EU AI Act became law on 1 August 2024. While most of the Act will not apply until August 2026, some of its provisions will take effect this year. Businesses should particularly note the following key deadlines in 2025:

- Prohibited AI practices will be banned outright starting 2 February 2025.

- Obligations for “providers” and “deployers” to ensure appropriate AI literacy for their staff (e.g., through regular training or policies) will also take effect on 2 February 2025.

- Rules for providers (mainly developers) regarding general-purpose AI (GPAI) models will apply starting 2 August 2025.

- Penalties (excluding those specific to providers of GPAI models) will apply from 2 August 2025.

It is crucial for businesses within the scope of the AI Act to begin preparations now for the August 2026 deadline and earlier relevant deadlines. Although many AI systems will only be partially subject to the regulation, the Act’s broad territorial scope means UK businesses that provide or use an AI system in the EU may also need to comply. Early preparation is key to achieving compliance.

The AI Act may not be the only EU legislation impacting the provision and use of AI. Progress on the European Commission’s proposed AI Liability Directive, which is intended to complement the AI Act, is expected to become clearer this year. We will closely monitor these developments in 2025.

 Will the UK regulate the use of AI?

 The UK currently lacks specific legislation on AI. However, following the July 2024 election, the new government announced plans to establish legislation for businesses developing the most powerful AI models. It remains to be seen what this legislation will entail.

The government is expected to publish an AI Bill, which will likely be accompanied by a consultation process. This will provide more clarity on the UK’s approach to AI regulation. The AI Bill is anticipated to set out regulatory principles applicable to any business that develops, deploys, or uses AI, potentially covering a broad range of activities. This could significantly impact how AI models are regulated in the UK, but we will need to wait for the Bill’s publication to understand its full implications.

What can businesses do to comply with the EU AI Act or upcoming UK legislation?

Some providers and customers are already incorporating bespoke AI-specific terms into contracts for the supply and purchase of AI systems.

 Providers supplying both the EU and UK markets should revisit their standard terms and conditions in 2025 to prepare for the AI Act’s implementation. This review process will need to be ongoing as the market and authorities adapt to the AI Act.

Suppliers may also begin to insist on more specific restrictions on the use of AI systems. For example, as AI is often trained to perform specific tasks, suppliers may aim to limit liability for misuse. While such restrictions are not new, what will be novel is the applicability of distinct rules to different types of use under the AI Act.

Data protection

The UK Information Commissioner’s Office (ICO) conducted a consultation on AI that closed in September 2024. It is expected to publish its response soon, offering guidance to UK businesses on AI and data protection compliance.

Summary

The regulatory landscape for AI is evolving rapidly. Businesses should begin preparations now to comply with the EU AI Act and remain alert to developments regarding the UK AI Bill. These changes are likely to shape how AI systems are developed, deployed, and used in both the UK and the EU markets.

We will continue to monitor and provide updates on these critical developments to help businesses and in-house legal teams navigate this changing regulatory environment.