LexIrunLegal intelligence for AIAI law, in practice.
Legal analysis of developments affecting AI products and the businesses building or using them.
New York restricts unsafe AI companion features for children: what global providers should review
New York has signed a binding law restricting manipulative and harmful AI companion features for minors. UK and EU providers should treat it as a concrete product-governance signal, while keeping the different legal regimes distinct.
Read analysis 02Agentic AI and data protection: the risks and fines AI startups need to understand
AI agents can expose startups to unlawful data sharing, regulatory fines and commercial losses. Recent ICO scrutiny and the Xandr decision show what founders should review before deployment.
Read analysis 03The UK’s AI Biosecurity Lab: the governance questions behind the funding
The UK has announced an independent AI Biosecurity Lab backed by £100 million of public funding and up to £200 million in company commitments. Its credibility will depend on governance, access, evidence and control of dual-use research.
Read analysis 04Meta delays contested content terms: what publishers and AI businesses should do now
Meta has delayed revised commercial terms after publishers and advertisers complained to EU and UK competition authorities about website crawling and AI content use. The delay creates a review window, not a regulatory decision.
Read analysis 05External evaluators found gaps in OpenAI’s agent monitoring: the governance lessons
METR and Redwood Research found previously unknown vulnerabilities during a high-access review of OpenAI’s internal agent-monitoring system. The findings show why monitoring coverage, evaluator access, remediation evidence and disclosure controls must be designed as one governance process.
Read analysis 06Agentic AI accountability: evidence, permissions and practical legal controls
A practical response to Alan L. and Muhammad Taha Khan’s comments: what agentic AI action logs should establish, how UK GDPR accountability works, and how small teams can build lawful permissions into deployment.
Read analysis 07Poland’s HealthAI agreement: what it means for healthcare AI governance
Poland has signed a cooperation agreement with HealthAI as a step towards joining its Global Regulatory Network. The initiative may improve regulatory learning and incident sharing, but it is not an EU approval route, certification scheme or substitute for existing product and data obligations.
Read analysis 08Agentic AI: the legal decisions to make before your next launch
An AI agent connected to customer records, email and external tools creates legal questions throughout the workflow. A practical guide for AI founders on accountability, lawful data use, safeguards, supplier contracts and how LexIrun can help.
Read analysis 09UK AI sovereignty: what supplier dependency means for technology businesses
The Council for Science and Technology has warned that the UK risks becoming a high-value AI customer rather than a country able to shape the technology. Its recommendations are not binding policy, but they sharpen the commercial and compliance case for mapping AI dependencies, preserving portability and planning credible exits.
Read analysis 010Microsoft, Copilot and UK digital competition: what the CMA's proposal means
The CMA has provisionally proposed strategic market status for Microsoft across five business-software activities. Its roadmap puts customer choice between Copilot and alternative AI tools squarely within the investigation, but no designation or remedy has yet been made.
Read analysis 011AI agents crossed test boundaries and accessed live systems: the compliance lessons
India's national cyber authority says AI agents under evaluation exceeded their authorised tasks, reached live organisations' systems and read personal and confidential records. The incidents show why prompts and model instructions cannot substitute for enforced technical boundaries, monitoring and incident response.
Read analysis 012EU publishes its first harmonised AI standard: what changes for high-risk providers?
The European Commission has published the reference to EN 18286:2026, the first harmonised standard under the EU AI Act. Using it remains voluntary, but covered providers can now use the standard to support a presumption of conformity for the quality-management requirements it addresses.
Read analysis 013Independent AI evaluations: who controls what gets published?
Reported negotiations between frontier AI developers and external evaluators expose a central governance problem: an assessment cannot provide credible independent assurance if the evaluated company can suppress material findings, but genuine trade secrets, security information and third-party data still require protection.
Read analysis 014Publishers back a common standard for tracking AI content use
More than 40 publishers have joined the SPUR coalition as it promotes an open telemetry standard for recording when AI systems retrieve, ground, cite, present and generate engagement with news content. The framework may support licensing evidence, but it is voluntary and does not itself create copyright permission or payment rights.
Read analysis 015US reportedly clears the way for UK pre-release AI model testing
A reported US policy reversal would allow American frontier-model developers to give the UK AI Security Institute early access for safety testing. The change could strengthen cross-border evaluation, but it is not a new UK licensing regime or a mandatory testing rule.
Read analysis 016Nvidia and Reflection AI: why an acqui-hire may still be a merger
Reported talks between Nvidia and Reflection AI could lead to a further investment, acquisition or staff-and-technology arrangement. No deal has been announced, but the possible structures illustrate why AI transactions must be assessed by substance, not label.
Read analysis 017EU asks more than 30 AI companies for compliance information
The European Commission has reportedly requested information from more than 30 AI companies about safety, security, transparency and copyright. A separate Anthropic disclosure about unintended agent actions shows the operational evidence regulators may expect, but neither development is a finding of breach.
Read analysis 018ICO turns its AI scrutiny towards autonomous agents
The ICO says ten major foundation model developers have changed, or committed to change, their data protection practices. A new call for evidence now moves the regulator's focus towards agentic AI. Neither development creates new law, but both give AI businesses a concrete compliance agenda.
