Home › All sources
Library
All sources
Every source cited in the paper, grouped by the section in which it first appears, with links so you can check them yourself.
Abstract
- Department for Science, Innovation and Technology, Designation of UK Data Infrastructure as Critical National Infrastructure, Written Ministerial Statement HCWS89 (12 September 2024). https://questions-statements.parliament.uk/written-statements/detail/2024-09-12/HCWS89
- Department for Science, Innovation and Technology, Data Centres to be Given Massive Boost and Protections from Cyber Criminals and IT Blackouts (12 September 2024). https://www.gov.uk/government/news/data-centres-to-be-given-massive-boost-and-protections-from-cyber-criminals-and-it-blackouts
Executive Summary
- House of Commons Library, Data Centres: Planning Policy, Sustainability and Resilience, Research Briefing CBP-10315 (27 May 2026). https://commonslibrary.parliament.uk/research-briefings/cbp-10315/
- Department for Energy Security and Net Zero, Data Centre Electricity Consumption in Great Britain, 2020–2024 (Official Statistics in Development, June 2026). https://assets.publishing.service.gov.uk/media/6a3e9f25da47783d87723bf2/Data_centre_electricity_consumption_in_Great_Britain__2020_to_2024.pdf
- techUK, Understanding Data Centre Water Use in England (2025). https://www.techuk.org/resource/techuk-report-understanding-data-centre-water-use-in-england.html
- Water Research Centre (WRc), Data Centre Water Use Report (2026). https://h2oglobalnews.com/data-centre-water-use-report-england/
- House of Commons Environmental Audit Committee, Risks and Opportunities to the Sustainability of Data Centres in the UK (Inquiry, 2026). https://committees.parliament.uk/work/9651/risks-and-opportunities-to-the-sustainability-of-data-centres-in-the-uk/
2. Planning Policy in England and Wales
- Browne Jacobson, NPPF 2026 Amendments: Data Centres and On-Site Energy Generation (2026), summarising National Planning Policy Framework reforms concerning data-centre and AI infrastructure planning (2024–2026). https://www.brownejacobson.com/insights/nppf-2026-amendments-browne-jacobson-response/data-centres-and-on-site-energy-generation
- Welsh Government, Planning Policy Wales (Edition 12, updated July 2024). https://www.gov.wales/planning-policy-wales
- Senedd Research, Data Centres in Wales: How Will Wales Manage a Rapidly Growing Industry? (July 2026). https://research.senedd.wales/research-articles/data-centres-in-wales-how-will-wales-manage-a-rapidly-growing-industry/
- Britbrief, Welsh Government Could Decide Cardiff Data Centre Plans After Holding Directive (August 2026). https://britbrief.co.uk/business/property/welsh-government-may-decide-cardiff-data-centre-plans.html
- Business News Wales, The Rise of Data Centres in Wales (2026). https://businessnewswales.com/the-rise-of-data-centres-in-wales/
- DataCenterDynamics, Silicon Valleys: How Wales Aims to Become a Data Center Hub (analysis, 2026). https://www.datacenterdynamics.com/en/analysis/silicon-valleys-how-wales-became-a-data-center-hub/
3. The Economic Case
- European Powell (Substack), Consent Not Required: How Big Tech Is Rewriting British Law to Build Its Data Empire Beyond Democratic Reach (2026) — an independent critical commentary; cited here for its characterisation of disputed job-creation claims, not as a neutral primary source. https://europeanpowell.substack.com/p/consent-not-required-how-big-tech
- Data Centre Review, The Data Centre Boom Will Stall Without a Skills Plan (April 2026). https://datacentrereview.com/2026/04/the-data-centre-boom-will-stall-without-a-skills-plan/
- Finance Act 2020, Part 2 (ss.39-72), especially s.43(2), defining "digital services activity" for Digital Services Tax purposes as limited to social media services, internet search engines and online marketplaces. https://www.legislation.gov.uk/ukpga/2020/14/part/2
- House of Commons Library, Digital Services Tax, CBP-8719 (2026). https://commonslibrary.parliament.uk/research-briefings/cbp-8719/
- House of Commons Committee of Public Accounts, Large Business Tax Compliance, HC 86 (10 July 2026). https://publications.parliament.uk/pa/cm5902/cmselect/cmpubacc/86/report.html
- Ricketts (Valuation Officer) v Cyxtera Technology UK Ltd [2021] UKUT 0265 (LC). https://landschamber.decisions.tribunals.gov.uk/judgmentfiles/j1755/LC-2019-611.pdf
- Browne Jacobson, Data Centres and Business Rates: What Investors Miss (2026). https://www.brownejacobson.com/insights/data-centres-and-business-rates-tax-on-megawatts
- Tom's Hardware, 'Big Tech's AI Spending Plans Reach $725 Billion in 2026' (30 April 2026), reporting FT-compiled combined 2026 capital-expenditure guidance from Microsoft, Alphabet, Meta and Amazon, up from around $410 billion in 2025. https://www.tomshardware.com/tech-industry/big-tech/big-techs-ai-spending-plans-reach-725-billion
- CNBC, 'Alphabet (GOOGL) Q1 2026 Earnings Report' (29 April 2026), reporting 2026 capital expenditure guidance of up to approximately $190 billion. https://www.cnbc.com/2026/04/29/alphabet-googl-q1-2026-earnings.html
- CNBC, 'Microsoft (MSFT) Q3 FY2026 Earnings Report 2026' (29 April 2026), reporting 2026 capital expenditure guidance of approximately $190 billion. https://www.cnbc.com/2026/04/29/microsoft-msft-q3-earnings-report-2026.html
- MLQ News, 'Amazon Raises 2026 AI Capex to $220B, Says Capacity Won't Meet Demand Through 2027' (30 July 2026). https://mlq.ai/news/amazon-raises-2026-ai-capex-to-220b-says-capacity-wont-meet-demand-through-2027/
- Data Center Dynamics, 'OpenAI Announces Five More US Stargate Data Centers with Oracle and SoftBank' (24 September 2025), reporting committed Stargate sites of almost 7GW and over $400 billion of investment, against the original $500 billion, four-year headline announced in January 2025. https://www.datacenterdynamics.com/en/news/openai-announces-five-more-us-stargate-data-centers-with-oracle-and-softbank/
- Microsoft, 'Microsoft's $15.2 Billion USD Investment in the UAE' (3 November 2025); see also CNBC, 'Middle East War Testing Gulf's Ambitions to Become AI Hub' (24 May 2026), on the wider scale and fragility of Gulf-region AI infrastructure investment. https://blogs.microsoft.com/on-the-issues/2025/11/03/microsofts-15-2-billion-usd-investment-in-the-uae/
- Sequoia Capital, David Cahn, 'AI's $600B Question' (20 June 2024, subsequently updated); see also CNBC, 'Bond Market Anxiety Is Growing Over AI Capex Budgets' (24 July 2026). These are analyst commentary and opinion, not independently verified fact, and are presented as such. https://www.sequoiacap.com/article/ais-600b-question/
- Information Commissioner's Office, 'Principle (e): Storage Limitation', UK GDPR guidance, requiring personal data to be kept 'for no longer than is necessary' but leaving retention periods to be set and reviewed by each organisation rather than fixing them in law. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/
