Recently, the UK Parliament’s Joint Committee on Human Rights (JCHR) published ‘Human Rights and the Regulation of AI’. Its headline recommendations are clear: a dedicated Artificial Intelligence (AI) bill, a single statutory AI oversight body, prior approval for high-risk systems, outright prohibition of certain uses, and stronger safeguards on automated decision-making under the UK General Data Protection Regulation (GDPR).

The report is a strong rights-based policy diagnosis. Its recommendations, however, are more persuasive as a framework for legislative debate than as a fully costed implementation plan. That distinction matters to anyone who must translate parliamentary recommendations into board decisions, compliance programmes, or regulatory design. 

This article examines what the report gets right, where it falls short, and what it should be read alongside.

The inquiry and its context

The report emerges within a UK policy landscape that has largely favoured regulating AI through existing sectoral regulators rather than dedicated AI legislation. 

With the proposed AI bill yet to materialise and the UK having signed but not ratified the Council of Europe Framework Convention on AI and Human Rights, Democracy, and the Rule of Law – the first legally binding international instrument of its kind – the committee concludes that existing regulatory frameworks remain inadequate to prevent or remedy AI-related human rights harms. 

More broadly, it argues that no jurisdiction, including the UK, has yet established a sufficiently comprehensive and fit-for-purpose framework for protecting human rights in the age of AI.

Breadth across the lifecycle and supply chain

The report’s principal strength is breadth. The committee examined AI across the whole lifecycle – data collection, model development, deployment, monitoring, and retirement – rather than treating AI as a product that appears fully formed at the point of use.

More importantly, it links technical risk to the structure of modern AI supply chains. Responsibility in these chains is distributed among developers, providers, and deployers, and the party best placed to identify a risk is often not the party that faces legal liability for it. A model trained on biased data by one firm, licensed through a platform operated by a second, and deployed in a hiring tool by a third, presents exactly this problem. 

A substantial consultative foundation

The inquiry rests on more than 70 written submissions and 10 oral evidence sessions, drawing on academics, civil society, regulators, technology firms, and government. This gives the report a range of perspectives that a narrower inquiry would lack. 

It does not treat AI regulation as merely a technology question or a data protection question, but as a question of how legal rights are protected when decisions are increasingly mediated by systems that few people can inspect.

Connecting abstract risk to recognisable rights

Much AI policy writing operates at a level of abstraction on ‘fairness,’ ‘trust,’ and ‘safety’ that is difficult to act upon. The report avoids this by anchoring its analysis in three concrete concerns: discrimination, privacy, and access to an effective remedy.

It then traces how familiar features of AI systems undermine each:

• Opacity makes discriminatory outcomes difficult to detect, let alone prove.
• Biased training data embeds historical patterns of disadvantage into prospective decisions.
• Intrusive data collection erodes privacy at a scale that individual consent mechanisms cannot meaningfully govern.
• Undisclosed automated decisions deny people the knowledge they need to challenge an outcome at all.

The third right, effective remedy, is the thread that ties the analysis together. A right that cannot be enforced because the affected person never learns that AI was involved is, in practice, no right at all. This is why the report treats transparency not as a desirable feature but as a precondition for every other protection.

The ‘human in the loop’ problem

The report’s strongest analytical insight concerns meaningful human oversight. The mere presence of a human reviewer does not provide effective protection if that person lacks the information, authority, time, or competence to understand, question, and override an AI-generated decision. 

A caseworker processing hundreds of algorithmic recommendations under performance pressures may simply legitimise a machine decision rather than exercise independent judgement. 

The committee therefore recommends clarifying under the UK GDPR that human involvement must be substantive rather than nominal. For AI governance practitioners, this is a highly transferable principle: organisations should test whether human reviewers can genuinely challenge and depart from AI recommendations, and whether, in practice, they actually do so.

A coherent regulatory architecture

The proposed response hangs together. It comprises:

1. Risk-tiered obligations, with more demanding requirements for higher-risk systems and models
2. Prohibition of uses incompatible with human rights, with subliminal techniques, emotional inference, and inappropriate use of profiling or biometric data cited as candidates, subject to public consultation
3. Upstream responsibility, placing obligations on developers and providers rather than deployers alone
4. Mandatory transparency across the lifecycle
5. Prior approval before high-risk systems can be provided or deployed
6. Stronger automated decision-making safeguards under the UK GDPR
7. Statutory oversight through an independent body with powers to monitor harms and hold providers to account

Each element addresses a gap the report has identified. 

