TL;DR

• Confidentiality and privilege are different things. Where exactly the boundary falls in a given file is a question for advice, not for a rule of thumb.

• The rights are the client’s. The Isle of Man Law Society’s summary: “Privilege is the right of the client and may only be waived by the client.” Under Rule 3.5.1 of the Advocates’ Practice Rules 2024, only the client, legislation or a court can waive or override confidentiality. But a lawyer can waive privilege in the conduct of litigation, and that does not cure the breach.

• Ask what you are pasting, not whether the prompt is privileged. Privilege attaches to communications, written ones and drafts included, but generally not to pre-existing documents or to facts (Ventouris v Mountain).

• Follow the SRA’s line from its 17 August warning notice. Both free and paid AI systems may pose risks. What matters is “the provider’s terms, settings and technical architecture”: client data in a secure environment, not accessed by unauthorised third parties, not used for training unless explicitly authorised, not retained longer than necessary.

• And be wary of privilege checklists, this one included.

What is Legal Privilege?

Legal professional privilege protects confidential communications from disclosure. It covers communications between clients and their lawyers, material evidencing those communications, and in some circumstances communications between clients or lawyers and third parties.

It is old and it is fundamental. The right has stood for some four centuries. English law treats it both as a fundamental common law right and as a human right. Lord Taylor’s formulation in R v Derby Magistrates’ Court, ex parte B [1996] AC 487 remains the clearest statement of why:

“a man must be able to consult his lawyer in confidence, since otherwise he might hold back half the truth. The client must be sure that what he tells his lawyer in confidence will never be revealed without his consent. Legal professional privilege is thus much more than an ordinary rule of evidence, limited in its application to the facts of a particular case. It is a fundamental condition on which the administration of justice as a whole rests.”

Privilege arises in two ways. They are parts of a single integral privilege, but they have different characteristics and conditions.

Legal advice privilege applies to confidential communications between a lawyer and a client, made for the sole or dominant purpose of giving or receiving legal advice. It also covers communications forming part of what the courts call a “continuum of communications”, aimed at keeping client and lawyer informed so that advice may be sought and given as required (Balabel v Air India [1988] Ch 317; Three Rivers (No 6) [2005] 1 AC 610). The scope of “legal advice” is broad. It is not confined to telling the client the law. It extends to advice about what should prudently and sensibly be done in the relevant legal context (Three Rivers (No 6); Civil Aviation Authority v R (Jet2.com Ltd) [2020] EWCA Civ 35). It does not require litigation. It lasts indefinitely.

Litigation privilege applies to confidential communications between lawyers or their clients and third parties, made for the sole or dominant purpose of conducting existing or reasonably contemplated litigation that is adversarial rather than investigative. It is wider in who it covers and narrower in when it applies.

The position under Isle of Man law

The Isle of Man Law Society published A Summary of Legal Professional Privilege under Isle of Man Law and its Application to In-House Lawyers. It recognises the same two heads. Advice privilege attaches to communications between a lawyer in his professional capacity and his client where they are (a) confidential and (b) made for the purposes of seeking or giving legal advice. Litigation privilege attaches to communications that are (a) confidential, (b) made after litigation has been commenced or contemplated, and (c) made for the sole or dominant purpose of such litigation.

There is also a statutory definition in section 13 of the Police Powers and Procedures Act 1998. It covers communications between a professional legal adviser and his client, or a person representing the client, made in connection with the giving of legal advice; communications between such an adviser, client or representative and any other person made in connection with or in contemplation of legal proceedings and for the purposes of such proceedings; and items enclosed with or referred to in such communications. Items held with the intention of furthering a criminal purpose are excluded.

This will be familiar, and deliberately so. Privilege is one of the major common law concepts on which Manx law tracks the English position. There is no reason to think our courts or our profession intend to depart from it.

Two features of the summary are worth drawing out.

On what privilege attaches to, the summary says:

“Legal professional privilege is a substantive rule of law, not a mere procedural rule of evidence. Privilege only relates to ‘communications’, not to other documents, or to any information per se.”

That is not a statement about medium. A communication can be in writing. Written communications are the paradigm case, and the drafts and documents generated in the course of communicating advice can form part of the communication rather than sitting outside it. That is the continuum point again.

What it restates is the orthodox rule that privilege does not attach to pre-existing documents or to facts. A document does not become privileged merely by being gathered into a lawyer’s file, or by being attached to a privileged communication (Ventouris v Mountain [1991] 1 WLR 607). A fact does not become privileged merely because you told your lawyer about it. The principle is common to both jurisdictions, and the exception in caselaw would likely equally apply: a selection of documents assembled by a lawyer may be privileged where it betrays the trend of the advice (Lyell v Kennedy (No 3)).

On agency, advice privilege “will also protect communications by or with an agent of the lawyer or client if that agent was appointed for the purpose of communicating with the other in order to seek or to give legal advice”. Litigation privilege extends to communications with agents of either. Again, the orthodox position. Agency is how a person other than lawyer and client comes inside the protection.

But the key statement of the general position is this one:

“Privilege is the right of the client and may only be waived by the client.”

The Manx professional materials say the same, adding that the right survives the client’s death. So does the English guidance. So does Derby Magistrates itself: privilege endures unless and until the client waives it. It is a right, not of lawyers or the legal profession, but of clients, whether individuals or corporates. On this, as on most of it, the two jurisdictions speak with one voice.

Confidentiality is not privilege

This distinction gets somewhat obfuscated in commentaries and summaries posted online. Confidentiality and privilege are separate concepts. Confidentiality prevents an advocate from disclosing any information relating to a client without the client’s consent. Privilege allows a lawyer to withhold specific information that they would otherwise be obliged to disclose, in court proceedings for example.

They differ in more than one aspect.

Scope. Confidentiality covers all information relating to a client, whatever its source and whatever its subject matter. Privilege covers only communications satisfying one of the two tests above. The categories are therefore different sizes. Everything in the file is confidential. Only some of it will be privileged.

I would resist going further than that. It is tempting to produce a tidy list of things that are supposedly “confidential but never privileged”: client identity, the fact of the retainer, billing information. Such lists are not safe. Whether any particular item is privileged is fact-sensitive, and material that looks administrative can attract protection where disclosing it would reveal the substance of advice sought or given. The reliable proposition is the narrow one. Confidentiality is wider than privilege. Working out where the boundary falls in a given file is a question for advice, not for a rule of thumb.

Direction. Confidentiality is a duty the professional adviser owes. It restrains them from disclosing. Privilege is a right the client holds. It entitles the client to withhold material from a court, regulator or opponent who could otherwise compel production.

Source. On the Island the confidentiality duty is expressed in Rule 3.5.1 of the Advocates’ Practice Rules 2024:

“Subject to any exceptions provided under the law, an advocate must maintain client confidentiality. This duty is not terminated by the passage of time. Where appropriate an advocate must also supervise his employees or consultants to ensure that they keep client matters confidential. Only the client, primary or secondary legislation, or a competent court can waive or override (as the case may be) the duty of confidentiality. The duty, howsoever arising, does not apply to information about any crime a client indicates that they will, or intend to, commit.”

Privilege, by contrast, is founded in the common law, with statutory definitions adopted for particular purposes.

Who can release it. Under Rule 3.5.1, only the client, legislation, or a competent court can waive or override confidentiality. And as we will see, only the client is entitled to waive privilege.

The relationship between them. Confidentiality is a precondition of privilege. Privileged material is necessarily confidential. Confidential material is not necessarily privileged. So when confidentiality goes, privilege may go with it. The reverse does not hold. The two questions also arise at different times. The confidentiality question arises the moment information leaves your control. The privilege question arises later, usually if someone tries to compel production.

Note also the supervision limb in Rule 3.5.1. The duty extends to supervising employees and consultants so that they keep client matters confidential. That obligation was drafted with human beings in mind. It reads rather differently in a year when the “assistant” processing your client’s file is neither an employee nor a consultant.

For many of the guests at the GCRAI event, the distinction is the practical point. Trust administrators, compliance officers, accountants and corporate service providers hold enormous quantities of confidential client information. Privilege will arise for a much smaller part of it. If they paste a client file into a consumer chatbot, the confidentiality question arises immediately and unavoidably. Sometimes the issue is both confidentiality and privilege.

Waiver, and loss: three different routes

With the concepts established, I can turn to the actual discussion this piece intended to cover, which came from a question on how one’s use of AI could lead to the end of legal privilege. The ways privilege comes to an end are distinct from one another, and worth taking separately. Since the right to assert privilege is the client’s, it is the client who is entitled to waive it. But a lawyer conducting litigation can, without reference to the client, act in a way that waives the client’s privilege. The classic example is allowing an opponent to inspect a privileged document. And separately from waiver altogether, privilege may simply be lost if confidentiality is lost.