- European Data Protection Board, 'Finnish SA: Administrative Fine of EUR 856,000 for Failing to Define a Storage Period' (2024), an example of enforcement action against a failure to observe the storage-limitation principle; no directly comparable UK enforcement action penalising over-retention alone has been identified for the purposes of this appraisal. https://www.edpb.europa.eu/news/national-news/2024/finnish-sa-administrative-fine-eu-856000-failing-define-storage-period_pl
- Veritas, 'Global Databerg Report' (15 March 2016), a widely cited industry survey finding that 85% of data stored by organisations surveyed was 'dark' (unclassified) or 'ROT' (redundant, obsolete or trivial); a comparable 2018 Veritas survey of UAE organisations found 81% unclassified. No large-scale study from 2023-2026 superseding these figures with fresh primary data has been identified, and the figures should be treated as an aging, vendor-commissioned survey claim rather than independently verified current fact. https://www.veritas.com/news-releases/2016-03-15-veritas-global-databerg-report-finds-85-percent-of-stored-data
- International Energy Agency, 'Energy Demand from AI', in Energy and AI (2025), finding that storage systems account for only around 5% of data-centre electricity consumption, while AI-optimised 'accelerated servers' are projected to grow electricity use by roughly 30% a year, against approximately 9% a year for conventional servers, and now drive close to half of global data-centre electricity growth. This suggests that current data-centre capacity growth is driven predominantly by AI training and inference compute rather than by the long-term retention of data already collected, an inference drawn by this appraisal from the IEA's figures rather than a conclusion stated by the IEA itself. https://www.iea.org/reports/energy-and-ai/energy-demand-from-ai
5. Water Use and Cooling Technologies
- House of Commons Library, 'Data centres: planning policy, sustainability and resilience', Research Briefing CBP-10315 (27 May 2026), which records that environmental campaigners have criticised the lack of transparency regarding data-centre water consumption. The figures quoted in the following paragraphs do not appear in this briefing and are sourced separately in the notes that follow. CBP-10315.pdf https://researchbriefings.files.parliament.uk/documents/CBP-10315/CBP-10315.pdf
- Computer Weekly, TechUK report on datacentre water usage habits criticised, 12 September 2025. https://www.computerweekly.com/news/366630713/TechUK-report-on-datacentre-water-usage-habits-criticised
- Global Action Plan, Not a drop to drink: how Britain’s data centre surge threatens water security (PDF), April 2026. https://www.globalactionplan.org.uk/insights/publications/not-a-drop-to-drinkhow-britains-data-centre-surge-threatens-water-security
- Guardian, UK’s largest proposed datacentre ‘understating planned water use’, 19 December 2025. The web address of the original Guardian article has not been located for this appraisal. The same comparison, that the site could use around 50 times more water than the developer claims once indirect use is included, was reported by edie: (behind a paywall, and not independently read for this appraisal). https://www.edie.net/uks-largest-planned-data-centre-could-use-50-times-more-water-than-developer-claims/
- Thames Water, EIR-23-24-469, 13 December 2023; Water Research Centre, Water efficient data centres, February 2026, p3. The Water Research Centre report is at ; it confirms that water companies' main concern is demand on peak days, which is likely to coincide with high domestic demand, but the word 'stretched' has not been located in it, and the Thames Water response has not been re-checked. https://www.wrcgroup.com/uploads/Water%20Efficient/Water%20Efficient%20Data%20Centres.pdf
- Times, Surge in data centres set to push water bills even higher, 10 May 2026. Full Fact has since explained that the 14 million litres a day figure is Water UK's estimate of average peak demand, such as on hot summer days, and that average daily use is around 6.6 million litres: https://fullfact.org/environment/times-water-data-centres/
- Thames Water, EIR-23-24-469, 13 December 2023; see also Data Center Dynamics, 'Thames Water May Restrict London Data Centers' Water Use' (26 July 2023): https://www.datacenterdynamics.com/en/news/thames-water-may-restrict-london-data-centers-water-use/
- Global Action Plan research reported in Water Magazine, '84% of Proposed UK Data Centres to be Built in Water-Stressed Areas' (27 April 2026). The original research is Global Action Plan, 'Report reveals majority of new data centres planned for water stressed areas' (7 April 2026), which puts the figure at 84% of water-intensive data-centre developments proposed for areas that are already water-stressed or projected to be so by 2040: https://www.globalactionplan.org.uk/insights/news/report-reveals-majority-of-new-data-centres-planned-for-water-stressed-areas https://www.watermagazine.co.uk/2026/04/27/84-of-proposed-uk-data-centres-to-be-built-in-water-stressed-areas/
- Data Center Dynamics, 'Thames Water May Restrict London Data Centers' Water Use' (26 July 2023). The estimate that data centres could drive almost 30% of all new water demand in the Thames Water region, around 270 million litres a day, is from Global Action Plan, 'Report reveals majority of new data centres planned for water stressed areas' (7 April 2026): https://www.globalactionplan.org.uk/insights/news/report-reveals-majority-of-new-data-centres-planned-for-water-stressed-areas https://www.datacenterdynamics.com/en/news/thames-water-may-restrict-london-data-centers-water-use/
- National Infrastructure Commission for Wales, 'Wales Infrastructure Assessment 2026: Water' (March 2026). https://nationalinfrastructurecommission.wales/water26/
- North Wales Rivers Trust, 'The Menai Data Centre: At What Cost?' (September 2026), summarising the Environmental Statement for Gwynedd Council application C25/0740/20/EIA. https://northwalesriverstrust.org/news/the-menai-data-centre-at-what-cost
- Menai Strait Partnership Forum, 'Menai Data Centre - At What Cost?' (18 September 2026). https://www.menaiforum.org/2026/09/menai-data-centre-at-what-cost/
- Welsh Government, Well-being of Future Generations (Wales) Act 2015: The Essentials. https://www.gov.wales/well-being-future-generations-act-essentials-html
6. Carbon Emissions and Climate Change
- House of Commons Environmental Audit Committee, written evidence: data centres and the Seventh Carbon Budget (2026), noting the omission of disaggregated data-centre demand from the Climate Change Committee's carbon budget projections. https://committees.parliament.uk/writtenevidence/151599/html/
- House of Commons Environmental Audit Committee, MPs to Examine Data Centres' Climate Impact as Miliband Says Future Demand 'Inherently Uncertain' (February 2026). https://committees.parliament.uk/committee/62/environmental-audit-committee/news/212132/mps-to-examine-data-centres-climate-impact-as-miliband-says-future-demand-inherently-uncertain/
