“Should we wait and see what the legislation does?” If you’ve signed off an AI budget this year, or declined to, that question’s been asked. It’s mid-October 2026 and it’s still coming up, and to be fair, it’s still a reasonable one. A lot of industries are looking for a UK decision to align to, well, spoiler alert, there still isn’t one. There’s a promise of one that keeps slipping, and a promise is a hard thing to hang your pilot on.
September 2026 didn’t help. Parliament’s human rights committee published a report asking the government for a dedicated AI bill and a single regulator to sit behind it. A Leeds MP had a bill read for the first time in September that would ban superintelligence outright. And the one bill that did try to regulate AI in the round, Lord Holmes’s, sits on the parliamentary record at first reading from March last year and hasn’t come back this session. So any board reading all of that, does the obvious thing, and shelves the opportunity. The procurement team sits hesitant, the AI team file another report, and so…progress is halted, not just in the government but across the commercial landscape, as well.
So, in this article, I want to make the case for the other route. The case is for building now, on good and ethical interpretation, with the law still coming in some shape, so that, when the rules are found and cemented in, you’re already on the right road.
Car before roads
There’s an analogy I use whenever this comes up across a table. We’re inventing the car for the first time. You cannot build the roads before you’ve built a functional car, and the roads here are everything: the infrastructure, the legislation, the regulation, the interpretation and simplification of how this thing handles operational infrastructure. All of that gets created after the car exists, because nobody knows how it handles any of this, until it does. The laws and regulations ‘have to’ happen after.
Which means if you stick around and wait for the roads to be made, you miss the greatest opportunity there is, which is to traverse the ground now and prepare yourself for faster travel when the roads do settle in.
I don’t think anyone should stop wanting AI laws, restrictions or regulation. I want them. I do think the rules and regulations will be found, provided we work from a foundational structure of good and ethical interpretation while we wait. That’s a different position from “stop waiting for the AI law”, which is the line doing the rounds. The first says the law doesn’t matter, and the second says the law is downstream of what we do now, which is a much more useful place to stand.
And there’s a second reason to keep moving, which the Holmes bill demonstrates purely by accident. The landscape is changing so quickly that what was written a year ago doesn’t stand up at all now. A bill drafted in early 2025 was describing a different set of models, a different set of use cases and a different set of risks. Any statute that does eventually land will have the same problem on the day it’s passed, and the people best placed to work inside it, will be the ones who’ve been interpreting well without it.
The ban isn’t the bill you’re looking for
I think it’s the ambiguity of AI doing the work here. The Leeds bill is a ban on superintelligence. Its long title is to prohibit the development, deployment and operation of artificial superintelligence systems, it’s a private member’s bill with a second reading in November, and it’s about the generation of superintelligent models. These are two completely different things, wearing the same two letters. It’s also, and I say this gently, easier to condemn AI usage than it is to make a change and adapt something new. A ban is a clean sentence and adaptation is a year of decisions, so I understand why one gets tabled and the other gets deferred. I’d still rather you were doing the second.
The bodies you already answer to
So what do you build on while the roads aren’t there? For me, the bodies are there, and they’re the same ones we already answer to: ethical, moral and legally right ways of using and integrating AI, and if you translate those forward you still have the same bias controls and the same ethical controls you can use to make sure the foundations of an AI-first or AI-native company hold true.
Let me make that concrete with my own corner. As an agency and production adviser I sit very close to the ASA, the FCA, Ofcom and the BCAP code. All of those rules were originally written for television and radio broadcast, pre-watershed and post-watershed. Then they were rewritten for digital, because we no longer watch content on the broadcaster’s timeline. We watch it when we want, on streaming, and so on a streaming service the idea of pre- and post-watershed doesn’t exist any more. The rule changed shape, and the principle underneath it, that you don’t put certain things in front of certain audiences, didn’t move at all.
That’s the model for AI. Adapt the implications and you can still work on the understanding that deepfaking for nefarious purposes is wrong, disingenuous activities are still inauthentic and wrong. That doesn’t mean the technology wrapped around it is bad; the ability to deepfake, digital twinning, the representation of human likeness, isn’t warranted in certain cases, it’s how you use it. There are many bad actors who’ll take AI and amplify it for negativity, and there are many who’ll take AI and amplify it for good. A gun in the wrong hands is as dangerous as AI in the wrong hands, and a gun in the right hands is as benign as AI in the right hands.
So, plenty to do. There’s a lot you can build without risk to the brand and without risk of regulation or legislation landing on the enterprise, and none of it requires you to unlock all of the doors and let AI in everywhere at once. The regulators you already report to haven’t waited for a statute either. Ofcom’s deadline for platforms to have deepfake hash-matching in place was the end of September 2026, with fines of up to 10% of global revenue behind it, and the government’s own AI risk management toolkit went out in September as voluntary guidance. That’s regulation arriving through the bodies you know, in the language they already use, right?
The first roads are being laid. They’re just not ours.
This is the tricky one, and it’s where I’d put my own effort if I were building infrastructure or aligning a company to AI practices today. I’d align to the EU AI Act. It’s been live since August 2026, and it’s now gathering judgement and, on recent reports, starting to distribute it: the trade press has the Commission sending its first formal requests for information to a long list of model providers, asking them to set out how they’re using AI. That’s the first set of roads being laid. They’ll evolve over time, and some of the early tarmac will get dug up again, but they’re laying them and letting cars ride on them.
And what will likely happen is that the UK follows suit, in slightly different terminology, once the shape is clear. If you’re selling into Europe you’re on those roads already. If you’re not, you’re still better off building to a live standard than to a promised one, because the live standard is the one the promised one will end up resembling.
Easier to condemn than to adapt
So if the board asks me whether to wait, the consultant’s answer is that the law you’re waiting for isn’t the one being tabled, the principles you’d be held to already exist in the bodies you answer to, and the first roads are being laid on the other side of the Channel. None of that requires you to open every door. It requires you to interpret well, write down what you’re doing and why, and prepare for the judgement rather than reserve it.
Whether that’s this quarter’s appetite or next year’s is your call. The question I’d leave you with is a simpler one than “what does the AI law say”. What would you build this quarter if you were only answering to the bodies you already answer to?