So there are three distinct ways privilege ends.

1. The client waives it. Expressly or impliedly, generally or on a limited basis.

2. The lawyer waives it in the conduct of litigation. Note the confinement. This concerns the lawyer’s ostensible authority in running the case.

3. Confidentiality is lost, because the material has entered the public domain.

Route 2 deserves emphasis, because it corrects a common shorthand. It is tempting to say that a lawyer can only ever breach privilege, never waive it, since the right belongs to the client. That is too neat. A lawyer conducting litigation can, without reference to the client, do something that waives the client’s privilege.

What follows, and matters more practically, is that the two concepts are not alternatives. That a lawyer’s act was effective against the opponent to waive the client’s privilege says nothing about whether the lawyer was entitled to do it as between lawyer and client. A waiver that was inadvertent or outside the client’s instructions may still be a breach of duty.

An adviser pasting a client letter into a chatbot at their desk is not route 1. It is some distance from route 2, which concerns the conduct of proceedings. If privilege is affected at all, it seems most likely to be by route 3. Loss of confidentiality has its own body of law.

Whether privilege survives a disclosure depends on whether the material retains its confidential nature. Confidentiality is generally understood as a prerequisite for privilege, and it will have been lost if the communications have entered the public domain. Two things follow. First, “the public domain” is a legal term of art, and its content is for the courts to interpret, case by case. Second, the threshold is demanding. Confidentiality is not necessarily lost merely because privileged communications have been made available online. The Singapore Court of Appeal so held in Wee Shuo Woon v HT S.R.L. [2017] SGCA 23, where privileged emails obtained by hacking and uploaded to WikiLeaks were found to retain their confidential character.

The limited waiver cases point the same way. Disclosure for a limited purpose is not treated as a general waiver, provided the material is not in fact made public. The test is what actually happened, not what the terms theoretically permit. But the limitation has to be a real one. In FM Capital Partners Ltd v Marino [2017] EWHC 3700 (Comm), a company disclosed an investigation report to a defendant ahead of a disciplinary hearing without imposing any express restriction on its use, and was held to have waived privilege in it. Silence about permitted use is not neutral.

Then there is the principle that is likely the most relevant to the AI question. Privileged material can be shared outside the organisation, not merely circulated within it, provided it is shared under a duty of confidentiality, express or implied. That principle is illustrated in Gotha City v Sotheby’s [1998] 1 WLR 114, where legal advice shared with the auction house from which a disputed painting had been bought retained its privilege. There was no express duty of confidence on the recipient, and the court proceeded on the basis that obligations of confidentiality were implied. The everyday application is the sharing of privileged advice with a client’s other professional advisers. An implied duty may suffice. An express one is better. That is the frame within which the AI question should be asked.

What the Upper Tribunal said

The case that prompted the question from guests is UK and R (on the application of Munir) v Secretary of State for the Home Department (AI hallucinations; supervision; Hamid) [2026] UKUT 81 (IAC), published this February. Most commentary calls it Munir. It is one judgment disposing of two unrelated cases, joined under the Hamid jurisdiction, being the inherent power of a court to hold the lawyers before it to proper professional standards.

Ms Munir’s case is about supervision, and its holding generalises well beyond the legal profession. A supervisor who fails to ensure a junior’s work is free of AI hallucinated citations is likely to be more culpable than a lawyer who fails to check their own, because the supervisor fails the tribunal, the public, the client and the junior’s development at once.

The privilege observation comes from the other case. An accredited immigration adviser explained that he had been putting draft client letters and Home Office decision letters into ChatGPT, to improve the former and summarise the latter. At paragraph 21 the Tribunal observed:

“to put client letters and decision letters from the Home Office into an open source AI tool, such as ChatGPT, is to place this information on the internet in the public domain, and thus to breach client confidentiality and waive legal privilege, and thus any regulated legal professional or firm that does so would, in addition to needing to bring this to the attention of their regulator, be advised to consult with the Information Commissioner’s Office. Closed source AI tools which do not place information in the public domain, such as Microsoft Copilot, are available for tasks such as summarising without these risks.”

It is the first time an English tribunal has addressed AI and privilege, which is why it travelled so far so fast.

Its status is worth being clear about. The Tribunal’s own language is “we also observe”. Therefore, in lawyer speak, this is strictly obiter. The point appears to not be in issue between any parties. It arose from an adviser’s candid account of his working habits in a professional conduct hearing. Herbert Smith Freehills Kramer’s note on the case records, with characteristic restraint, that “it is not clear what submissions were made on this issue”, and adds that the point “will no doubt receive further detailed analysis and judicial consideration in due course”. That seems right.

The SRA’s Latest Misuse of AI Warning Notice

The warning notice was published on 17 August and addressed to all firms and individuals the SRA regulates. It repays close reading, and not only for its content.

The notice cites the Upper Tribunal decision. What is noteworthy to me is what it quotes, and how the notice proceeds. It reproduces one clause, expressly attributed as the Tribunal’s observation: that to put client letters and Home Office decision letters into an open source AI tool “is to place this information on the internet in the public domain”. It does not adopt the reasoning as its own. It does not repeat the open-source and closed-source distinction, and it endorses no named product.

Then, in its own voice: “Using AI tools in this way will likely breach client confidentiality and as a result, legal professional privilege may be permanently waived and unable to be recovered.”

And then it proposes alternative criteria:

“Both free to use and paid for AI systems may pose risks to client confidentiality. Depending on the provider’s terms, settings and technical architecture, information entered into AI systems may be stored, retained or used to improve the tool.”

The SRA’s warning effectively says, without contradicting anyone, that price tier and brand are not the variable. Terms, settings and technical architecture are. A paid tool can be unsafe. And it gives a usable standard:

“Client information should only be entered into AI systems where appropriate contractual, technical and organisational safeguards are in place to protect confidentiality. Firms and solicitors should satisfy themselves that client data remains within a secure environment, is not accessed by unauthorised third parties, is not used to train AI models except where explicitly authorised and appropriate to do so, and is not retained longer than necessary.”

The SRA has taken the Tribunal’s concern entirely seriously, restated it in terms a compliance officer can apply, and left the doctrinal question where it belongs, with the courts. The SRA has clearly been grappling with related clarification questions lately, and it shows.

Note too what the SRA’s standard has in common with the Sotheby’s principle. “Appropriate contractual, technical and organisational safeguards” is the regulator’s way of saying what the common law has said for years: shared under a duty of confidentiality, express or implied, and better express than implied.

So how would you design a prompt flow that preserves confidentiality?

This was also a follow up question from guests. Most of the answer for now seems to be procurement rather than law.

Start with architecture. The question is not how a model is licensed but where the processing happens. A model run on your own or on dedicated infrastructure keeps the material inside your environment. Open weights are usually what makes that possible, but they are not themselves the safeguard: an open-weight model called through someone else’s API sends client material out to a third party just as any other hosted service does. Self-hosting is the highest-assurance option, and the most operationally demanding.

Two other approaches would in principle let material stay protected while the computation happens elsewhere. Confidential computing keeps data encrypted in memory during processing, inside hardware enclaves the provider cannot read into. Homomorphic encryption would allow computation on encrypted data without decrypting it at all. Both are technically possible. Confidential computing is available from some providers, though not yet in ordinary use for professional work of this kind. Homomorphic encryption remains far too slow for language models. This is an area where the position could change quickly.

With any hosted service, each prompt is a separate transmission of whatever it contains, to be processed on someone else’s systems. That much is a matter of fact. What it means legally is a further question, and the fact of transmission does not answer it. Confidential material can be shared with an outside party under a duty of confidence without the duty being breached or the client losing privilege. This is Sotheby’s applied to a vendor: your provider should be in the same position as the client’s other professional advisers, outside the firm but bound. So everything turns on the terms for your specific deployment. The terms that matter likely include the exclusion of training rights, a defined retention period with deletion that reaches logs and backups, no review of prompts by the provider’s own staff or contractors, named and bound sub-processors, express confidentiality obligations, encryption, and tenant isolation, meaning that your material is kept partitioned from that of the provider’s other customers. Training rights are the single most important of these. The SRA’s formulation is the standard: client data not used to train “except where explicitly authorised and appropriate to do so”.