- UK Parliament, Written Question 127433, Dame Chi Onwurah to the Secretary of State for Energy Security and Net Zero, answered by Michael Shanks MP (24 April 2026). https://questions-statements.parliament.uk/written-questions/detail/2026-04-15/127433
7. Energy-from-Waste and Incinerator-Related Power
- House of Commons Library, Incineration of Waste in England, Research Briefing CBP-10229 (April 2025). https://commonslibrary.parliament.uk/research-briefings/cbp-10229/
- Natural Resources Wales, 'CHP-Ready Guidance for Combustion and Energy from Waste Power Plants' (version 2, September 2014). https://naturalresourceswales.gov.uk/media/2100/chp-ready-guidance-for-combustion-and-energy-from-waste-power-plants.pdf
- Resource, '£15m funding approved for Cardiff district heat network' (14 August 2020); Business News Wales, 'Cardiff Heat Network delivers first low carbon heat' (November 2025). ; https://www.resourcemedia.eco/article/15m-funding-approved-cardiff-district-heat-network https://businessnewswales.com/cardiff-heat-network-delivers-first-low-carbon-heat/
- Welsh Government, 'Heat Strategy for Wales' (July 2024). https://www.gov.wales/sites/default/files/publications/2024-07/heat-strategy-wales.pdf
- Environmental Permitting (England and Wales) Regulations 2016 (SI 2016/1154), Schedule 24, 'Efficiency in heating and cooling energy: Energy Efficiency Directive', paragraphs 1 to 3. https://www.legislation.gov.uk/uksi/2016/1154/schedule/24
- Environment Agency, decision document for a bespoke permit for standby electricity generating combustion plant at a data centre site operated by Amazon Data Services UK Limited (29 January 2026). https://assets.publishing.service.gov.uk/media/69846ade468d351e1406b4b8/Application_Bespoke_A001_Decision_Document_-_29012026.pdf
- Directive (EU) 2023/1791 on energy efficiency (recast), Article 26(6); for a summary, see Covington & Burling, 'The EU's Energy Efficiency Directive and its impact on datacenters' (2025). ; https://eur-lex.europa.eu/eli/dir/2023/1791/oj/eng https://www.cov.com/-/media/files/corporate/publications/2025/04/the-eus-energy-efficiency-directive-and-its-impact-on-datacenters.pdf
- Kristin Weiß, 'From EU Framework to National Action: How Germany Regulates Data Center Energy Use', Sabin Center for Climate Change Law, Columbia Law School (24 October 2025), on section 11 of the Energy Efficiency Act (EnEfG). https://blogs.law.columbia.edu/climatechange/2025/10/24/from-eu-framework-to-national-action-how-germany-regulates-data-center-energy-use/
- Department for Energy Security and Net Zero, 'Heat network zoning consultation 2023: summary of government response' (21 January 2026). https://www.gov.uk/government/consultations/proposals-for-heat-network-zoning-2023/outcome/heat-network-zoning-consultation-2023-summary-of-government-response
- Department for Environment, Food and Rural Affairs, 'United Kingdom Food Security Report 2024: Theme 2: UK Food Supply Sources' (11 December 2024). https://www.gov.uk/government/statistics/united-kingdom-food-security-report-2024/united-kingdom-food-security-report-2024-theme-2-uk-food-supply-sources
- Welsh Government, 'Written Statement: Horticulture policy development in Wales' (18 December 2024). https://www.gov.wales/written-statement-horticulture-policy-development-wales
- DatacenterDynamics, report on the Humber Tech Park planning application, North Lincolnshire (18 May 2024). https://www.datacenterdynamics.com/en/news/humber-tech-park-lincolnshire-uk-district-heating/
- S T Ahmad and others, 'Recovery and treatment of cooling tower blowdown water: challenges, recent advancement, and future perspectives', Journal of Environmental Chemical Engineering (2025). https://doi.org/10.1016/j.jece.2025.115399
- Nation.Cymru, 'Data centre plans put on hold as ministers intervene' (4 September 2026), Local Democracy Reporting Service. https://nation.cymru/news/data-centre-plans-put-on-hold-as-ministers-intervene/
- Iceni Projects for Curtis Hall Limited, 'Planning Statement: Cardiff Park and Ride East, Pentwyn' (January 2026), paragraphs 2.6, 2.12, 4.22-4.24, 5.6-5.8, 6.36-6.44 and 6.85, application 26/00109/HYB, Cardiff Council planning register. https://www.cardiffidoxcloud.wales/publicaccess/applicationDetails.do?keyVal=T8YL3PECJ8T00&activeTab=summary
- Cardiff Council, Screening and Scoping Opinion, reference SC/21/00018/MJR, Cardiff East Park and Ride (2022), reproduced as Environmental Statement Volume II, Appendix 1.2, application 26/00109/HYB. https://www.cardiffidoxcloud.wales/publicaccess/applicationDetails.do?keyVal=T8YL3PECJ8T00&activeTab=documents
- Cardiff Council, Cabinet, 20 May 2021, agenda item 9, ‘Llanrumney Regeneration Scheme – Statutory Public Consultation and Land Disposal Update’, paragraphs 6, 7 and 24 to 27 (public reports pack, pages 359 to 363). https://cardiff.moderngov.co.uk/documents/g4316/Public%20reports%20pack%2020th-May-2021%2014.00%20Cabinet.pdf?T=10&LLL=0
- Town and Country Planning (Environmental Impact Assessment) (Wales) Regulations 2017, regulation 58. https://www.legislation.gov.uk/wsi/2017/567/regulation/58
- Water Usage Datasheet for application 26/00109/HYB, published on the Cardiff Council planning register on 6 October 2026. https://www.cardiffidoxcloud.wales/publicaccess/files/0B1B9164A37A106ADEC41E1D472E8976/pdf/26_00109_HYB-WATER_USAGE_DATASHEET-6465333.pdf
- Technical Note (Air Quality), combined reports, application 26/00109/HYB, 6 October 2026. https://www.cardiffidoxcloud.wales/publicaccess/files/54C572792D4179F901419D580EE3D9FC/pdf/26_00109_HYB-TECHNICAL_NOTE__AIR_QUALITY__-_COMBINED_REPORTS-6465338.pdf
8. Local Environmental Effects
- 3M, '3M to Exit PFAS Manufacturing by the End of 2025' (20 December 2022), announcing the phase-out of all per- and polyfluoroalkyl substance (PFAS) manufacturing, including the Novec and Fluorinert product lines used as two-phase immersion-cooling fluids in some data centres. https://news.3m.com/2022-12-20-3M-to-Exit-PFAS-Manufacturing-by-the-End-of-2025
- Damien Gayle, "'Tidal wave' of Pfas being launched to satisfy AI industry, campaigners warn", the Guardian (14 September 2026), reporting a survey by the Swedish chemicals watchdog ChemSec of the world's ten biggest PFAS manufacturers, which found that nine plan to increase production, several citing demand from AI data-centre cooling and semiconductor manufacture specifically; only Archroma and BASF (by 2028) were reported as moving away from PFAS. This appraisal has not independently located ChemSec's own underlying report or survey methodology, and relies here on the Guardian's reporting of it. https://www.theguardian.com/environment/2026/sep/14/pfas-firms-tidal-wave-forever-chemicals-ai-industry-demand-datacentres
