Artificial Intelligence Regulation Is About People, Not Machines

Much discussion of AI regulation begins with the machine. Models are classified, risks placed into categories, technical standards devised and new terminology accumulated with impressive speed. For a practising lawyer, however, the most important regulatory questions remain strikingly familiar. Who made the decision? Who supervised the work? Who checked it? Who had authority to use the system? And who answers when the result turns out to be wrong?

Artificial intelligence has certainly created new ways to get old duties wrong. A fabricated authority may now arrive in polished prose rather than from careless research. Confidential material can be placed into a system which the lawyer does not properly understand. A junior can produce substantial work with machine assistance before a supervisor has appreciated how the work was prepared. None of that requires us to invent a new species of professional responsibility. Accuracy, competence, confidentiality, supervision, honesty and duties to the court existed before large language models did.

That is why the developing caselaw on false AI-generated material matters, but not because it establishes that lawyers must avoid AI. The more important point is almost the opposite. Courts have recognised that the technology can be useful. What they have rejected is the proposition that using it changes who is responsible for the result. A lawyer adopting an authority must verify that authority. A supervisor remains responsible for the work which he supervises. A chambers or firm which knows that these tools are readily available cannot sensibly behave as though their use were somebody else’s private hobby.

Verification must also be real. If an AI system proposes an authority, asking it to confirm that the case exists does not turn the system into an independent source. Asking another general-purpose model is little better. The safeguard lies outside the machine: find the judgment, open the statutory provision, read the passage and decide whether it says what the draft claims it says.

The same principle applies to supervision. “Human in the loop” has become one of those phrases which sounds reassuring until one asks what the human actually does. A person who clicks an approval button after glancing at a document is certainly in the loop, in much the same way that a passenger is in an aircraft. That does not mean he is flying it. Proper supervision has to be capable of detecting the type of error which the task may generate. A grammatical rewrite requires one level of scrutiny; a list of authorities for an injunction requires another.

Institutional responsibility follows. An organisation which simply tells everybody not to use AI may discover that it has created shadow AI rather than prevented AI. If useful tools are readily available, some people will use them. The more durable response is to identify approved systems, prohibit particular uses where necessary, train people in the relevant risks and make clear what checking is required. A supervisor cannot supervise a process which everybody has been encouraged to conceal.

There is also a wider regulatory point. Machines make recommendations, but human beings decide whether to give those recommendations power. An automated score matters because somebody decides that it will determine who is interviewed, who is investigated, who receives credit or who is treated as high risk. The apparent objectivity of the machinery can make that human choice less visible, not less important.

For lawyers, then, the central regulatory proposition is remarkably conservative. Technology changes the means by which work is produced; it does not dissolve the obligations attached to adopting it. The machine may be new. Responsibility remains stubbornly old-fashioned.

Revised for the second edition, October 2026.