Recommendation 56

The new oversight body should: a. have the power to facilitate co-ordination with other national regulators in relation to monitoring, investigation and enforcement, knowledge sharing, and capacity building b. make regular reports on its activities to Parliament, identifying opportunities to fill emerging gaps in protection and highlighting trends and sectoral developments in best practice c. have a statutory duty to maintain a public repository of AI incidents and proactively identify patterns of reported harm and any emerging systemic threats, and to consider cases for further investigation d. have the power to publish mandatory codes of practice for the responsible use of AI in the private and public sector, and to sanction developers, deployers and other actors who do not fulfil their responsibilities under these codes of practice e. have the powers necessary to implement and enforce the provisions of the AI Bill we recommend, including: i. to carry out testing and evaluation of AI systems, including powers to implement a prior testing, auditing and evaluation regime for high-risk uses and applications of AI ii. to prohibit AI models or systems from being launched or deployed, and to order their withdrawal from the market if unacceptable risks to human rights are identified 82 iii. to issue codes of practice which would provide greater specificity concerning the due diligence obligations which must be complied with (for example, requiring high risk AI providers to establish and maintain a risk management system, to ensure that practical and acceptable complaints mechanisms are in place and so forth), and to receive reports if certain types of risk are identified iv. to conduct investigations of allegations concerning breaches of the statutory prohibitions and mandatory codes of conduct, including allegations that AI systems have caused harm to human rights v. to sanction actors who fail to comply with mandatory codes of practice vi. to order that remedies be provided as appropriate in individual cases without requiring the affected individuals to incur prohibitive costs vii. to prescribe transparency requirements through its codes of practice, identifying the information actors at each stage of the AI lifecycle must disclose and to whom, including other actors along the AI lifecycle and public sector AI deployers viii. where actors in the AI supply chain are located outside the UK, to be able to assess the risks of deploying their systems in the UK, having regard to how those actors are regulated in their home state. If the new AI oversight body considers that deployment in the UK would give rise to unacceptable risks which could not be addressed within the UK, the oversight body should be able to limit or prohibit such deployment. (Recommendation, Paragraph 227)