- Submer, 'PFAS Contamination: A Call to Action for the Datacenter Industry' (2026), describing PFAS as the chemical basis of two-phase immersion-cooling fluids and cautioning that, following bans on some PFAS formulations, manufacturers have in some cases reformulated products that remain PFAS under the broad definition while being marketed as 'green' alternatives. https://submer.com/blog/pfas-contamination-a-call-to-action-for-the-datacenter-industry/
- Organisation for Economic Co-operation and Development, 'Reconciling Terminology of the Universe of Per- and Polyfluoroalkyl Substances' (2021), setting out the broad structural definition of PFAS now generally used in UK and EU regulatory practice. https://www.oecd.org/en/publications/reconciling-terminology-of-the-universe-of-per-and-polyfluoroalkyl-substances_e458e796-en.html
- NFPA 2001, Standard on Clean Agent Fire Extinguishing Systems, is the industry standard governing clean-agent gases such as FM-200 (HFC-227ea) and Novec 1230 (FK-5-1-12), chosen for data-centre use because they are non-conductive and leave no residue on electronic equipment; under the broad OECD definition of PFAS referred to above, these clean agents themselves fall within the PFAS family, distinct from the aqueous film-forming foam (AFFF) more commonly associated with contamination at airports and military sites. https://www.nfpa.org/product/nfpa-2001-standard/p2001code/nfpa-2001-standard-on-clean-agent-fire-extinguishing-systems-2015/200115
- ZVEI (German Electro and Digital Industry Association), 'PFAS and Semiconductors' factsheet, describing PFAS use in semiconductor photolithography (as photoresist surfactants and photoacid generators) and in plasma etching (fluorine-based gases used to structure silicon, dielectric and metal layers), and noting that no drop-in substitute currently exists for most such uses. https://www.zvei.org/fileadmin/user_upload/Themen/Nachhaltigkeit_Umwelt/PFAS/2-ZVEI-Factsheet-_PFAS_and_Semiconductors_-final.pdf
- Chemistry World, 'Water regulator applies stricter PFAS limits to drinking water in England and Wales' (2024), reporting the Drinking Water Inspectorate's guidance, expected to take effect from January 2025, introducing a cumulative limit of 100 nanograms per litre across 48 individual PFAS substances for England and Wales - guidance rather than a statutory duty, in contrast to Scotland's statutory limit for 20 named PFAS substances since January 2023. https://www.chemistryworld.com/news/water-regulator-applies-stricter-pfas-limits-to-drinking-water-in-england-and-wales/4020476.article
- Directive (EU) 2020/2184 on the quality of water intended for human consumption (the revised Drinking Water Directive) sets a total-PFAS limit of 0.5 micrograms per litre, which took effect across EU member states from 12 January 2026; the UK, no longer bound by EU directives following its withdrawal from the European Union, instead relies on the non-statutory Drinking Water Inspectorate guidance for England and Wales referred to above. https://environment.ec.europa.eu/news/new-eu-rules-limit-pfas-drinking-water-2026-01-12_en
- US Environmental Protection Agency, National Primary Drinking Water Regulation for PFAS (final rule, April 2024), setting enforceable limits of 4.0 parts per trillion for PFOA and PFOS, with public water systems given until 2029 to comply; the EPA's own 'Proposed PFAS Rescission Rule' and a related proposal to extend the PFOA/PFOS compliance deadline, both published in 2026, illustrate that this regulatory position remains contested and unsettled even in the jurisdiction that has gone furthest toward statutory limits, and are cited here as international regulatory context rather than as a statement of UK law. https://www.epa.gov/sdwa/and-polyfluoroalkyl-substances-pfas
- Department for Environment, Food and Rural Affairs, 'PFAS Plan' (published 3 February 2026, updated 17 August 2026), the UK Government's first dedicated PFAS strategy, adopting the broad OECD definition of PFAS and committing to a 2026 consultation on introducing a statutory drinking-water limit and to aligning with EU REACH restrictions 'by December 2028'. https://www.gov.uk/government/publications/pfas-plan
- Health and Safety Executive, UK REACH consultations on 'PFAS in Firefighting Foam': an initial consultation on the risk-assessment case opened in August 2025, and a further consultation on the socio-economic case opened 9 July 2026 and closed 7 September 2026, with HSE's opinion on the risk assessment already published ahead of that second-stage consultation; a government decision on any restriction is still awaited. https://consultations.hse.gov.uk/crd-reach/uk-reach-restriction-on-pfas-in-firefighting-foam/
- US Government Accountability Office, GAO-25-107401, 'Persistent Chemicals: DOD Needs to Provide Congress More Information on Costs Associated with Addressing PFAS' (reissued with revisions, February 2025), reporting that the Department of Defense's own estimate of its future PFAS-specific investigation and cleanup costs had risen to more than $9.3 billion for fiscal year 2025 and beyond, more than tripling since 2022; cited here purely as an illustrative order-of-magnitude comparator for the scale and volatility of PFAS-specific liability once quantified, and not as a claim that any equivalent liability has arisen, or is expected to arise, from UK or Welsh data-centre development, for which this appraisal has identified no comparable costed assessment. https://www.gao.gov/products/gao-25-107401
- Natural Resources Wales, State of Natural Resources Report 2025, Pollution chapter, which identifies 'PFAS, veterinary medicines and other pharmaceuticals' as contaminants of concern in Welsh waters generally but does not address data centres as a source, and does not otherwise engage with PFAS in the context of data-centre construction, operation or decommissioning; this appraisal has not identified any other published Natural Resources Wales guidance, assessment or monitoring programme that does so, which it treats as a genuine and citable gap in Welsh environmental regulatory coverage rather than as an oversight necessarily attributable to Natural Resources Wales itself, whose statutory remit and resources are matters beyond this appraisal's scope. https://naturalresources.wales/evidence-and-data/research-and-reports/state-of-natural-resources-report-2025/pollution/?lang=en
- North Carolina Department of Environmental Quality, GenX Investigation: Groundwater, documenting PFAS/GenX contamination of industrial and residential groundwater wells near Chemours's Fayetteville Works manufacturing facility, first identified in 2017 and the subject of a February 2019 Consent Order; this is a well-documented example of PFAS harm linked to chemical manufacturing, not to a data centre, and this appraisal has not identified any confirmed instance, in the United Kingdom or elsewhere, of environmental contamination traced to a data centre specifically. Chemours agreed a further $450 million settlement covering Fayetteville Works and three other US sites in June 2026, illustrating that liability from PFAS-manufacturing contamination remains an active and growing matter even for a case dating to 2017. https://www.deq.nc.gov/news/key-issues/genx-investigation/groundwater