The prompt is also not the only place client material goes. Where a system retrieves from your own documents to answer a question, an arrangement usually called retrieval-augmented generation, those documents are first indexed into a store that sits outside the prompt flow. That store is a persistent copy of client material, and it needs the same analysis as the inference endpoint rather than being treated as plumbing. Fine-tuning goes further still: material used to adapt a model is absorbed into its weights and cannot straightforwardly be deleted afterwards. Both are common in legal deployments, and both sit outside a terms review that looks only at what happens to a prompt.

Retention needs a qualification. Shorter is not automatically better, because other duties can pull the other way. Storage limitation under data protection law points toward deletion. The EU AI Act points the other way for anyone within its reach, requiring providers and deployers of high-risk systems to keep automatically generated logs for at least six months (Articles 19 and 26(6)). Professional file-retention obligations, anti-money laundering record-keeping and litigation holds can require preservation for far longer. The regimes are reconcilable, but not by instinct. The question is not how little you can retain. It is whether the period you have settled on is deliberate, and defensible against each duty that applies to you.

The FM Capital point applies with equal force to vendor terms. What the contract does not restrict, it may be taken to permit. And distinct from what a provider will choose to do is what it can be made to do. Data held by US providers is reachable under the CLOUD Act wherever it is stored. It is not only a US question. Article 7 of China’s National Intelligence Law requires organisations to support and cooperate with state intelligence work, and Article 35 of the Data Security Law obliges them to cooperate with security organs collecting data, with none of the published process or transparency reporting that has grown up around the US regime. The point is not that one jurisdiction is uniquely dangerous. It is that compelled access is a feature of the legal system your provider sits in, and it survives whatever the contract says. Worth separating from the question of where a model came from: running open weights of any origin on your own infrastructure involves no provider to compel, while a hosted service does, wherever it is based. That matters for various professional work here, however good the commercial terms.

That much you can specify, procure and audit. The harder question is not about the tooling at all. It is what you are pasting. Privilege attaches to that material, or does not, by ordinary principles, before any tool is involved.

Ventouris held that pre-existing documents obtained by a solicitor for the purposes of litigation do not thereby attract litigation privilege. That is not authority that a third party’s document can never be privileged in any configuration. A selection of documents assembled by a lawyer may be protected where the selection itself would betray the trend of the advice (Lyell v Kennedy (No 3)). There is also an unresolved body of law about the status of copies of unprivileged originals.

Why any of this matters, when the material is confidential either way, is that only privilege protects against compulsion. Where material is confidential but not privileged, an upload may breach a duty owed to the client, but a court or regulator could always have required its production in any event. Where the material is privileged and the upload is found to have destroyed confidentiality, the client loses the ability to resist that production. The first is a wrong done to the client. The second hands something to the other side.

Two shorter points on the lawyer’s own working material. Advice a client obtains from a chatbot instead of from a lawyer does not attract advice privilege. Litigation privilege is a different question, so material a client prepares for the dominant purpose of contemplated proceedings may still qualify. More importantly, advisers should expect to receive AI-prepared client drafts carrying no advice privilege at all, and to have to say so. And the converse does not follow either. Using an AI tool does not create privilege where none would otherwise arise, and a lawyer’s involvement does not supply it. Whether material is privileged turns on the ordinary tests, as summarised above.

Nor is “it involves a third party and litigation is contemplated” always a safe harbour, as the Commercial Court illustrated in June. In Uber London Ltd v White [2026] EWHC 1610 (Comm), communications between a firm of solicitors and a litigation funder were held not to attract litigation privilege. Proceedings were genuinely in contemplation. The documents would not have existed but for the prospective claim. But the dominant purpose was enabling the funder to decide whether to fund, and, adopting Hollander’s formulation, “obtaining funding cannot sensibly be regarded” as conducting litigation. Dominant purpose is a demanding filter, applied to the reason each document came into existence. Sophisticated parties with first-rate representation can get it wrong.

So the practical answer to the design question may look something like this. Whether a privilege claim is ultimately available for any given prompt may be genuinely uncertain. The confidentiality analysis always applies, and it is the one you can control by procurement. Design for confidentiality and privilege looks after itself. Design assuming privilege will save you, and you may find that for a good deal of the material there was never any privilege there to save you with.

Perhaps, then, a matter for the engagement letter. Only the client can waive privilege. Under Rule 3.5.1, only the client, legislation or a court can waive or override confidentiality. An engagement letter that sets out which categories of AI tooling may be used, for what tasks, and on what terms as to confidentiality, converts an unauthorised disclosure into an authorised and limited one. That reflects settled good practice for limited waivers generally: record in writing the terms on which the disclosure is permitted, and the specific purposes for which it is given. FM Capital shows what happens when no limit is specified. It is the cheapest control available.

A caution about the foregoing

Having set out a procurement standard and a good deal of doctrine, I should say plainly what the exercise is and is not worth.

Privilege is a genuinely difficult area. It is riddled with distinctions and potential exceptions like the rest of the common law: sole versus dominant purpose, who counts as the client, whether the adviser counts as a lawyer, which communications fall inside a continuum and which sit outside it, when a third party is an agent, when confidentiality has been lost, when a waiver is limited and when it is collateral. Uber v White is a useful reminder that these are not academic refinements. It took a Commercial Court judgment to resolve whether documents that would never have existed but for a prospective claim were made for the purpose of conducting it, and the parties had excellent lawyers on both sides.

So I would be sceptical of any attempt, including my own, to reduce this to a rule set that lets someone decide, unaided, whether a particular use of an AI tool is safe. Summaries of privilege written to enable technology adoption tend to be of limited value precisely where they are most needed: at the margins, on the facts of an actual file. What is set out above is a way of structuring a conversation with people who will look at your circumstances. It is not a substitute for that conversation, and nothing here is legal advice.

There is a version of this article that ends with a neat table. I have not written it, because I do not think one exists that would be safe to rely on. What I would rather leave you with is a sense of which questions matter, what an England and Wales legal regulator has actually said, and enough of the shape of the law to know when you have reached the edge of what a checklist can tell you.

Parting Thoughts to the Weekend

I mulled over these follow up questions over multiple weekends, and will close this particular one with a few last remarks.

The AI questions are being litigated elsewhere first. Privilege is one of the major common law concepts on which the Manx and English positions align, and nothing in the local materials suggests an intention to diverge. English decisions are persuasive here rather than binding. But the AI cases are reaching the English courts first, and the Upper Tribunal’s observation will likely be tested there before it is tested here, so that is where to watch. On AI specifically, the Isle of Man Law Society has not issued guidance, and the Information Commissioner’s has been signalled but is not yet published. The questions are arriving faster than the guidance.

The Isle of Man Information Commissioner. The Upper Tribunal in UK and R (Munir) v SSHD suggested consulting the Information Commissioner’s Office. In a Manx setting that is the Isle of Man Information Commissioner, under the Applied GDPR. If client material has gone into a consumer tool, the questions are familiar. Is this a personal data breach? Is it reportable? Was there ever a data protection impact assessment? The Island’s Data Protection Maturity Survey in February found only 8% of AI-using organisations believed they were processing personal data at all.

The law will develop, probably soon, and with better argument than a conduct hearing could provide. In the meantime the useful answer does not depend on how it develops, which is fortunate, because none of us can currently say. And for most people here it will not turn on privilege at all, but on the confidentiality duty, which is the live obligation whether or not privilege is ever in play. The question to ask before pasting anything into a prompt box is the one I closed the talk with: would I do this if the client were watching?

If the answer is anything other than an immediate yes, that is not a signal to consult a checklist. It is a signal to ask someone.

AIOM · Artificial Intelligence of Mann · theaiom.im

Sources. Publicly available: Isle of Man Law Society, A Summary of Legal Professional Privilege under Isle of Man Law and its Application to In-House Lawyers; SRA Warning Notice, Misuse of AI (17 August 2026); Advocates’ Practice Rules 2024, r.3.5.1; Police Powers and Procedures Act 1998, s.13; UK and R (on the application of Munir) v SSHD (AI hallucinations; supervision; Hamid) [2026] UKUT 81 (IAC); Uber London Ltd v White [2026] EWHC 1610 (Comm); Wee Shuo Woon v HT S.R.L. [2017] SGCA 23; and the authorities cited throughout, all of which are reported and can be read in full.

The Law Society of England and Wales practice note on legal professional privilege is available to members only. I have drawn on it for orientation, but the propositions above are stated from the underlying authorities rather than from the note, so that readers without access can check the source material for themselves. The same approach is taken to the Isle of Man Bar Examinations ethics materials.

Nothing here is legal advice.