An evidence base that is broad but primarily consultative

The report sometimes moves from documented examples and witness concerns to general conclusions about AI systems as a whole. That is a defensible approach for precautionary policy – waiting for comprehensive harm data may mean waiting until harm is widespread. But the argument would be considerably stronger with the following:

• Systematic incident data on the prevalence and distribution of AI-related harms
• Comparative evaluation of how existing regulators are performing within their current remits
• Quantified compliance costs, particularly for smaller firms
• Evidence on false positive and false negative rates in the systems of greatest concern

Without these, the report is better at establishing that intervention is warranted than at establishing which interventions, and at what intensity.

Institutional design risk

The proposed statutory oversight body is the report’s most consequential recommendation and its most exposed. Such a body could provide a single channel for complaints, coordinate existing regulators, and identify systemic incidents that no sectoral regulator would see in isolation.

Yet the report itself records the counterarguments: that a new regulator might duplicate the work of existing bodies, generate inconsistent rules, or impose disproportionate burdens on smaller firms. These concerns are acknowledged rather than resolved. 

Unresolved operational questions

The recommendation to combine broad statutory principles with adaptable codes of practice is sensible; it allows the regime to keep pace with the technology without constant primary legislation. But flexibility defers difficult design choices rather than making them. At least four remain open:

• Who classifies risk? Self-classification by providers invites under-classification; regulatory classification requires substantial capacity and technical expertise.
• How is prior approval resourced? Pre-market approval for high-risk systems is a significant administrative undertaking. Without adequate funding and clear timelines, it becomes either a bottleneck or a formality.
• How are trade secrets reconciled with meaningful explanation? The report’s emphasis on transparency is well founded, but providers will resist disclosure of model architecture and training data. The mechanism for protecting legitimate commercial confidentiality while still giving affected people an explanation they can act upon is not specified.
• How is responsibility divided across international supply chains? Much of the foundational model development relevant to UK deployers occurs outside the UK. Upstream obligations are only as effective as the regulator’s reach over upstream actors.

Deliberate omissions

The inquiry consciously gave limited treatment to intellectual property, performers’ rights, and the effects of AI on the justice system. Risks associated with artificial general intelligence attracted competing views from witnesses but no detailed policy analysis.

Assessment: Diagnosis versus implementation

The report’s greatest value is diagnostic and normative. It explains convincingly why deployment-only, sector by sector regulation can miss the upstream causes of harm, and why transparency is a precondition for any meaningful remedy. On these points it is persuasive, well evidenced, and likely to shape debate for some time.

Its main weakness is operational. It identifies what a rights-respecting regime should achieve more clearly than it demonstrates how the UK could implement that regime proportionately, measure its success, and avoid regulatory overlap. This is not unusual for a parliamentary committee report – committees are better placed to set direction than to design agencies – but it means the report should not be mistaken for a blueprint.

If the report is to serve as the foundation for an AI bill, it should be supplemented by:

1. Technical impact assessments of the systems most likely to be classified as high risk, establishing error rates, failure modes, and the practical feasibility of the proposed controls
2. Economic analysis of compliance costs across firm sizes and of the costs of inaction
3. Clearer prioritisation of prohibited uses, moving from illustrative candidates to defined categories with tested boundaries
4. An evidence-based design for institutional powers, specifying how a new oversight body would interact with existing regulators, what powers it would hold exclusively, and how accountability would be measured

Implications for practitioners beyond the UK

Although ‘Human Rights and the Regulation of AI’ is directed primarily at the UK context, its analysis has wider relevance, particularly in jurisdictions where AI-specific legislation remains developing and organisations often rely on existing laws. Three practical lessons are immediately applicable:

• Human oversight must be demonstrably effective, with reviewers able to understand, challenge, and override AI outputs
• AI supply chains must be mapped, with contractual arrangements addressing information and accountability gaps between developers, providers, and deployers
• Transparency should be treated as essential remedy infrastructure, because meaningful disclosure of AI use enables individuals to understand, challenge, and seek redress for automated decisions

Overall, the report provides a strong foundation for rights-based AI governance, while highlighting the need for further evidence, institutional mechanisms, and practical safeguards to translate broad regulatory principles into proportionate and workable protections.

(The writer is an AI governance professional and lawyer)

(The views and opinions expressed in this article are those of the writer and do not necessarily reflect the official position of this publication)