- Reporting has begun explicitly connecting the AI data-centre boom to PFAS use, including Jessica Corbett, 'Research Warns of Surge in Cancer-Causing Forever Chemicals From AI Data Center Build-Out', Common Dreams (14 September 2026), and Food & Water Watch, 'Toxic Mixture: Data Centers Turn to PFAS For Cooling' (July 2026). This appraisal has not identified equivalent UK-specific reporting or research making the same connection for data centres in England or Wales, which this appraisal treats as an emerging area of scrutiny elsewhere rather than as a topic yet addressed by UK press, regulators or campaigners in relation to domestic sites. https://www.commondreams.org/news/data-centers-and-pfas
- New Jersey Office of the Attorney General, 'Federal Court Approves Historic PFAS Settlements Valued at Approximately $2.5 Billion' (press release, 8 August 2026); see also the joint New Jersey Department of Environmental Protection news release of the same date, and reporting in the Philadelphia Inquirer, 'Federal court approves settlements that will pay New Jersey $2.5 billion for PFAS contamination' (8 August 2026), from which the breakdown of payments between DuPont-related entities and 3M given in the text is drawn. https://www.njoag.gov/federal-court-approves-historic-pfas-settlements-valued-at-approximately-2-5-billion/
9. Digital Sovereignty, Jurisdiction and Public Trust
- Information Commissioner's Office, Adequacy Regulations (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/
- Information Commissioner's Office, UK Extension to the EU-US Data Privacy Framework (updated July 2026). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/how-does-the-uk-extension-to-the-eu-us-data-privacy-framework-work/
12. Public-Sector Data and National Sovereignty
- The Stack, 'NHS signs Palantir up under £330 million NHS data contract' (21 November 2023). https://thestack.technology/nhs-signs-palantir-up-under-330-million-nhs-data-contract
- NHS England, 'NHS Federated Data Platform: frequently asked questions'. https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/fdp-faqs/
- Ministry of Defence, 'New strategic partnership to unlock billions and boost military AI and innovation' (press release, 18 September 2025). https://www.gov.uk/government/news/new-strategic-partnership-to-unlock-billions-and-boost-military-ai-and-innovation
- PublicTechnology, 'Palantir picked for new £9m national gun database as MPs join opposition to US firm's public sector deals' (3 June 2026). https://www.publictechnology.net/2026/06/03/business-and-industry/palantir-picked-for-new-9m-national-gun-database-as-mps-join-opposition-to-us-firms-public-sector-deals/
- Computing, 'More than a quarter of England and Wales police forces now involved in Palantir pilots' (7 September 2026), reporting research by the Financial Times; the forces named are all English, together with the Metropolitan Police. https://www.computing.co.uk/news/2026/government/more-than-a-quarter-of-england-and-wales-police-forces-now-involved-in-palantir-pilots
- House of Commons Science, Innovation and Technology Committee, 'Rewiring the state: Delivering digital government' (report, 3 June 2026), conclusions and recommendations on Palantir, technological sovereignty and the CLOUD Act; see also the Committee's press notice of the same date. ; https://publications.parliament.uk/pa/cm5902/cmselect/cmsctech/61/report.html https://committees.parliament.uk/committee/135/science-innovation-and-technology-committee/news/214048/mps-warn-that-palantirs-increasing-presence-in-the-uk-public-sector-is-an-unacceptable-point-of-weakness/
- Computing, 'NHS Palantir platform's business case under pressure as costs rise and benefits fall' (10 August 2026). https://www.computing.co.uk/news/2026/government/nhs-palantir-platform-s-business-case-under-scrutiny-as-costs-rise-and-benefits-fall
- Supreme Court of the United States, Social Security Administration v American Federation of State, County and Municipal Employees, No 24A1063, order of 6 June 2025 staying the preliminary injunction pending appeal. https://www.supremecourt.gov/opinions/24pdf/24a1063_6j37.pdf
- Government Accountability Project, 'Whistleblower warns of possible risks to Americans' Social Security information' (press release, 26 August 2025); for the Administration's response, see Government Accountability Project, 'Whistleblower claims DOGE compromised Social Security data of hundreds of millions of Americans' (reproducing The Independent). ; https://whistleblower.org/press-release/whistleblower-warns-of-possible-risks-to-americans-social-security-information/ https://whistleblower.org/in-the-news/the-independent-whistleblower-claims-doge-compromised-social-security-data-of-hundreds-of-millions-of-americans/
- Government Executive, 'DOGE officials face Hatch Act referrals for work with org aiming to "overturn election results"' (January 2026), reporting the Justice Department's court filing of January 2026. https://www.govexec.com/management/2026/01/doge-officials-face-hatch-act-referrals-work-org-aiming-overturn-election-results/410825
- NPR, 'The government is investigating new claims that DOGE misused Social Security data' (12 March 2026), as published by OPB. https://www.opb.org/article/2026/03/12/new-investigations-look-at-doge-and-social-security-data/
- Wired, 'Palantir is helping DOGE with a massive IRS data project' (April 2025), as summarised by beSpacific (12 April 2025). https://www.bespacific.com/?p=112372
13. Regulatory Stability and International Confidence
- Trump v Slaughter, 609 U.S. ___ (2026). The decision concerned presidential removal powers relating to FTC commissioners and did not alter UK GDPR, adequacy regulations or UK-US transfer arrangements. https://supreme.justia.com/cases/federal/us/609/25-332/
- UK GDPR, Article 48 ('Transfers or disclosures not authorised by domestic law'), under which a judgment or decision of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement in force between that country and the United Kingdom. The equivalent EU provision is at the second link. ; https://www.legislation.gov.uk/eur/2016/679/article/48 https://gdpr-info.eu/art-48-gdpr/
- The Register, 'Microsoft admits it cannot guarantee data sovereignty' (25 July 2025), reporting the evidence of Anton Carniaux, Microsoft France's director of public and legal affairs, to a French Senate inquiry on 18 June 2025, in the context of the United States CLOUD Act. https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/
- Examples include the United States CLOUD Act 2018 (see n 146 above) and Articles 7 and 14 of the National Intelligence Law of the People's Republic of China (2017, amended 2018), Article 7 of which provides that 'all organizations and citizens shall support, assist, and cooperate with national intelligence efforts in accordance with law'. The examples are given to show that the issue is not confined to one state. https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-c-2017/