Last month, I spent a Saturday at the Inner Temple in London at a seminar on AI, human rights and the rule of law convened by the Bar Human Rights Committee of England and Wales with UNESCO’s Network of Experts on AI and the Rule of Law. In-person tickets sold out. Representatives from the Bar Council of England and Wales, the Law Society of England and Wales, JUSTICE, Doughty Street and the Thomson Reuters Foundation were in the room. More than a thousand participants in more than sixty-five countries joined by livestream.

The most thought-provoking framing came from Robin Allen KC in the closing session. Why do we believe in the rule of law at all? Because it is what stands between a society and street law. And it depends on one thing absolutely: the loser in any dispute must know enough about why they lost not to go looking for a remedy of their own. Anything that makes judicial decisions less explicable attacks that settlement directly. Current AI systems, ones that are black-boxed, where human oversight is a buzzword, where output is statistically plausible rather than reasoned, sit squarely in that category.

Allen provided a legal opinion to the Open Rights Group in March 2026 on the use of two AI tools by the Home Office: the Asylum Case Summarisation (ACS) tool, which summarises transcripts of asylum interviews, and the Asylum Policy Search (APS) tool, which summarises country-of-origin material (e.g. Country Policy and Information Notes (CPINs), guidance documents, and Country of Origin Information (COI) reports). These systems respectively summarised what asylum seekers said and matched claims against the Home Office’s retained country information. But the asylum seekers involved were not aware of it. The legal opinion concluded that the Home Office’s use of these AI tools in asylum decision-making did not conform with the principles in the AI Playbook for the UK Government and was at significant risk of being unlawful, in potential breach of the Secretary of State for the Home Department’s procedural obligations under Article 3 ECHR, various public law principles, data protection legislation and the public sector equality duty. When a parliamentary question asked how far the Home Office had complied with the Government’s own AI Playbook, Allen’s tally of ministerial awareness was: one hand up in Parliament.

And quietly, a threat aimed at judges themselves. Dr Margaret Satterthwaite, the UN Special Rapporteur on the Independence of Judges and Lawyers, gave the warning I have thought about most since. If a judge’s research and drafting runs through a commercial AI system, whoever can see the queries can see the judge thinking. Well-resourced litigants already model individual judges to predict outcomes and shop forums. France has restricted this. But shortly after the seminar, a colleague sent me Neal Katyal’s TED talk, in which the US Supreme Court advocate describes winning the Trump tariffs case with a bespoke AI system trained on twenty-five years of the justices’ questions and opinions. Katyal described how it predicted many of the questions asked at oral argument, sometimes almost word for word. That is judge-modelling as a star advocate’s openly declared edge. The talk drew its own backlash, too.

But imagine the modelling capability pointed at a bench by someone with worse intentions. Add inadequate protections, and AI-assisted judging becomes a surveillance channel into judicial deliberation, or what Satterthwaite called “epistemic capture”: lock the judiciary into a private system, and the system’s suggestions quietly become the boundaries of judicial thought. AI, she reminded the room, always involves a concentration of power — in the handful of companies that build it — and a potential transfer of power away from the people constitutionally charged with judging.

In some jurisdictions, Dr Kamel El Hilali of UNESCO noted, free-tier ChatGPT is being used to draft entire judgments.

According to the database at DamienCharlotin.com, the current tracked AI hallucination case count stands at 1,782. But Matthew Lee of Doughty Street shared that the interesting cases are no longer the ones where a lawyer gets caught. In the week before the seminar, an Italian court upheld a judgment on appeal notwithstanding a hallucinated citation in it; a US appellate court has done the same. Lee called the endgame the “8th time effect”: a hallucinated case is cited in a judgment, the judgment survives, the fake authority gets cited again — in academic work, in expert reports, in later judgments — until it hardens into legal principle. The corruption doesn’t announce itself. It compounds.

More than one speaker noted that the current England and Wales judicial guidance doesn’t require a judge to disclose whether or how AI was used. Every part-time judge Allen asked reported receiving no AI training at all; there is no mandatory requirement. He called it a total failure of leadership, and drew the comparison: when the Human Rights Act came into force, it was accompanied by two years of mandatory judicial training. The judiciary has done this properly before. It is choosing not to now.

Dr John Sorabji — who is helping prepare the Council of Europe judges’ 2026 opinion on judicial AI use — pushed the concern somewhere subtler. The obvious danger is substitution: the tool, not the judge, drafting the judgment. The insidious one is deskilling. If judges outsource the small cognitive work — summarising, drafting, even email, as many lawyers now do — they are slowly simplifying their own capacity to think and write critically. The limits of my language are the limits of my world. Lawyers, especially those trained in common law, recognise the nuances inherent in language and differing perspectives on the notion of ‘truth’. As one panellist put it, discussions about AI, shaped partly by computer science, often assume there is a single right answer — pushing towards one definition instead of a range of responses, losing nuance and context, reducing it all to writing that gets turned into 1s and 0s. What is a fact? What is fairness?

Sorabji’s half-serious proposal: mandatory minimum hours of AI-free work, the judicial equivalent of keeping the muscles from atrophying. Handing powerful tools to untrained users, he offered, is like giving a Ferrari to a seventeen-year-old.

The seminar was not all scepticism and no solution though. In December 2025, UNESCO published the Guidelines for the Use of AI Systems in Courts and Tribunals. It contains recommendations for judges, court staff and practitioners on the development, procurement, deployment and use of AI in justice settings. It was built from consultations across 160+ countries, designed for national adaptation, and is available online free of charge. In addition, UNESCO’s AI Essentials for Judges for the non-expert bench, its Global Toolkit on AI and the Rule of Law, and an 18-hour self-paced MOOC on AI, justice and the rule of law are also freely available.

To the small jurisdiction that is wondering what to build itself, and what it should take off the shelf, it would seem obvious that these are better starting points than, say, directly adopting Google search result AI summaries and using them to inform judicial thinking.

Materials from various jurisdictions offer useful reference points. Some working examples from the seminar: Brazil piloted its own internal judicial AI carefully, adjusted it, and when litigants started injecting hidden white text into filings to game it, sanctioned the lawyers and published a public alert. Singapore dismisses claims and fines litigants who file hallucinated citations, and litigants in person are directed to the official verification tools, namely the eLitigation GD Viewer for case law and Singapore Statutes Online for legislation. The US federal courts deliberately confine AI to narrow, repetitive work — e-filing automation, first-run transcription with human review, internal knowledge bases — and keep it away from adjudication.

I had more questions than answers from that seminar last month, but one thing is clear. Judges who are quietly experimenting with AI do not have to invent anything new overnight. They have to choose.

I attended the BHRC x UNESCO seminar on AI, Human Rights & the Rule of Law at the Inner Temple, London, 20 June 2026. The event was livestreamed; quotes are from my contemporaneous notes. Views are my own and nothing here is legal advice. This is AIOM, (hopefully) fortnightly from the Isle of Man. Feel free to subscribe if you think the interesting experiments are happening in places you haven’t been watching.

It was hard to imagine a better venue. Ireland is weeks away from taking up the presidency of the Council of the EU. Dublin hosts the European headquarters of Meta, Google, OpenAI, and Anthropic, and its diaspora ties make it a natural bridge between European regulation and North American AI. If Europe has an AI hub, this is it.

The moment that stayed with me was Lucilla Sioli, Director of the EU AI Office, updating practitioners on what the Commission is building. It brought a sense of reality, and of urgency: around the room, firms from inside and well outside the EU (anywhere with an EU client base, really) were in final preparations for 2 August 2026, when the Article 50 AI Act transparency rules become enforceable. The Isle of Man, in a sense, doesn’t feel ready for it yet.

I went to Dublin to understand how the Isle of Man should position itself relative to the EU’s regime. I came back with a more uncomfortable conclusion: for a meaningful slice of the island’s economy working to adopt AI, the positioning question has already been answered before the next Island Plan.

Convergence on the EU rulebook

The clearest pattern across three days: companies are not building bespoke AI governance frameworks for each market. They are looking to adopt a single baseline that satisfies the EU AI Act, because they want access to the European market without running parallel compliance systems. The technical vocabulary is converging too. NIS2, ISO 42001, and the EU’s emerging standards are becoming the de facto language of AI governance in many countries, including in places the EU has no formal authority.

This is the gravitational pull of the European market, operating exactly as it did with the GDPR. Yes, there is the UK GDPR, and Isle of Man GDPR, but they are still versions based on the EU GDPR. This has a sharp implication for a small jurisdiction weighing its own AI framework: the question is no longer whether to align with the EU baseline. In a sense, the market will decide that. The question is what a small jurisdiction can offer on top of convergence.

