What Eight Years of GDPR Should Teach Us About Regulating AI

20 Oct

Regulation does not operate itself.

On 14 September the Joint Committee on Human Rights called for a UK AI Bill: a risk-based regime with more demanding obligations for higher-risk systems, prohibitions on some uses, obligations across the lifecycle and the supply chain, prior approval for systems posing a high risk to human rights, and a single oversight body on a statutory basis. Anyone who worked through the data protection programmes of 2017 and 2018 will recognise the architecture. The UK is being asked to legislate for AI in the shape of the GDPR — which makes eight years of GDPR experience a valuable source of insight into what happens inside organisations once the rule is written.

That experience points to one conclusion above the others. Good governance is not something an organisation acquires when regulation arrives. Regulation operates within the governance capability the organisation already has.

The Regulation Is Only the Beginning

The GDPR did not operationalise itself. It required organisations to be accountable, to protect personal data, to assess high-risk processing, to respect individual rights and to build safeguards into the design of systems. Somebody inside each organisation then had to translate those requirements into decisions, responsibilities, processes, controls, evidence and everyday behaviour. The ICO's accountability guidance is explicit on the point: accountability means taking responsibility for compliance and being able to demonstrate it, measures must be reviewed and updated, and none of it is a box-ticking exercise.

That sounds obvious. In practice it was the most consequential lesson of the GDPR years, because the organisations that struggled after May 2018 were rarely the ones that had misunderstood the law. They were the ones whose ability to make and evidence decisions had not changed.

Lesson One: Accountability Must Have an Owner

The GDPR forced organisations to answer questions they had previously left open. Who owns this processing? Who advises, who approves, who handles a breach, who answers the regulator, who keeps the evidence? As the ISO and data protection lead in a technology business at the time, I spent more of 2018 establishing who was entitled to decide than on what the law said. The law was the easier part.

AI reproduces the problem on a wider canvas. Responsibility is dispersed across technology, procurement, data science, risk, legal, business owners, vendors and senior leadership, and a system can be shaping consequential work while no one feels responsible for the whole of the decision around it. Future AI rules will allocate legal duties. The organisation will still have to decide who may approve a use, who can challenge it, who can stop it, and who remains accountable when the technology contributed to the outcome.

Lesson Two: By Design Is Cheaper Than Repair

Data protection by design and by default was the GDPR's most important organisational idea: consider the safeguards from the start and throughout the lifecycle, not at the end. Most DPOs will remember the impact assessment requested after the contract had been signed, or the system that went live with the privacy questions still open. The lesson was learned expensively, and it extends directly to AI. It is easier to decide what evidence a system should leave behind before it is deployed than to reconstruct it after something has gone wrong; easier to establish who may authorise a consequential use before people begin using it informally; easier to define where human intervention is meaningful before a workflow has become dependent on the automation. AI governance cannot be a compliance check placed on top of a finished system.

Lesson Three: Documentation Counts Only When It Describes Reality

The GDPR made documentation visible. The ICO expects records to be meaningful, current and to reflect actual processing. Many organisations produced excellent records of processing in 2018 and did not touch them again. A register that describes last year's organisation is not visibility; a risk assessment completed before a material change is not assurance; a policy that employees routinely work around is not evidence that the behaviour is controlled. The Deloitte finding discussed in my previous article — nearly a third of generative AI users working without their employer's knowledge — is what that last case looks like in practice.

AI will make this harder, because models, vendors, use cases and capabilities change faster than processing activities ever did. The useful question will not be whether the organisation has the document, but whether the evidence still describes what is happening.

Lesson Four: Proportionality, or People Route Around You

The GDPR did not require every processing activity to be treated as equally risky, and the organisations that treated it that way discovered that people learned to route around the process. The same will be true of AI. Treat every use as dangerous and governance becomes an obstacle; treat every use as harmless until a regulator says otherwise and the organisation discovers its exposure after the harm. Good governance is not the maximum amount of control. It is sufficient and proportionate control for the situation, which requires the organisation to be able to tell ordinary, low-consequence uses from those that need deeper scrutiny, stronger evidence, greater human control or more senior authority.

Governance Is Not a Readiness Event

There is also a lesson in what not to repeat. Much of the corporate response to the GDPR was organised around a date. Programmes mobilised for 25 May 2018, produced their documentation, delivered their training, declared the organisation ready and were disbanded. The obligation was ongoing; the programme was not.

The regulatory landscape did not stand still. Guidance evolved, enforcement decisions clarified expectations, and the UK’s data protection framework continued to change.

The Data (Use and Access) Act 2025 introduced changes in stages, with its main data protection provisions taking effect on 5 February 2026, followed by new requirements for handling data protection complaints in June. Meanwhile, the ICO consulted on updated guidance for automated decision-making, with publication expected this winter. A statutory requirement to produce a code of practice on AI and automated decision-making also came into effect in May 2026, with the code expected in 2027.

AI regulation will behave the same way. Whatever framework emerges will sit alongside existing law, sector regulation, standards and contractual obligations, and it will be amended. An organisation that builds for the first version of the rulebook will rebuild repeatedly. The durable capability is the ability to recognise a new authoritative requirement and translate it into responsibilities, controls, decisions and evidence — and to know what would cause an earlier decision to be reconsidered when the system, the supplier or the use changes.

The Rule Lands in an Organisation That Already Makes Decisions

When an AI rule arrives it does not land on a blank sheet. It lands in an organisation with existing authority structures, incentives, suppliers, risk practices, culture and weaknesses. The same legal requirement will therefore produce very different outcomes in two organisations. One knows who owns the decision, what evidence it requires, where meaningful human control exists and what would trigger reconsideration. The other writes a policy and assigns the problem to compliance.

I first made this argument in November 2019, on the 'Mind the Gap' panel at Goode Intelligence's Biometric Summit London, when the gaps in the legal framework for biometrics, rather than generative AI, were the subject under debate. The point has not changed: the organisations that wait for regulation to tell them how to govern are the ones regulation finds unprepared.

For Boards, the practical question is not what an AI Bill might say, but whether the organisation could already demonstrate where AI is used, who authorised it, what evidence supports the decisions it informs, where human judgement remains, and what would prompt reconsideration. If it can, the legislation will simply be another authoritative requirement it is equipped to meet. If it cannot, the legislation is not the problem.

That question is where Mediajem now starts. Our AI & Data Governance Review offers organisations a short, structured assessment of where AI is used, what information it touches, who makes the decisions, what evidence exists and where human judgement must remain. The findings provide a clear starting point for deciding what, if anything, needs further attention.

For organisations requiring a more comprehensive assessment, our AI & Data Governance Gap Analysis & Board Report provides the next step.

Find out more: https://mediajemcompliance.com/ai-data-governance-review