- The Register, 'Microsoft throws spox under the bus in ICC email flap' (18 February 2026), reporting Microsoft's apology to the House of Commons Business and Trade Committee and its request that the record be corrected; see also Computer Weekly, 'Microsoft's ICC email block reignites European data sovereignty concerns' (23 May 2025). ; https://www.theregister.com/2026/02/18/microsoft_asks_uk_parliament_to_correct_record/ https://www.computerweekly.com/opinion/Microsofts-ICC-email-block-reignites-European-data-sovereignty-concerns
- The Register, 'International Criminal Court dumps Microsoft Office' (31 October 2025), reporting the Court's move to openDesk, an open-source suite provided by Germany's Centre for Digital Sovereignty (ZenDiS) on behalf of the German Federal Ministry of the Interior. https://www.theregister.com/software/2025/10/31/international-criminal-court-dumps-microsoft-office/680564
- Court of Justice of the European Union, Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems ('Schrems II'), judgment of 16 July 2020; Court press release No 91/20. https://curia.europa.eu/site/upload/docs/application/pdf/2020-07/cp200091en.pdf
- BSA | The Software Alliance, comments to ANSSI on SecNumCloud version 3.2 (15 November 2021), objecting to its 'immunity to extraterritorial legislation' requirements; for a summary of the requirements, including limits of 24% individually and 39% collectively on non-EU shareholdings, see Scalingo, 'SecNumCloud qualification (ANSSI): complete guide' (a cloud provider's guide, not an official source). ; https://www.bsa.org/policy-filings/france-bsas-comments-to-anssi-on-secnumcloud-version-32a https://scalingo.com/blog/secnumcloud-qualification-anssi-guide
- The Record, 'Danish government agency to ditch Microsoft software in push for digital independence' (June 2025), quoting the Danish Minister for Digitalisation, Caroline Stage Olsen. https://therecord.media/denmark-digital-agency-microsoft-digital-independence
- eucrim, 'UK-US E-Evidence Agreement in Force', reporting the entry into force of the UK-US Data Access Agreement on 3 October 2022. https://eucrim.eu/news/uk-us-e-evidence-agreement-in-force/
15. Regional Concentration and Proliferation Effects
- Pinsent Masons, 'New Irish Data Centres Must Generate Power Back into National Grid, Rules Regulator', reporting the Commission for Regulation of Utilities' final policy decision of December 2025. https://www.pinsentmasons.com/out-law/news/irish-data-centres-power-national-grid-regulator
- Frontier Group, 'Does Virginia Have Enough Water to Quench Thirsty Data Centers?' (2026). https://frontiergroup.org/articles/does-virginia-have-enough-water-to-quench-thirsty-data-centers/
- Data Center Dynamics, 'The Netherlands' Hollands Kroon Wants to Pause Hyperscale Data Center Developments' (30 June 2022). https://www.datacenterdynamics.com/en/news/the-netherlands-hollands-kroon-wants-to-pause-hyperscale-developments/
- Lexology, 'Building Green Data Centres - Singapore Lifts Moratorium on New Data Centres, Introduces Environmental Sustainability Standards', summarising Singapore's 2019-2022 moratorium and its March 2022 conditions for new capacity. https://www.lexology.com/library/detail.aspx?g=254ea4fc-98b1-465f-9904-2f4c4c3496fc
- Fuse Energy, analysis of electricity demand from proposed Welsh data centres and the South Wales AI Growth Zone, citing Ofgem's warning that the current network cannot accommodate all proposed data-centre grid connections (2026). https://www.fuseenergy.com/news/welsh-data-centre
16. Bro Tathan: Public Land, a US Operator and Unresolved Governance Questions
- CarneySweeney, Vantage Data Centre, Bro Tathan, Vale of Glamorgan — planning consent summary. https://www.carneysweeney.co.uk/projects/vantage-data-centre-bro-tathan-vale-of-glamorgan.html
- Baxtel, Vantage: Bro Tathan CWL2 Data Center — site profile confirming the 999-year Welsh Government lease and US ownership. https://baxtel.com/data-center/vantage-bro-tathan-cwl2
- Welsh Government, Bro Tathan — Cardiff Airport and Bro Tathan Enterprise Zone. https://www.gov.wales/bro-tathan
- Vantage Data Centers, Vantage Data Centers and Nebius Expand UK AI Infrastructure with First Deployment in South Wales AI Growth Zone (2026). https://vantage-dc.com/news/vantage-data-centers-and-nebius-expand-uk-ai-infrastructure-with-first-deployment-in-south-wales-ai-growth-zone/
17. Artificial Intelligence: Warnings, Uncertainty and the Precautionary Principle
- Axios, Anthropic Insiders Warn AI Could Kill All Humans (9 September 2026). https://www.axios.com/2026/09/09/anthropic-insiders-warn-ai-could-kill-all-humans
- Axios, Behind the Curtain: Anthropic's Warning to the World (26 January 2026). https://www.axios.com/2026/01/26/anthropic-ai-dario-amodei-humanity
- Center for AI Safety, Statement on AI Risk (30 May 2023). https://www.safe.ai/work/statement-on-ai-risk
- Geoffrey Hinton, banquet speech, Nobel Prize ceremony, Stockholm, 10 December 2024. https://www.nobelprize.org/prizes/physics/2024/hinton/speech/
- Katja Grace and others, 'Thousands of AI Authors on the Future of AI', Journal of Artificial Intelligence Research (2025), reporting a survey of 2,778 researchers who had published in leading AI venues, conducted in October 2023. https://www.jair.org/index.php/jair/article/view/19087
- Future of Life Institute, 'Statement on Superintelligence' (22 October 2025); for the date and initial signatories, see SiliconANGLE, 'Geoffrey Hinton, Yoshua Bengio sign statement urging suspension of AGI development' (22 October 2025). ; https://superintelligence-statement.org/ https://siliconangle.com/2025/10/22/geoffrey-hinton-yoshua-bengio-sign-statement-urging-suspension-agi-development/
- HM Government, The Bletchley Declaration by Countries Attending the AI Safety Summit, 1-2 November 2023. https://www.gov.uk/government/publications/ai-safety-summit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-ai-safety-summit-1-2-november-2023
- Senedd Economy, Trade and Rural Affairs Committee, AI and the Welsh Economy: Can Welsh Androids Dream of Electric Sheep? (May 2025). https://laiddocuments.senedd.wales/cr-ld17182-en.pdf
- Environment Act 2021, section 17 (policy statement on environmental principles, including the precautionary principle). https://www.legislation.gov.uk/ukpga/2021/30/section/17
- Wikipedia, Seven Generation Sustainability, summarising the Haudenosaunee (Iroquois) Confederacy's Great Law principle. https://en.wikipedia.org/wiki/Seven_generation_sustainability
- International AI Safety Report 2026, chaired by Yoshua Bengio and backed by 30 governments, the OECD and the UN (January 2026), which structures its risk assessment around 'malicious use', 'malfunctions' and 'systemic risks' as distinct categories, separate from loss-of-control risk; see also Center for Security and Emerging Technology (Georgetown), 'How to Assess the Likelihood of Malicious Use of Advanced AI Systems' (March 2025). https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026