You may already be caught by the EU AI Act

This is not talked about enough in the Isle of Man. Article 2(1)(c) of the EU AI Act extends the Regulation to providers and deployers established in non-EU countries “where the output produced by the AI system is used in the Union.”

Maybe read that again with an Isle of Man law firm in mind (since I work in one). A firm uses an AI system, be it CoCounsel, Lexis+ AI, or ChatGPT, to help produce a mediation opening speech, a template contract for a client’s business, a set of advice letters. The client is based in Dublin, or Frankfurt, or Paris. The output is used in the European Union.

On my reading, that firm is a “deployer” under the EU AI Act, and the deployer obligations attach to the firm, not to Microsoft or the model provider. I should be clear that this is an argued position rather than settled doctrine: how far “output used in the Union” stretches is one of the live interpretive debates, and the AI Office’s guidance pipeline may yet narrow it. But the better view, I think, is that routine cross-border professional services are caught. If your business is serving EU clients from a non-EU third country, which describes a large part of the Isle of Man’s professional services sector, you should be planning on that basis.

The timeline is uncomfortable, as the Island is currently so busy with Moneyval. The European AI Office and national market surveillance authorities acquire formal enforcement powers, including the power to levy significant administrative fines on non-EU entities, on 2 August 2026. That is eight weeks away.

Some of the AI Act is already in force. The AI literacy obligation in Article 4 has applied since 2 February 2025. It requires training calibrated to each person’s role and the context in which they use AI. The speakers in Dublin were blunt that a single generic e-learning module rolled out firm-wide does not discharge it. If you haven’t started, you are not early. You are behind. At the moment, it appears there is no fine that attaches to breaching this obligation though.

The next wave lands in August: transparency obligations for AI-generated content. Public-facing material that could be mistaken for human-authored work published on matters of public interest must be disclosed as AI-generated. This could include law firm website articles.

One more thing the conference made unambiguous: deployer liability cannot be outsourced. You can’t contract it away to your AI vendor, and one shouldn’t take vendor claims of “AI Act compliant” at face value, because the harmonised European standards that would make such claims verifiable don’t yet exist. Self-certification is the current norm. Caveat emptor, with fines attached.

The EU Timeline

From a distance, the AI Act looked like a big chunk of growing regulation to me, not always linked to how AI tech is morphing (at warp speed). The European AI Office’s implementation programme is serious though: a governance structure built with Member States through the AI Board, regulatory sandboxes, a Scientific Panel, detailed guidance documents, and an AI Act Service Desk for businesses trying to comply (EU Login account or eID currently required). Guidelines on high-risk classification are in consultation now. This is institution-building at scale, and it was on full display in Dublin.

But two things undercut the confidence.

First, the timelines keep moving. The Digital Omnibus (politically provisionally agreed on 7 May, still awaiting formal adoption) pushes the high-risk rules to December 2027 for Annex III systems and August 2028 for products under Annex I. The watermarking transition now runs to December 2026. Each delay is individually defensible, as the harmonised standards the high-risk regime depends on simply aren’t finished. But the cumulative effect is a regime that gains enforcement powers in August while still negotiating what some of its central obligations mean.

Second, the EU’s own instruments don’t yet agree with each other. My favourite example from the conference: the AI Act requires deployers of high-risk systems to retain logs for at least six months, while the GDPR gives the people in those logs a right to erasure. Brussels has produced two regimes that can simultaneously order you to keep and delete the same data. Joint EDPB–Commission guidelines on the GDPR–AI Act interplay were promised for early 2026 and are now expected “imminently”.

The small jurisdiction question

So where does this leave the Isle of Man, a jurisdiction that has allocated a substantial budget and set up a National AI Office behind the ambition of taking AI seriously?

Here is the uncomfortable version: the EU already regulates a large part of future Manx economic activity, extraterritorially, whether Tynwald ever passes AI legislation or not. Anyone tempted to think a small jurisdiction can simply wait and write its own, lighter rulebook and call it a competitive advantage should sit with Article 2(1)(c) AI Act for a while.

There is, though, a model for divergence at the margins. Post-Brexit, the UK quietly rewrote Article 22 of its version of the GDPR: since February 2026, the right not to be subjected to solely automated decision-making, which is a near-blanket restriction in the EU, now bites strictly in the UK only where the decision is based on sensitive personal data. Everything else is relaxed and permitted to a degree, subject to safeguards. It is regulatory arbitrage of a deliberate, surgical kind: keep the framework recognisably European, loosen the specific provision business finds most constraining. Whether the UK (or the Isle of Man) attempts the same manoeuvre with the European AI standards remains to be seen. But it shows that convergence and divergence are not all-or-nothing.

None of this is an argument for fatalism. It’s an argument for precision about what’s actually on offer. Convergence on the EU baseline is happening anyway, so the value a small jurisdiction can add lies in everything the EU machinery does slowly and impersonally: clarity about how the baseline applies locally, fast and authoritative guidance, maybe a regulator you can actually speak to, and legislative gap-filling where the EU regime is silent or self-contradictory. The GDPR-versus-logging conflict will eventually be resolved in the EU at Brussels speed. But a small jurisdiction could publish a sensible position in a month, once there is clarity and consensus.

That is a different and humbler proposition than “first mover advantage.” It might also be a more durable one.

If you run an Isle of Man firm: five things to do now

1. Inventory your AI tools — including the ones embedded in software you already pay for (document management, research platforms, Copilot features).

2. Map tools to people and clients — who uses what, in what context, and whether any output reaches EU-based clients or candidates.

3. Start role-differentiated AI literacy training and document it — the obligation is already live, and the documentation is your evidence of compliance.

4. Review engagement letters and vendor contracts — AI use disclosure for EU clients ahead of August; data processing terms, incident notification, and training-data restrictions on the vendor side.

5. Designate an AI governance lead and adopt a policy — acceptable use, human oversight, incident response — before enforcement powers arrive on 2 August.

I attended IAPP AI Governance Global Europe in Dublin, 2–4 June 2026. Views are my own, and nothing here is legal advice. If any of the above describes your firm, take some. This is AIOM, (optimistically) fortnightly from the Isle of Man. I fell off the posting schedule while I was busy with the Manx Bar Exam (which I thankfully passed with distinction). Please feel free to subscribe if you think the interesting experiments are happening in places you haven’t been watching.

I have just finished reading Dr Chien Lee-feng’s book on the future of artificial intelligence in Taiwan.1 The first thing that struck me was how the book does not really talk much about AI governance. It reads like a national strategy briefing, pitched to government, industry, business owners, employees, parents and young people in one go, about an industrial transition that Taiwan cannot afford to miss.

Dr Chien, the former no. 1 Google Taiwan employee, thinks about AI as an industrial transition. That’s remarkable, because that kind of context is the key to understanding why jurisdictions produce such different AI conversations. What each jurisdiction thinks AI is shapes what it thinks AI governance is for. And what it thinks AI governance is for determines what kind of institutional bet it makes, and when.

I think that makes comparing jurisdictions fascinating. The difference between jurisdictions is not that some have rules and others do not. It is that the rules each jurisdiction writes are shaped by what each thinks AI is for in the first place.

Taiwan: AI as an industrial transition

Taiwan sits at the centre of the global AI supply chain. TSMC fabricates the overwhelming majority of the world’s leading-edge AI accelerators; the island’s hardware ecosystem is inseparable from the frontier-compute economy that OpenAI, Anthropic, Google, and the large Chinese labs all depend on. Chien’s book takes that industrial centrality as the frame within which Taiwan’s AI future has to be reasoned about.

Within that frame, the problems he identifies are almost entirely capacity-side rather than rules-side. Four stand out.

The first is talent retention. Taiwan trains world-class engineers, and then loses many of them to the United States. The AI hardware story is a Taiwanese story, but a significant share of the people who will build the AI software stack over the next decade are doing so in Palo Alto, Seattle, and Cambridge, Massachusetts, not Hsinchu or Taipei. This is not an easy problem to legislate out of existence.

The second is training data in traditional Chinese. Simplified Chinese dominates the internet’s Chinese-language corpus; traditional Chinese (the written script used in Taiwan and Hong Kong) is comparatively under-represented, and much of the high-quality material that does exist is not digitised or not openly accessible due to IP protection. A jurisdiction that wants its own legal, medical, and cultural context to be legible to AI systems has to build the corpus that makes that possible.

