UK CMA Publishes Initial Report on Regulation of AI

Background

On 18 September 2023, the Competition and Markets Authority (“CMA”) published its AI Foundation Models: Initial Report ("Initial Report"), which is the product of engagement with over 70 stakeholders and sets out the evidence gathering and analysis work conducted by the CMA to date.

This Initial Report follows the launch of the CMA’s Initial Review in May of this year (see our previous article for additional context) and is the most recent step in the CMA’s explorative work to understand the market for foundation models (“FMs”) and how their use might evolve, with a particular focus on the competition and consumer protection issues that could arise. 

Its publication comes in response to the UK government’s proposals for regulating AI, which place the emphasis on existing regulators to determine the standards that AI systems need to adhere to in the context of their domain and supervisory powers. The Initial Report therefore provides a useful indication of how the CMA is already thinking about regulating AI, and particularly FMs.

Observations from the Initial Report

The Initial Report recognises that transformation in the field of FMs is rapid and ongoing, and that whilst the accompanying impact on competition and consumers is yet to be determined, it will undoubtably be significant.

In particular, the Initial Report focuses on a number of areas:

• Competition and barriers to entry in the development of FMs.  The CMA identifies that previous technology-driven markets have shown that network effects and switching barriers can lead to consolidation, weak competition, and a ‘winner-takes-most’ outcome.  As part of its analysis, the CMA identifies the likely ‘upstream inputs’ required to build FMs, which include data, technical expertise and computing power. 
• A number of ‘key uncertainties’ are identified which could have an adverse impact on competition in the FM sector – e.g. if proprietary data (or large volumes of data) are required to progress or if FMs become larger and increasingly complex, such that it is harder for some, particularly smaller, organisations to compete effectively.  The CMA concludes by identifying that restrictions of access to key inputs would be a ‘concern’ and posits that the market is likely to trend towards positive outcomes if, inter alia, a range of FM developers can access the key inputs required to build FMs and the initially successful FM developers face an ongoing competitive constraint from new entrants.
• The impact FMs will have on competition in other markets.  As part of its analysis, the CMA considered the risks which may arise when FMs are used as inputs in downstream markets – i.e. how businesses might deploy FMs, including in consumer facing applications, products and services.  The impact of vertical integration of FMs – i.e. where one firm develops the FM and also sells the associated product/service incorporating its own FM-generated output on the downstream market – is also considered.  The use of FMs in downstream markets is varied and still evolving – for example, some businesses are using FMs to add new features while are others are deploying FMs to create entirely new services. 
• The CMA again sets out a number of uncertainties in these other markets.  Amongst these concerns are the extent to which downstream firms will continue to have access to a wide range of FM deployment options and have the ability to switch between them and whether consumers will be able to make good choices between FM services or have a preference for FM services to be offered within an integrated ecosystem.  The possible incentives for vertically integrated firms to foreclose downstream competitors is specifically identified as an uncertainty.  The CMA goes on to identify a number of factors likely to produce positive market outcomes, including the ability for downstream businesses to have a range of options, FMs and systems being interoperable with one another and consumers being able to easily port their data between services.
• Consumer protection. The principal issues identified from a consumer protection perspective include false and misleading outputs from FMs and developing sufficient consumer understanding of how FMs work and their potential fragilities.  Notably these areas align with the UK government’s mandatory AI principles of robustness and transparency.
• Particular focus is given to the risks of so called ‘hallucinations’, where an output from the FM appears to be accurate or true but which does not align with real-world knowledge or is wrong based on the context. There is also guidance on the means by which the developers and deployers of FMs can enhance transparency through appropriate disclosures to consumers. The CMA accompanies its commentary on these risk areas with a list of governance measures it recommends organisations should be taking including testing and evaluation of AI systems and watermarking of FM-generated outputs.

CMA’s enforcement toolkit

The assessment of the uncertainties identified, and how the CMA will go about addressing any perceived issues that may develop, are still being considered in further detail.  However, from the CMA’s perspective, these potential challenges will need to be viewed through the lens of its existing (and future) enforcement powers, as well as the broader legal framework in the UK and its application to AI.  The CMA’s current powers can broadly be split as follows:

• Competition law.  Enabling the CMA to enforce prohibitions on anti-competitive agreements and conduct, review mergers to mitigate or prevent significant lessening of competition and investigate the operation of markets.  The CMA will also have new powers once the Digital Markets, Competition and Consumer (“DMCC”) Bill becomes law, including the creation of a new pro-competition regime for digital markets – where certain companies will be designated as having Strategic Market Status (“SMS”), i.e. companies that have “substantial and entrenched market power” and a “position of strategic significance” in relation to a digital activity that the CMA considers to be linked to the UK.  (See our previous article on that development here.)
• Consumer protection law.  Enabling the CMA to enforce legislation to protect consumers against unfair commercial practices and unfair terms.  An example of potential relevance for the deployment of FMs is the extent to which a business sells digital content produced by a third-party FM developer cannot contract out of its statutory obligations under the Consumer Rights Act 2015 by seeking to exclude or restrict a consumer’s statutory rights.  The CMA’s enforcement powers in the consumer realm will also be substantially boosted once the DMCC Bill becomes law. (See our previous article on that development here).

The CMA will only be able to intervene in FM and related markets using these powers, but it will also have a role to play through its interaction with other regulators which have an AI-relevant remit – in particular, when it comes to the shaping of the evolving regulatory landscape in this area.

Recommendations

Coming out of the Initial Report are a set of seven overarching principles which the CMA considers should guide the development and deployment of FMs from a competition and consumer protection perspective.  The first and main principle which underpins all of this is accountability – specifically that FM developers and deployers should be accountable for outputs provided to consumers.

The CMA have created a graphic setting out how all seven of these principles fit together, and we have reproduced this below.

What next?

Following on from the Initial Report, the CMA has begun a significant programme of engagement with a broad range of people and businesses, including consumer groups, leading FM developers, major deployers of FMs as well as innovators, challengers, and other regulators.

The purpose of this additional work is to further develop the principles and support the positive development of FMs and the associated markets in a way that fosters effective competition and consumer protection.  The CMA plans to publish a further update in early 2024.

Notably, the CMA emphasises in the Initial Report that good market outcomes are not contingent on competition alone: it is necessary for other regulators to consider issues including safety, data protection and intellectual property rights. 

However, for those active in the AI space, the Initial Report is a timely reminder to keep competition and consumer law compliance top of the agenda.  The CMA will continue its evolving and collaborative work with industry for the foreseeable future, but it has extensive enforcement powers and will not hesitate to act – indeed the CMA has already warned that “we are ready to intervene where necessary”.

Authored by Christopher Peacock, Dan Whitehead, Angus Coulter, and Eduardo Ustaran.