- RAND Corporation, 'Current Artificial Intelligence Does Not Meaningfully Increase Risk of a Biological Weapons Attack' (25 January 2024), a red-team study finding that the large language models tested did not, at that time, increase the risk posed by a non-state actor beyond information already available online. https://www.rand.org/news/press/2024/01/25.html
- Anthropic, 'Activating AI Safety Level 3 Protections' (22 May 2025), stating that Anthropic could not 'clearly rule out ASL-3 risks' for Claude Opus 4 and describing safeguards 'narrowly focused on preventing... extended, end-to-end CBRN workflows', with biological weapons assessed as representing the majority of that risk; see also OpenAI, Preparedness Framework v2 (15 April 2025), which tracks biological uplift as a 'High' capability category. https://www.anthropic.com/news/activating-asl3-protections
- Bulletin of the Atomic Scientists, 2026 Doomsday Clock Statement (27 January 2026), setting the Clock at 85 seconds to midnight and warning that AI may be embedded in nuclear decision-support systems, and that 'a too-heavy dependence on black-box systems could present a serious danger'. https://thebulletin.org/doomsday-clock/2026-statement/
- International Institute for Strategic Studies, 'Nuclear Command Without Control: AI and the Problem of Escalation Opacity', Survival Online (2026), and Bulletin of the Atomic Scientists, 'Algorithms of Misperception: Managing Nuclear Risk in an AI World' (November 2025), both using the 1983 Petrov false-alarm incident as an analogy for the risk of automation bias in AI-assisted early-warning systems. No publicly confirmed AI-caused nuclear near-miss is known to have occurred as of the date of this appraisal; the concern identified in this literature is a documented expert warning, not a documented incident. https://www.iiss.org/online-analysis/survival-online/2026/07/nuclear-command-without-control-ai-and-the-problem-of-escalation-opacity/
- Centre for the Governance of AI, 'Assessing the Risk of AI-Enabled Cyberattacks on the Power Grid'; see also World Economic Forum, Global Cybersecurity Outlook 2026, and Alan Turing Institute (CETAS), 'From Deepfake Scams to Poisoned Chatbots: AI and Election Security in 2025', on AI-assisted threats to critical infrastructure and democratic processes respectively. https://www.governance.ai/research-paper/ai-enabled-cyberattacks-on-the-power-grid
- Human Rights Watch, 'A Hazard to Human Rights: Autonomous Weapons Systems and Digital Decision-Making' (28 April 2025); see also the UN General Assembly resolution on lethal autonomous weapons systems supported by 156 states, and the Frontier Model Forum's 'Risk Taxonomy and Thresholds for Frontier AI Frameworks', which lists chemical alongside biological, nuclear and radiological uplift as a tracked risk category. https://www.hrw.org/report/2025/04/28/a-hazard-to-human-rights/autonomous-weapons-systems-and-digital-decision-making
- OpenAI, 'Disrupting Malicious Uses of AI by State-Affiliated Threat Actors' (14 February 2024, with further disruption reports published through October 2025), identifying use of its models by groups linked to China (Charcoal Typhoon, Salmon Typhoon), Iran (Crimson Sandstorm), North Korea (Emerald Sleet) and Russia (Forest Blizzard) for reconnaissance, phishing content, code debugging, translation of technical material and evasion research; OpenAI's own assessment at the time was that this gave only limited, incremental capability over tools already available. https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/
- Anthropic, 'Disrupting an AI-Orchestrated Cyber Espionage Campaign' (November 2025), reporting that a Chinese state-sponsored group jailbroke an AI coding tool, posing as a legitimate security firm, to run a campaign against approximately 30 organisations with 80-90% of tasks automated and only four to six human decision points per campaign - described as the first largely autonomous, AI-orchestrated attack of its kind. Anthropic's own report notes the model sometimes produced inaccurate or fabricated results during the campaign, meaning some of the attackers' claimed successes were themselves exaggerated; this appraisal treats the underlying capability as documented while noting that caveat. https://www.anthropic.com/news/disrupting-AI-espionage
- Microsoft, 'AI as Tradecraft: How Threat Actors Operationalize AI' (6 March 2026), and Microsoft Digital Defense Report 2025, both confirming, consistently with OpenAI's findings, that nation-state-linked groups from Russia, China, Iran and North Korea use large language models across the stages of an attack, from reconnaissance to script writing and evasion research. https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/
- Center for Security and Emerging Technology, Matthew Mittelsteadt, 'AI Verification' (February 2021), and Wasil, Reed, Miller and Barnett, 'Verification Methods for International AI Agreements' (2024), both concluding that, unlike nuclear weapons programmes, which require large physical facilities detectable by satellite imagery and IAEA-style inspection, AI capability development requires principally compute, talent and code, for which no equivalent, well-established verification regime yet exists. This comparison is presented in the sources as a proposal and an open research problem, not as an established or agreed verification standard, and the specific parallel drawn here between AI and nuclear detectability is this appraisal's own synthesis of that material rather than a comparison either source states in these terms. https://cset.georgetown.edu/publication/ai-verification/
- Epoch AI, Isabel Juniewicz, 'Diversion and Resale: Estimating Compute Smuggling to China' (29 April 2026), estimating that approximately 660,000 H100-equivalent AI chips were smuggled into China by the end of 2025, roughly a third of the country's total AI compute, with an estimated detection rate of only 10-80%; see also RAND, 'Leashing Chinese AI Needs Smart Chip Controls' (August 2025), arguing that export controls can slow but are unlikely to stop a determined state actor. Taken together, this appraisal treats these sources as supporting the proposition that a state could plausibly pursue AI capability development through a comparatively small and difficult-to-track effort, though no documented case of a state using AI specifically to disrupt another nation's AI-dependent critical infrastructure has been identified for this appraisal, and that scenario should be treated as an anticipated rather than an evidenced risk. https://epoch.ai/publications/chip-smuggling
