On 3 February the UK Information Commissioner’s Office opened a formal investigation into xAI in relation to the processing of personal data in the creation of non-consensual sexualised imagery by Grok. The ICO is assessing whether Grok complied with UK data protection law. If xAI is found to have processed personal data unlawfully, the ICO will be able to enforce a fine of up to £17.5 million or 4% of xAI’s annual worldwide turnover (whichever is higher) under the Data Protection Act 2018 and the UK GDPR.
This follows the opening of an investigation by Ofcom under the Online Safety Act 2023 on 12 January 2026, which criminalises the sharing of intimate deepfakes without consent. There is another law at play in this investigation too – the Data (Use and Access) Act 2025, which makes it a criminal offence to create or request deepfake content of adults in the UK – but not, thus far, to supply the technology which allows deepfakes to be made, although the Labour Government is looking to amend the Act further.
This investigation into Grok’s compliance with UK data protection law follows French prosecutors from the cybercrime office raiding X offices in Paris on the same day, and the European Commission formally opening an investigation into X under the Digital Services Act to assess whether the company mitigated “systemic risks” linked to Grok, including the dissemination of illegal content and gender-based violence.
Enforcement action against Grok shows the differing focus of UK and EU data protection and online safety regimes – the UK approach, typical for a common law jurisdiction, focuses on addressing specific harms. The EU approach focuses on building a preventative framework for systemic risk management. These approaches are likely to show their value at different stages of the development of a new technology, with the common law approach better able to respond to the current speed of AI development, while the potential for an EU regulatory system to prevent harms is temporarily weakened due to Europe’s desire not to be left behind in the AI race. In essence, post-Brexit, the divergent development of UK and EU law in this field tells us a great deal about the consequences of Brexit itself for rights and enforcement.
A broad, European-style top-down regulatory regime is designed to empower a political executive acting on behalf of the voting public against an industrial class acting in the interests of private capital. Europe’s core problem is that it does not have much of an industrial class (in the IT sector at least), but it does have a large consumer market. European legislators have traditionally attempted to leverage the purchasing power of the EU’s consumer market to set global regulatory standards – a phenomenon which Anu Bradford termed the “Brussels Effect”.
The Brussels Effect worked well to address the data protection concerns of the “surveillance capitalism” era, but it is struggling to keep up with the pace of AI development. This led the European Commission to present the “Digital Omnibus” Regulation Proposal in November 2025, to delay the passing of parts of the AI Act concerning biometric ID until December 2027, and to alter the GDPR to allow AI models to be trained on European data, in a move widely seen as a push towards deregulation. Nonetheless, because of how the EU lawmaking apparatus is structured, it will find it much harder to adapt to the speed of AI development until it has stabilised.
Article 50 of the EU AI Act sets transparency rules for content produced by generative AI which state that such content must be marked in a machine-readable way. These rules were originally set to take effect in August 2026, but the Commission has proposed delaying their implementation until 2027, as part of its push to regulate with a lighter touch. The UK currently has no legislation requiring watermarks at all for an AI-generated image, although the 2024 UK government consultation on Copyright and Artificial Intelligence did acknowledge the benefits of AI labelling.
The UK’s ICO and Ofcom reacted quickly to the deepfake issue, with the ICO targeting xAI (the technology developer) as well as X (the platform/distributor), which shows enforcement at different levels of the data cycle – the two companies remain distinct legal entities, in spite of the recent series of mergers. The UK, due to its common law heritage, is perhaps more nimble in responding to specific instances of online harm, but the EU system provides better scaffolding for enforcement of uniform standards against large corporations over the long term. The two systems, with their differing focuses, can together provide a comprehensive means of enforcing shared standards and protecting the rights of the individual against large corporations, but the key challenge is in coordination post-Brexit.
The UK and EU approaches to enforcement follow broadly similar lines in a range of areas, not just data protection. In Competition and Antitrust, for example, the approach is similarly one of UK specificity and EU structural requirements. In 2023 the UK Competition and Markets Authority blocked the $69 billion Microsoft-Activision merger on the grounds that Microsoft already controlled some 60% of the global cloud gaming market. The CMA then made Microsoft restructure the terms of the deal at the global level to satisfy the UK regulator, which Microsoft accomplished by selling cloud streaming rights for all current and future Activision games released over the next 15 years to an independent third party, Ubisoft. The European Commission cleared the deal, accepting the remedies proposed by Microsoft (which the UK rejected), but made it clear that Microsoft must ensure that the deal must not undermine the purpose of the Digital Markets Act – to keep digital markets open and contestable. Microsoft became a designated gatekeeper for core platform services, which made it subject to additional regulatory requirements such as interoperability, data access, and non-preferential treatment of its own services. In essence, the UK system created an immediate and effective change, but the EU system bound Microsoft to more dependence on the European Commission in the long term.
In biotech and agri-tech, the UK passed the UK Genetic Technology (Precision Breeding) Act 2023, in which the emphasis shifts from proving that every stage in the process of food production is safe, to proving that a genetically-edited plant could have occurred naturally. Unlike the EU, the UK does not require mandatory labelling of precision-bred organisms, as long as they could have occurred naturally (although Scotland and Wales are still resisting the Precision Breeding Act). The EU GMO Directive 2001/18/C as enforced by the European Food Safety Authority (EFSA) imposes a heavier compliance burden on large food producers, who have to document every stage of the supply chain and label all genetically-modified products. In England, companies can bring new precision-bred organisms to market sooner, without having to label them as such, and enforcement will only follow where an organism is shown to be non-compliant with the Act and have foreign DNA (i.e. could not have occurred naturally). In summary, the EU binds corporations to its own regulatory process, while England, and to large extent the rest of the UK, looks to ease the financial and regulatory burden on the producer, acting against specific instances of non-compliance.
The UK approach to deepfakes is in line with the above – it focuses on making it as legally challenging as possible to create and spread individual deepfake images. The EU approach, by contrast, focuses on the procedural failures of X in assessing the risks of its software prior to deployment. The UK approach allows for more effective case-by-case enforcement, but the EU approach can eventually lead to heavier fines and make more of an impact on xAI’s overall business. The EU can levy a maximum fine of 7% of global turnover under the DSA, while the UK can only issue a 4% fine – but the Achilles heel of the EU approach is delay. The EU has thus far issued retention orders for documents, and will be stalled in enforcement until August 2026, when many of the remaining provisions of the AI Act come into force, or even until August 2027, when specific provisions on high-risk AI systems come into force. The UK faces no such delays, and is already proceeding with enforcement via the ICO and Ofcom. The UK approach is therefore likely to be better at preventing immediate harms to individuals who may suffer from the illicit creation and sharing of deepfakes – but the EU approach may yet have more of an impact on the future direction of companies such as xAI and its competitors, potentially shifting the direction of the market at a later stage in its maturity.
In each case, the UK approach is to solve a specific problem as it arises, and the EU approach is to increase the influence of the European Commission over the long term. Each approach has its advantages, and both can be leveraged in a complementary fashion to hold large companies to account. Far from making enforcement more difficult post-Brexit, the UK may have found an effective – and uniquely British way to police the blind spots of the previous, EU-only system, giving individuals more options, and more access to justice in the digital world.
Anna Richards.
Anna Richards has worked at the Ministry of Defence and House of Commons, and as a Judicial Assistant at the High Court. She writes for the Spectator, the Critic, and UnHerd, and is currently researching ECHR reform as part of a Pamela Thomas Research Award with the Society of Conservative Lawyers.
The Constitution Society is committed to the promotion of informed debate and is politically impartial. Any views expressed in this article are the personal views of the author and not those of The Constitution Society.