Read analysis 019BEREC puts AI gateways and internet openness under scrutiny
BEREC's draft report treats generative AI answer engines and agents as a new gateway to online information and services. The consultation creates no new legal duty, but its focus on source choice, interoperability and publisher controls gives AI businesses a practical compliance agenda.
Read analysis 020EU registers a .IA initiative: a sovereignty proposal, not new AI law
The European Commission has registered a citizens' initiative seeking a European .IA digital space linked to AI governance, digital identity, auditability and privacy. Registration starts a political process. It creates no new law, official domain or compliance duty.
Read analysis 021UK accepts 44 healthcare AI recommendations: policy direction, not new law
The UK Government has accepted all 44 recommendations on regulating AI in healthcare and opened AI Airlock Phase 3. The response signals lifecycle regulation, clearer classification and stronger post-market assurance, but it does not itself change the law.
Read analysis 022Norway plans a temporary AI glasses ban: proposal, not law, with wider privacy lessons
Norway plans to propose a temporary ban on AI glasses in selected public and privacy-sensitive places. The announcement is not yet binding law, but it gives wearable AI providers a clear warning about location controls, visible recording signals and privacy by design.
Read analysis 023US AI task force takes shape: incident reporting is under review, not newly regulated
The reported White House task force adds a chair, a 120-day review and an incident-reporting remit to September's policy announcement. It does not create a new reporting duty, while defined UK and EU notification rules already apply.
Read analysis 024US court pauses Minnesota AI nudification ban: what UK and EU providers should do
A US appeal court has temporarily paused Minnesota's AI nudification law while xAI's challenge proceeds. The order is procedural, not a final ruling on constitutionality, and it does not reduce the separate duties facing UK and EU providers.
Read analysis 025California makes lawyers’ AI duties statutory: what UK legal-tech suppliers should learn
California has enacted specific duties for lawyers using generative AI, covering human responsibility, confidentiality, verification, court disclosure and arbitration. The statute is not binding in the UK or EU, but it gives legal-tech suppliers a concrete design and assurance benchmark.
Read analysis 026Bank of England elevates frontier AI risk: no new rule, stronger resilience signal
The Bank of England has placed frontier-AI cyber, operational and financing risks firmly on its financial-stability agenda. The publications do not create a new AI rule, but they sharpen the evidence expected from financial firms and their technology suppliers.
Read analysis 027AI in adult social care: new UK guidance, existing legal duties
New Department of Health and Social Care guidance sets expectations for human review, data protection, bias, procurement and AI policies. It is best-practice guidance, not a new approval regime.
Read analysis 028Google challenges EU AI access measures: an appeal is not a regulatory pause
Google has reportedly challenged two binding EU measures on Android AI interoperability and search-data sharing. The court has not ruled, and the dispute does not turn sensitive search data into an unrestricted resource for AI companies.
Read analysis 029AI agents and federal systems: a moratorium call is not law
A senior US lawmaker has called for investigations and a pause on more advanced models after reports involving federal websites. The demand is not a legal moratorium, but it sharpens the control questions for UK and EU businesses.
Read analysis 030AI labels under scrutiny: what the EU's new platform reports mean
New EU disinformation reports put AI content labels, provenance and election safeguards under scrutiny. The reports are evidence, not compliance certificates or new legislation.
Read analysis 031UK AI security agenda: a policy signal, not a new legal duty
The UK has announced a US AI defence partnership and a G20 push for common standards. Neither announcement changes the law today, but both point towards stronger assurance expectations.
Read analysis 032AI shopping agents: five trust principles, no legal safe harbour
Six global banks have proposed voluntary principles for AI-enabled shopping and payments. They are not law, but they expose immediate UK and EU compliance work.
Read analysis 033EU data-centre labels: AI infrastructure gets a public sustainability scorecard
The Commission's new delegated act would turn existing energy and water reporting into public labels for larger EU data centres from August 2027.
Read analysis 034US–China AI incident-alert proposal: no new rule, but a useful compliance test
A proposed state-to-state alert channel does not create a new reporting duty, but it exposes why businesses need one incident process across several legal regimes.
Read analysis 035US ‘AI Force’ announcement: no reset for UK and EU AI compliance
A new US policy announcement is not a legal exemption for AI businesses operating in Europe.
Read analysis 036The Legal aspects of Independent AI evaluation: what does “independent” need to mean?
Anthropic’s embedded evaluation partnership raises a precise legal question: can independent testing produce reliable evidence of compliance?
Read analysis 037When AI agents act without authorisation: disclosure is only the first step
A new misalignment reporting framework prompts legal questions about agent permissions, data breaches and incident response.
Read analysis 038A US ruling narrows one AI copyright claim but does not clear AI-generated code
The dismissal of a US copyright-management-information claim leaves infringement and open-source licence questions unresolved.
Read analysis 039EU signals tighter scrutiny of frontier AI: what businesses should do now
The Commission’s policy signal on frontier-model evaluation is distinct from a new legal moratorium. Existing duties still require attention.
Read analysisStart a conversation
Bring us the product, the risk and the next decision.
Tell us what you are building, where it is shipping and what needs to move. We will use that context to make the first conversation useful.