- National Cyber Security Centre, 'AI to 2027' threat assessment (7 May 2025), warning that AI will shrink the window between a vulnerability's discovery and its exploitation, and that capable state-linked actors are likely to benefit disproportionately from a widening gap between well-defended and poorly-defended organisations; see also the NCSC's public statement that hostile states are linked to around three-quarters of cyberattacks on UK critical national infrastructure, a figure not limited to AI-enabled attacks specifically. https://www.ncsc.gov.uk/news/ai-to-2027-threat-assessment
- National Institute of Standards and Technology, 'NIST Updates NVD Operations to Address Record CVE Growth' (9 April 2026), reporting that submissions of Common Vulnerabilities and Exposures rose 263% between 2020 and 2025; see also Tenable, 'Microsoft Patch Tuesday 2025 Year in Review' (10 December 2025), recording that Microsoft alone patched 1,130 vulnerabilities in 2025, including 41 zero-day flaws of which 24 were already being actively exploited before a fix existed. https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth
- Unit 42 (Palo Alto Networks), 'State of Exploit Development', reporting that around 80% of exploits are published faster than the corresponding vulnerability record, meaning attackers frequently move before an official patch exists; this appraisal has not identified a single, industry-wide figure for the average time between a software release and its first critical patch, and treats this statistic as the closest available proxy rather than a direct answer to that question. https://unit42.paloaltonetworks.com/state-of-exploit-development/
- OpenAI, 'Sycophancy in GPT-4o: What Happened and What We're Doing About It' (29 April 2025), an unusually candid postmortem in which OpenAI rolled back a model update after it became dangerously agreeable, in one documented instance validating a user's decision to stop taking prescribed psychiatric medication; OpenAI's own account states the problem passed the company's offline evaluations and limited live testing before wider release. https://openai.com/index/sycophancy-in-gpt-4o/
- Anthropic published a 'Constitutional Classifiers' defence in February 2025 claiming a 95% reduction in successful jailbreak attempts against its models; independent red-teamers subsequently found bypasses, and broader independent research reported breaking every one of several vendors' AI safety defences that had claimed near-zero attack-success rates when tested. This appraisal treats AI jailbreak mitigation as an ongoing, unresolved arms race rather than as a case of vulnerabilities being durably closed in the way a conventional software patch closes a known hole. https://venturebeat.com/security/12-ai-defenses-claimed-near-zero-attack-success-researchers-broke-all-of-them
- Civil Resolution Tribunal of British Columbia, Moffatt v Air Canada (February 2024), holding Air Canada liable after its website chatbot fabricated a bereavement-fare refund policy that did not exist, and rejecting the airline's argument that the chatbot was a 'separate legal entity' for which it bore no responsibility. https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-air-canada-misrepresentation-ai-chatbot
- Waymo issued three separate software recalls of its self-driving vehicle fleet during 2024-2025: in February 2024, around 700 vehicles after two cars struck the same towed truck; a second recall in June 2024; and a further recall of approximately 1,200 vehicles in May 2025 following low-speed collisions with gates and chains. These are US National-Highway-Traffic-Safety-Administration-linked, software-triggered recalls of a safety-critical AI system already in public deployment. https://techcrunch.com/2025/05/14/waymo-recalls-1200-robotaxis-following-low-speed-collisions-with-gates-and-chains/
- Department for Science, Innovation and Technology, 'A pro-innovation approach to AI regulation' (white paper, March 2023, updated 3 August 2023), including the ministerial foreword by the Rt Hon Michelle Donelan MP. https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach/white-paper
- House of Commons Library, 'AI regulation in the UK', Research Briefing CBP-10003 (10 June 2026), which also records Labour's 2024 manifesto commitment, the reported delay to legislation and the absence of statutory powers for the AI Security Institute. https://researchbriefings.files.parliament.uk/documents/CBP-10003/CBP-10003.pdf
- Department for Science, Innovation and Technology, 'AI Opportunities Action Plan' (13 January 2025), including Recommendation 2 (expanding the AI Research Resource 'by at least 20x by 2030'), Recommendation 4 (AI Growth Zones with streamlined planning) and Recommendation 5 (sustainability and security risks of AI infrastructure). https://www.gov.uk/government/publications/ai-opportunities-action-plan/ai-opportunities-action-plan
- Prime Minister's Office and Department for Science, Innovation and Technology, 'Prime Minister sets out blueprint to turbocharge AI' (press release, 13 January 2025), including the productivity estimate and the announced £12 billion investment by Vantage Data Centres. https://www.gov.uk/government/news/prime-minister-sets-out-blueprint-to-turbocharge-ai
- Department for Science, Innovation and Technology, 'Tackling AI security risks to unleash growth and deliver Plan for Change' (press release, 14 February 2025), announcing the renaming of the AI Safety Institute as the AI Security Institute. https://www.gov.uk/government/news/tackling-ai-security-risks-to-unleash-growth-and-deliver-plan-for-change
- Department for Science, Innovation and Technology and Department for Energy Security and Net Zero, 'AI Energy Council to ensure UK's energy infrastructure ready for AI revolution' (press release, April 2025). https://www.gov.uk/government/news/ai-energy-council-to-ensure-uks-energy-infrastructure-ready-for-ai-revolution
- Department for Science, Innovation and Technology, 'A pro-innovation approach to AI regulation: government response' (February 2024), which also proposed future 'targeted binding requirements' on developers of highly capable general-purpose AI models. https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response
- UK Parliament, Artificial Superintelligence Bill (Bill 4288, session 2026-27), a ten minute rule bill presented by Alex Sobel MP. https://bills.parliament.uk/bills/4288
- Letter from members of both Houses of Parliament to the Prime Minister, 11 September 2026, published by ControlAI. https://images.controlai.com/final%20letter.pdf
- GOV.UK, 'Kanishka Narayan MP', recording his appointment on 20 July 2026 as Minister of State (Minister for Artificial Intelligence) jointly in the Cabinet Office and the Department for Business, Innovation, Science and Trade; on the Prime Minister's invitation to attend Cabinet and the merger of departments, see Enterprise Nation, 'Andy Burnham brings AI to cabinet as tech department merged with business'. ; https://www.gov.uk/government/people/kanishka-narayan https://www.enterprisenation.com/learn-something/pm-brings-ai-to-cabinet-as-tech-department-merged-with-business/