Nearly half of public sector leaders not confident of meeting AI legal requirements, law firm research finds
- Details
Nearly half of public sector leaders are not confident or are unsure that their organisations can meet the legal and regulatory requirements for deploying artificial intelligence, with data governance the most cited concern about compliance and accountability, according to research by law firm TLT.
The report, Public Sector AI Perspectives, draws on a May 2026 survey of more than 100 leaders across central government, local government, regulators and blue-light services, together with interviews with organisations including the Government Legal Department, the Metropolitan Police, the Department for Work and Pensions and the Professional Standards Authority.
Gareth Oldale, partner and head of digital, data and commercial at TLT, said the question for public bodies was no longer whether AI had potential but how it could be deployed in a way that was effective, accountable and trusted.
The report identifies five main barriers to adoption:
1. Lack of skills and/or capacity (cited by 45%)
2. Legacy systems
3. Lack of governance and assurance frameworks (34%)
4. Regulatory or legal uncertainty
5. Data quality and integration issues
Only 9% of respondents said they were very confident of meeting legal and regulatory expectations, while 23% were not confident at all and 22% were unsure. Asked about compliance and accountability, 57% named data governance as a concern, followed by explainability of AI decisions (51%), bias and unfair outcomes (44%), legal accountability and liability (44%) and safety and security risks (41%).
When asked to rank their highest-priority AI risks, respondents put cybersecurity and safety first (32%), followed by data quality including data sharing (30%), governance and oversight (26%), legal and regulatory compliance (22%) and lack of transparency in decision-making (22%).
The survey found that only 36% of organisations currently used AI to support operational decisions, but that once AI started to shape prioritisation, risk scoring, resource allocation or case handling, the defensibility burden would rise materially.
Jack Doukov-Eustice, legal director at TLT, said that organisations needed to be able to prove that a use case complied with the relevant legal and regulatory requirements from the outset, and to maintain a credible record of why it was chosen, how bias was assessed and mitigated, what limits were set and how human oversight worked.
The report recommended that for each significant use case organisations document the purpose and intended scope, data sources and controls, bias assessment and mitigation, testing and assurance, explainability, human oversight points, challenge and review routes, and an audit trail and decision record.
On governance, 56% of respondents said governance and approvals were a major cause of delays in implementing new policies or service improvements, and 46% identified complex governance as a barrier to efficiency. Nicola Mead-Batten, partner and head of regulatory at TLT, said the answer was better-designed rather than more governance, operating as a system of triage and escalation rather than a single approval gate, with higher-risk use cases affecting eligibility, enforcement or citizen outcomes receiving stronger legal, data and assurance scrutiny at the outset. Mead-Batten said the central question was "have we built a defensible route to deployment?"
Operational resilience emerged as one of the least mature areas. Only 7% of respondents said their organisation was well prepared to respond to AI-related failures, with 72% not yet mostly or well prepared. Anthony Vittadini, legal director at TLT, said failure readiness should be a precondition for scale and that organisations unable to identify what failure looks like, who owns escalation and when deployment should be paused were not ready to scale.
Melanie Venables, director of policy and communication at the Professional Standards Authority, the UK’s oversight body for the regulation and registration of people working in health and social care, said in the report that it was not yet understood how resilient existing regulatory and governance frameworks were for incorporating AI, and that the core issue was clarity over who was responsible when things went wrong.
Procurement was identified as an early control point, with 57% of organisations expecting to rely heavily on third-party suppliers but 53% reporting limited internal expertise, 48% slow procurement cycles and 47% a lack of AI-specific frameworks. Vanessa Cooper, partner at TLT, said contracts and supplier due diligence should assess explainability, resilience, data handling and accountability, including rights to monitor, challenge, remediate and exit.
The Government Legal Department's Project GRAFO, a prototype system using an open-source large language model to draft statutory instruments, is cited as a case study of staged deployment within a secure environment subject to legal assurance. David Lewis, deputy director of GLD's AI programme, said the department had chosen not to ban public AI tools outright but to focus on responsible use, ensuring staff never input sensitive or confidential information, as a more effective way of combating shadow AI.
Looking ahead, 21% of respondents pointed to agentic AI for autonomous decision-making as a trend likely to shape their operations, but only 22% considered themselves prepared or very prepared for the shift to agentic systems and 4% very prepared. Emma Erskine-Fox, partner at TLT, said boards and legal teams should use today's deployments to build governance disciplines while the stakes remained manageable.
Jobs
Senior Legal Adviser (General Counsel Advice)
Locums
Directory
Events
