Two things happened in Westminster in the same week. On 13 October 2026, OpenAI and Anthropic told a parliamentary session they would support binding UK requirements for the most powerful AI systems, including pre-release testing and mandatory reporting of serious incidents. On 14 October, a government official confirmed that dedicated AI legislation remains undecided, as does whether the AI Security Institute should get statutory testing powers.
So the largest developers are asking to be regulated, and the regulation is not yet drafted. For anyone running a delivery roadmap, that is an awkward place to plan from.
Why the uncertainty is narrower than it looks
The open questions are about enforcement: who has statutory powers, what the penalties are, which systems are in scope. Those matter enormously to frontier labs and comparatively little to a team adding a classifier to a claims workflow.
The questions that are not open are the ones that affect most engineering teams. Every proposal on the table assumes you can produce evidence: what the system was tested against, what it does in production, what happened when it failed. No credible outcome reduces that expectation.
Build for the evidence, not the statute
Version everything that influences an output
Model, prompt, retrieval index, post-processing rules. If a decision from six months ago is challenged, you need to reconstruct the system as it was, not as it is.
Make the failure path explicit
What does the product do when the model is slow, unavailable or returns nonsense? A documented fallback is a compliance artefact as much as an engineering one.
Treat evaluation as a release gate
If evaluation runs after release, it is monitoring. If it blocks a bad release, it is a control. Regulators are interested in controls.
What not to do
Do not pause AI work waiting for clarity. The consultation timelines here are measured in quarters, and the practices that will be required are the same practices that make AI systems maintainable: knowing what is deployed, being able to reproduce it, and noticing when it drifts.
Equally, do not buy a compliance product to solve it. Nothing can be certified against a rule that does not exist yet. What survives any outcome is disciplined engineering.
A reasonable position
Assume you will have to show your working. Build so that showing it is a query rather than an archaeology project. If the rules land lightly, you have a better-run system. If they land hard, you are ready.
That is how we approach AI and machine learning delivery, alongside quality assurance and data and analytics. If you want to review where your systems stand, start a conversation.