An AI Bill is what a committee of both Houses asked the government for on 14 September, and the part worth your attention is not the headline. The Joint Committee on Human Rights took evidence across ten oral sessions and more than seventy written submissions, and it reports that the law as it stands falls on the organisation using an AI system rather than the one that built it. Ministers have two months to reply. I read the recommendations as a firm owner rather than as a constitutional question, and two of them describe the position your practice is already in.
Where the law lands today
The finding at paragraph 104 is blunt. Existing UK laws that apply to AI systems do so mainly at the point of deployment, so deployers are the primary holders of responsibility for the harm those systems cause. The committee adds that this aims the law at the wrong party, because the design choices that create the trouble are made further up the chain and are rarely explained to the buyer.
Louise Hooper of Garden Court Chambers put it to the committee in terms any managing partner will recognise. It is not appropriate, she said, for deployers of AI systems to bear the burden of risks created upstream, which they may not properly understand because they have not been explained properly. The report goes on to record that developers further up the chain escape responsibility by writing exclusions into their contracts with the firms that buy from them. Your practice is a deployer, and that sentence describes your supplier agreement.
Why a human check stops working
The second recommendation to read closely sits at paragraph 218 and concerns automated decisions. The committee wants regulations made under the UK GDPR to state that the mere presence of a human in the loop is not enough to count as meaningful human involvement. The reviewer has to be sufficiently informed and independent to reach an objective view that has not been improperly influenced by the automated output. The person affected has to be told about their own circumstances rather than the general workings of the system, and told enough to mount an effective challenge.
Firms reach for the phrase a human reviews everything when a client asks what the software does. The committee has set out what that phrase has to mean before it carries any weight, and a reviewer who sees a score without the reasons behind it fails the test. The same standard is heading towards your clients who screen staff, check tenants or decide credit, and they will ask you what it asks of them.
What to do before the government replies
None of this is law, and nothing in the report moves your obligations this week. What it moves is the direction, and three pieces of work sit better done now than in a hurry later. Take the contract for every AI tool the firm pays for and read what the supplier excludes, because that clause is the whole of your protection until Parliament acts. Write down every place where a machine touches a decision about a person, whether that person is a client, a candidate or a member of staff, since nobody governs what nobody has listed. Then make the human step real by naming who performs it, what they see when they perform it, and what they are permitted to overturn.
Where this goes next
The committee wants more than a Bill. It asks for an independent oversight body on a statutory footing with the power to test systems before release, to order withdrawal where the risk to rights is unacceptable, and to direct remedies without the affected person facing prohibitive cost. It asks for prior approval of high-risk uses, for prohibitions on the uses it treats as incompatible with rights, and for a published timetable for ratifying the Council of Europe Framework Convention on AI. It says in the same breath that legislation should not place unjustified burdens on business, and it names smaller firms as the ones to protect.
A Bill was promised in the King's Speech of 2024 and has not appeared. The government now has two months to say whether it accepts the case for one. Watch the reply rather than the report, because the reply tells you whether the exclusion clause in your supplier contract is a problem for this year or the next.
The report, Human Rights and the Regulation of AI, is the committee's fourth of the session and carries the numbers HC 160 and HL Paper 56. It is open to any reader at the parliamentary publications site.
If you want the exclusion clauses in your AI contracts read by someone who has sat on both sides of that decision, start with a conversation.