The third is quality data for sovereign AI. Even with good corpora, developing models that reflect Taiwan’s legal, regulatory, and cultural specificity requires institutional collaboration that cuts across sectors usually kept apart. Chien notes that the TAIDE and TAME sovereign AI models — built on Meta’s open-weights Llama — were developed by a consortium including the National Science and Technology Council, the Department of Computer Science and Information Engineering and the Department of Information Management at National Taiwan University, Pegatron, Unimicron, Chang Gung Memorial Hospital, and the CCP Group.2 State, academy, industry, and healthcare, aligned around a single technical project. That is what proper capacity-building looks like. I am genuinely curious how these models have been adopted, and how they have performed against frontier alternatives in real Taiwanese use — a question I would have to dig in further. Any views from readers closer to that development would be most welcome.

The fourth, and the one I found most striking, is adoption-timing risk. Chien observes that Taiwan’s economy has relatively robust fallback sectors — mature manufacturing, agriculture, established services — which cushion individual actors from the pressure to adopt AI quickly. The consequence, he argues, is that Taiwan as a whole may drift past the window in which early AI adoption delivers compounding advantage, while other economies with fewer fallbacks move faster out of necessity. This is a governance concern that sounds nothing like the governance concerns dominating Western AI debate. It is not about risk, or liability, or rights. It is about timing — specifically about the failure mode of moving too slowly, not too fast.

Taken together, these are the worries of a technology-intensive, export-oriented, democratically governed jurisdiction whose security posture is aligned with the United States and whose manoeuvring room is shaped by external pressures it did not choose. They are also, unmistakably, the worries of a jurisdiction that has decided AI is primarily an industrial question.

Taiwan’s rules, written to serve Taiwan’s industry

It would be wrong, however, to stop there and conclude that Taiwan has chosen capacity over law. In December 2025, the Legislative Yuan adopted the Basic Law on Artificial Intelligence, which came into effect on 14 January 2026.3 Unlike German or Hong Kong law, Basic Laws in Taiwan is a type of framework or umbrella statute and sits below the Constitution. The Basic Law on AI sets out seven foundational principles: sustainable development and well-being, human autonomy, privacy protection and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability. It also mandates high-risk warnings for AI products and systems classified as such by the relevant competent authority in consultation with the Ministry of Digital Affairs. Finally, it requires all government agencies to review, amend, or enact legislation under their jurisdiction to bring it into compliance with the Basic Law within two years of its commencement. The clock runs to 14 January 2028.

What makes the Basic Law on AI worth reading closely is not the seven principles (as most contemporary AI frameworks name a similar set) but the genealogy of its drafting. In 2004, Taiwan’s Fundamental Communications Act established, without qualification, that the interpretation and application of communications statutes should not prejudice the provision of innovative technologies and services. Twenty years later, when a similar pro-technology clause was included in the Basic Law on AI draft, the Legislative Yuan — after “vigorous discussions,” as per Ms Ken-Ying Tseng’s measured description — added a precondition: the promotion of new technologies and services would prevail over conflicting laws, but only where the seven fundamental principles are adhered to.4 The direction of the concession matters. Pro-innovation was the default; principles were the negotiated qualifier. That is a very particular kind of AI rulebook. It is a rulebook that treats technology-first as the starting premise, and treats the seven principles as the constraints within which the starting premise gets to run.

The Basic Law on AI also instructs MODA to align Taiwan’s framework with international risk-classification standards, establishes a regulatory sandbox, and commits the government to budgetary support, talent cultivation, and mechanisms for data openness, sharing, and reuse to enhance AI-usable data. In other words, the same capacity concerns Chien raises in his book is now codified as statutory obligations on government agencies. The law aligns with the industrial strategy, translated into the operative task to develop statute in the next two years.

Taiwan, then, has not chosen capacity over rules, or rules over capacity. It has written its rules to serve its capacity bet. The two-year legislative review clock is the institutional expression of a judgment that capacity-building and legal clarity have to arrive together. Industry gets certainty; the profession gets an architecture to work within; government gets a programmatic deadline that survives the election cycle.

That is a more disciplined move than most of the AI legislation passed elsewhere in the last eighteen months. And it is a move whose distinctive character is only visible if you read the industrial frame (Chien) and the legal frame (the Basic Law on AI) as one continuous argument, not two separate ones.

England: AI as a liability and professional-conduct question

The contrast with the English conversation is starker than one would expect. In the last fortnight alone, the English AI-and-law conversation has circled around the Civil Justice Council’s interim report on AI in court documents (consultation has just closed on 14 April 2026), Munir v Home Office on AI hallucinations and verification obligations, the UK Jurisdiction Taskforce’s forthcoming legal statement on AI liability, the October 2025 judicial guidance update, and Sir Geoffrey Vos’ continuing public reflections on AI in the legal system.5

Every one of those interventions is a rules-side move in a specific register: the key ideas are professional duties, negligence, and the absorption of a new technology into existing rights and remedies. Chien’s Taiwanese concerns about corpora, talent flight, and fallback-sector drag have no English analogue in the legal-regulatory conversation, because they belong to a different conversation altogether. It looks like the UK’s AI capacity questions are being handled, for better or worse, in other rooms — by the Government’s industrial-strategy apparatus, the CMA, the frontier labs themselves. The courts and the legal profession do what they do well, on common law grounds they understand.

This is not a criticism. England and Wales most probably will have the court volume, the legal market depth, and the institutional infrastructure to make an incremental, case-law-driven approach work. It is coherent for a jurisdiction whose AI capacity questions are being settled elsewhere.

It is simply a different lens. Consequently, the lens produces a different kind of rulebook. Where Taiwan’s Basic Law on AI treats AI as an industrial transition to be supported within principled limits, English common law treats AI as an analytic object to be absorbed within the existing fabric of professional duty, much like the arrival of the fax and email as methods of service of Court documents.

Both jurisdictions are working on rules. They are not the same rules.

Tokyo: commitments extracted, and capacity built alongside

Between the industrial lens and the liability lens, Dr Chien brought up a third move worth noticing, and Tokyo illustrates it.

When Sam Altman visited Japan and met Prime Minister Kishida in April 2023, and returned again to speak at the University of Tokyo in February 2025, the discussions around the visits emphasised OpenAI’s Japan-specific commitments: a Japanese-optimised GPT-4 model, collaboration on analysing publicly available Japanese government data, an OpenAI Japan office, and eventually a SoftBank-OpenAI joint venture.6 The point is, a frontier lab will make locally-tailored commitments — tuned models, local offices, joint ventures with national champions, data-collaboration frameworks — when a jurisdiction has enough leverage to ask.

The important move, though, is what Japan has done alongside those commitments, not because of them. Japan did not sit around and wait for OpenAI. Their National Institute of Advanced Industrial Science and Technology opened the ABCI 3.0 supercomputer to industry and universities for foundational model development in January 2025. The GENIAC programme has funded thirty Japanese-language foundation-model projects since February 2024. Sakana AI and Rakuten have built and released Japanese-optimised models, some of them open-source.7 The commitments extracted from OpenAI are real, but they are a supplement to Japanese sovereign capacity, not a substitute for it.

Nor are capacity programmes Japan’s only legal-architecture move. Most recently this month (April 2026), the Japanese Cabinet approved an amendment bill to the Act on the Protection of Personal Information that removes the opt-in consent requirement for third-party provision of personal data, and for the acquisition of publicly available sensitive personal information, where the data is to be used for “statistical purposes” — a term the bill reads broadly enough to cover AI development and training. The same bill introduces an administrative fine regime for violations of data-processing obligations. One instrument, two directions at once: loosened consent rules to enable AI training data to move at scale, tightened enforcement to make the privacy floor stick.8[^8] Taiwan’s Basic Law on AI pairs industrial-strategy support with seven principled constraints; Japan’s APPI amendment pairs training-data liberalisation with a new penalty regime. The move is not unique to either jurisdiction, but the pattern is becoming identifiable. Rules that reflect what a jurisdiction thinks AI is for are rules that move on more than one axis at once.

The lesson for jurisdictions further down the scale is not “demand more from OpenAI.” It is that extracting commitments from frontier labs is worth doing only if you are also building something that makes the commitments bite — and that legal architectures built to serve an AI strategy have to calibrate enablement and enforcement as a single, integrated move. A jurisdiction that is not building anything gets press releases. A jurisdiction that only enables, or only enforces, gets an incomplete rulebook.

The Isle of Man: manoeuvring room, and what to do with it

The Isle of Man is a Crown Dependency. It is not part of the United Kingdom, and it is not part of the European Union. Tynwald — the Island’s parliament, and one of the oldest continuously sitting legislatures in the world — passes its own primary legislation. It does so, however, subject to review by the UK Ministry of Justice before Royal Assent, and Westminster retains, under the framework articulated in the 1973 Kilbrandon Report, a reserved power to legislate directly on Isle of Man matters where the good governance of the Island or the United Kingdom’s legitimate interests are judged to require it.9[^9]

In practice, this is less a ceiling than a permanent negotiation. Much of the delicate conversation between the Island and the UK is about where the line between internal Manx matters and external matters falls, and that line moves, slowly, through decades of practice rather than constitutional rewriting. I have not seen this arrangement described as clearly in public-facing material as it is explained to students on the Manx Bar course, which is itself a small fact worth sitting with. But it is the constitutional reality within which any Isle of Man AI strategy has to be made.

Taiwan’s manoeuvring room is constrained, structurally, by a contested international status and by a security posture aligned with the United States. The Isle of Man’s manoeuvring room is constrained, structurally, by its relationship with the Crown and with Westminster. Of course, these are not analogous constraints. Taiwan has dense domestic capacity — hardware, universities, cross-sectoral consortia, an active industrial base, and now a statute that programmes that capacity into a two-year legislative cycle — and makes institutional bets inside a geopolitical constraint it did not choose. The Isle of Man has legislative agility — a parliament that can move a bill from introduction to Royal Assent in months — inside a relational constraint that is negotiated rather than imposed. Neither set of tools is complete. What each jurisdiction can do with the tools it has is a different question.

The Isle of Man does not have a frontier-model industry, and is unlikely to acquire one. It has an emerging deployment layer — a small but growing group of Manx firms developing AI workflow products, some of them explicitly marketed to offshore jurisdictions — which looks broadly similar to the deployment layers forming in dozens of other jurisdictions of comparable scale. What is more distinctive is what the Isle of Man has started doing legislatively with data.

The Data Asset Foundation, and an extension of the logic

On 24 March 2026, Tynwald passed the Foundations (Amendment) Bill, with Royal Ascent pending, which would create a new legal structure: the Data Asset Foundation. A DAF is a licensed entity — a new type of legal personality like a company but closer in nature to a foundation or a trust — designed as a legal wrapper to hold data, set enforceable rules about how that data can be used and by whom, and allow the data to be treated as a formal capital asset.10 Secondary regulations are in development; a six-month pilot with early adopters is now running; full enactment is scheduled for later in 2026.11

Two features of the DAF regime are worth isolating.

The first is that the DAF is positioned as a structure outside the reach of the US CLOUD Act and outside the UK and EU regulatory frameworks.12[^12] Its pitch is not that the Island has built a better version of what larger jurisdictions offer, but that it has built something larger jurisdictions cannot offer, because they are inside regulatory regimes with which the DAF is deliberately non-aligned. The Crown Dependency position — not part of the UK, not part of the EU, not subject to US extraterritorial legislation — is being treated not as a marginal status to be overcome, but as the defining feature of the product.

The second is that the DAF regime is being delivered by an emerging ecosystem of data hosting and corporate service providers now offering DAF administration and governance services. The infrastructure is not hypothetical. It is being built.

It would be too early to evaluate this regime. It is closer to a bet of a particular kind — not Taiwan’s capacity bet, not England’s liability bet, but a jurisdictional-arbitrage bet. The proposition is that strategic regulatory distance from larger powers is itself a valuable asset, and that a small Crown Dependency with legislative agility and an established financial-services regulatory culture is unusually well placed to sell that distance in a structured, legally-cognisable form.

Here is my speculation. If the DAF bet works — if, by 2027 or 2028, there is a visible body of international data custody business operating through DAFs — then it is entirely plausible that a post-September-2026 Tynwald will want to extend the same logic to AI. Not just data as an asset, but AI models, AI training runs, AI workloads, and AI governance obligations structured in, and administered from, a jurisdiction deliberately positioned outside the CLOUD Act, outside the EU AI Act, and maybe even partially outside whatever the UK’s eventual AI legal landscape looks like. An “AI Asset Foundation” is not something anyone has publicly proposed. But the institutional logic that produced the DAF points in that direction, and the Island’s regulatory culture — built over decades for financial services — is, for better and for worse, precisely the kind of culture that can productise a legal concept once the political decision is made.

This is a bet Taiwan cannot make. Taiwan’s security and trade posture requires alignment with the United States on AI supply-chain matters, with all that implies about export controls, compute access, and regulatory convergence. Its manoeuvring room runs in a different direction. What Taiwan can do — build state-academy-industry-hospital consortia to develop sovereign models, retain talent, digitise and steward its linguistic and legal corpus, write a Basic Law that codifies the industrial-strategy framing into statute — the Isle of Man cannot. What the Isle of Man can do — hold data and, possibly, AI assets in a structure deliberately outside the major regulatory regimes — Taiwan cannot. The contrast and complementarity are, to me, noteworthy. The lesson-flow, honestly, probably runs mostly in one direction: there is more the Isle of Man can learn from Taiwan about the patient, cross-sectoral work of building capacity than there is the other way around. But the jurisdictional-arbitrage move is a move, and it is one worth potential Taiwanese readers understanding, because a version of it is being built about two thousand miles from Taipei, in a Crown Dependency of 85,000 people.

Three clocks

Taiwan thinks AI is an industrial transition, and has written a Basic Law that treats governance as the architecture that transition is run through. England and Wales thinks AI is a legal liability and professional-conduct problem, and its courts and profession are doing the incremental, case-law-driven work of absorbing a new technology into its common law jurisprudence. Japan, pragmatically, thinks it is both — something to be built and something to be negotiated with — and has the state capacity to do both at once. The Isle of Man seems to be in the process of deciding if AI is, for it, a jurisdictional-arbitrage question: a question about what kind of regulatory distance the Island can offer that larger jurisdictions structurally cannot.

None of these lenses is wrong. Each is answering a different question, shaped by the manoeuvring room the jurisdiction actually has. The interesting thing is that they are not substitutes. The industrial lens and the liability lens and the arbitrage lens each illuminate parts of AI governance the others do not, and a jurisdiction paying attention to all three — not just the one its own structural position pushes it toward — is better placed to make whatever institutional bet it ends up making.

Three clocks are running through 2026 and 2027, and they matter because they set the deadlines by which the bets actually have to be placed.

Taiwan’s clock is statutory. The Basic Law on AI requires every government agency to complete the review, amendment, or enactment of legislation in its jurisdiction by 14 January 2028. That deadline survives elections, cabinet reshuffles, and shifts in political mood. It is running whether anyone chooses to pay attention to it or not.

The European Union’s clock is regulatory, and currently uncertain. The statutory deadline for compliance with the Annex III high-risk provisions of the EU AI Act remains 2 August 2026, but the Commission’s Digital Omnibus proposal — on which the Parliament’s IMCO and LIBE committees voted jointly on 18 March 2026, and which the Parliament adopted as its negotiating position in plenary on 26 March 2026 — would push that deadline to 2 December 2027 for stand-alone high-risk AI systems, and 2 August 2028 for high-risk AI systems embedded in products already regulated under Annex I. Trilogue negotiations with the Council are expected to begin in April. Whichever deadline ends up binding, that is the compliance horizon EU-facing businesses are facing.13

The Isle of Man’s clock is democratic. The general election is scheduled for September 2026. Whatever AI strategy the Island commits to for the next five years will be chosen by the Tynwald that election returns. The manifestos being drafted over the coming months are where the direction actually gets set. Unlike the Taiwanese and European clocks, the Manx clock is not set by statute or treaty. It is set by the electorate, and by the candidates who choose to put AI governance on their platforms.

So we have three jurisdictions with different structural questions converging on the same approximate timeline. Chien’s book is, among other things, an argument that Taiwan needs to make its bet soon, because the industrial window is closing. The Isle of Man, on a different clock but the same horizon, is making up its mind, potentially deciding on what the Island is willing to commit to for the next five years.

I will be in Dublin for the IAPP AI Governance Global Europe conference in June, where the state of the Digital Omnibus and the high-risk rollout will likely be one of the conversations in the room. I will report back on what the EU is actually going to ask of anyone doing AI-adjacent business from a jurisdiction of our size.

In the meantime, the decision the Isle of Man is in the process of making is not a bet to imitate the EU, or the UK, or Taiwan. It looks like a bet on what the Island’s Crown Dependency status and established regulatory culture can build that no larger jurisdiction structurally can. What the September 2026 election will decide is whether the Island is willing to make that bet deliberately, or by default.

AIOM is published fortnightly from the Isle of Man. Next issue: the UKJT legal statement, when it lands.

Except this is not entirely hypothetical. In Munir v Home Office [2026] UKUT 81,1 the England and Wales Upper Tribunal delivered another stern warning on AI hallucinations in legal submissions.2 The judgment is blunt: legal professionals who cite fake cases fail their professional obligations, supervisors who don’t catch the errors are likely more culpable than the juniors who made them, and uploading confidential documents to an open-source AI tool like ChatGPT places client information in the public domain, thus breaching confidentiality and legal privilege in one step.

Munir is not an isolated event. Courts are encountering AI-related issues with increasing frequency, from reliance on AI-generated evidence,3 to the use of smart glasses for witness coaching,4 to the question of whether a defendant’s conversations with a GenAI platform were protected by legal privilege.5 AI is already in the courtroom. The question is whether the rules will catch up before something goes seriously wrong.

Different jurisdictions are answering that question differently, perhaps reflecting fundamentally different views of who should govern AI in the legal profession. As we finish the first quarter of 2026, it is worth comparing the approaches, because the Isle of Man will need to choose one.

The English Approach: Top-Down, Judiciary-Driven

The approach of England and Wales to AI in legal practice is being built through the courts.

The Civil Justice Council, chaired by Sir Colin Birss, has published an interim report and consultation on the use of AI for preparing court documents.6 It covers four categories: statements of case, skeleton arguments and other advocacy documents, witness statements, and expert reports. The key proposal is that where AI has been used to generate evidence on which the court is asked to rely, legal representatives should be required to make a declaration. More routine uses - such as transcription, spell-checking, administrative tasks - would not trigger the requirement.

Transparency is a good thing. But the edge cases will be interesting. If AI has been used to organise correspondence and handle discovery that forms the factual matrix of a witness statement, or your client has incorporated AI workflows into their daily working life and the instructions to you are not entirely human-produced, would you be safe to declare no AI was used on the basis that the witness statement itself was drafted by you? These lines are not as clear as the consultation might suggest.

The broader judicial direction is clear though. On 31 October 2025, the judiciary issued updated guidance for judicial office holders on AI, replacing its April 2025 version.7 Sir Geoffrey Vos, the Master of the Rolls, has spoken publicly about the need to engage with AI in the legal system, specifically calling for debates about human rights, the future role of human judges, and the profession’s readiness.8 The UK Jurisdiction Taskforce’s consultation on liability for AI harms under English private law, for which Sir Geoffrey wrote the introduction, closed on 13 February 2026. The report is anticipated.9

After Munir, the common law is doing what it does: using existing professional obligations to absorb a new technology. No new legislation has been required, although new AI-specific laws are being considered. The courts are telling lawyers what they must disclose, and caselaw is setting the consequences for failures. This approach is coherent for a jurisdiction with high court volume, a large and well-resourced bar, and an active judiciary. The question is whether it is right for everyone.

The Singaporean Approach: Practitioner-Facing, Toolkit-Based

Singapore has been building its AI governance infrastructure since 2019, with frameworks spanning government, industry, and now the legal profession specifically.10

On 6 March 2026, Singapore’s Ministry of Law published its Guide for Using Generative AI in the Legal Sector.11 It is worth reading in full (yes, all 50 pages of it) because it represents something quite different from the English approach.

The Guide is non-binding. It addresses law firms and in-house teams directly, rather than being court-facing. And it is relentlessly practical. It includes sample internal GenAI governance policies, employee handbook clauses, letter of engagement templates, and a vendor assessment checklist. This is not a statement of principle. It is a toolkit, with implementation steps mapped to three progressive adoption stages, designed so that a two-partner firm and an international firm’s Singapore office can both use it.

One of the most useful features is its risk-based oversight framework, which distinguishes between human-in-the-loop (active review before output is used) and human-on-the-loop (monitoring with intervention only when anomalies arise), mapped to whether the task is internal or external and whether the output has legal, reputational, or financial consequences. Have a look at the diagram at page 18. This is what practical AI governance looks like. It is not glamorous. It is checklists and data classification tables and vendor assessment questions. It gives you specific key concepts to consider (that you can Google) when you’re building your firm’s AI policy. But it is the kind of framework that prevents a firm from uploading client files to ChatGPT and discovering the consequences after the fact.

The Guide is particularly strong on data governance: tiered data classification (public, internal, confidential, highly confidential, prohibited), specific guidance on free-to-use versus enterprise AI tools, and contractual safeguards for vendor selection. For a jurisdiction like the Isle of Man, where much of the legal work involves licensed financial services and regulated activities, this is directly relevant.

Singapore’s courts have also acted. Since 1 October 2024, the Guide on the Use of Generative AI Tools by Court Users applies across the Supreme Court, State Courts, and Family Justice Courts.12 It does not mandate a declaration of AI use, but requires users to be prepared to identify AI use where directed by the court. In other words, a lighter touch than the CJC’s proposed mandatory disclosure.

The Singapore approach says: we trust the profession to govern itself, and here are the tools to do it well. This is arguably the result of years of digitalisation and capacity building. Beyond the legal sector, Singapore is investing in AI literacy across the whole population. In his Budget 2026 speech, Prime Minister Lawrence Wong announced that Singaporean citizens enrolling in AI training courses will receive six months of free access to premium AI tools.13 The Law Society of Singapore already offers a Productivity Solutions Grant for pre-approved legal technology solutions.14 The direction is clear: institutional support for responsible adoption, across the profession and beyond. The government has removed the biggest barriers and lowered friction to aid adoption, and promised to take its people along the journey as the nation navigates the changes brought by AI.

The Australian Approach: Principles-Based, Court-Led

Australia offers a third model. Several state supreme courts have issued AI guidelines for litigants. These are court-led, but principles-based and softer in tone than the English or Singaporean materials.15

The Supreme Court of Victoria’s Guidelines for Litigants: Responsible Use of Artificial Intelligence in Litigation,16 issued in May 2024, is the clearest example. It sets out 12 principles rather than mandatory rules. Disclosure is encouraged: parties and practitioners “should” disclose AI use to each other and the court but it is not mandated. The Court is candid about GenAI limitations, stating explicitly that output from general-purpose tools “is not presumed to be correct” and is “more likely to produce results that are inaccurate for the purpose of current litigation.”

One principle is particularly relevant for a small jurisdiction. Principle 8(d) warns that AI output may be “inapplicable to the jurisdiction, as the data used to train the underlying model might be drawn from other jurisdictions with different substantive laws and procedural requirements.”

For the Isle of Man, this is not a theoretical concern. It is an acute one, and it connects directly to the points I raised before about the accessibility of Manx law online. Manx law is a distinct legal system. As a Crown Dependency, the Isle of Man has its own statutes, its own jurisprudence, land law with Norse and Celtic origins, and its distinct constitutional and administrative frameworks. Its common law references English cases in some areas but not others. If Manx judgments and legislation are not accessible online, they are almost certainly not in the training data of any major AI model, or, for that matter, in the databases of major legal research tools like Westlaw and Lexis.

The Australian approach shows that court-level guidance does not require the formality of a consultation or a state-led development programme. It requires judicial and professional leadership, and a willingness to put principles on paper. For a small jurisdiction with a handful of Deemsters and a collegial bar, this might be the most natural starting point.

The Isle of Man’s Time to Choose

In the Isle of Man, the judiciary has yet to adopt a position on AI in legal practice. The Law Society’s current approach has been to leave it to individual firms to adopt their own responsible AI policies. At a time when every comparable common law jurisdiction, from England to Singapore to multiple Australian states, has issued at least some form of guidance, the Isle of Man’s current position is, in effect, that there is no position.

It is worth pausing on what being free to adopt their own responsible AI policy means in practice. A sole practitioner here is expected to develop their own AI governance framework from scratch, covering disclosure, confidentiality, data classification, vendor assessment, and professional liability. The resources to do that well exist: Singapore has just published a 50-page guide with templates and checklists. But the expectation that every firm will independently discover and adapt those resources is optimistic. Guidance from a professional body does not restrict practitioners. It equips them. Or at the very least, they would be less likely to just ask ChatGPT to generate an AI policy for their firm. The Law Society in England and Wales has an AI strategy too.17

The Isle of Man does not need to choose just one model. By reviewing and comparing what England, Singapore, and Australia have done, it can adapt what suits the island’s context. But a choice does need to be made, and it needs to be made soon. The CJC consultation closes on 14 April. The Singapore Guide was published on 6 March. The Australian guidelines have been in effect for up to two years. This conversation is overdue.

But there is a deeper issue behind the guidance question, and the most recent UK consultation report brings it into focus. On 18 March 2026, the UK government published its report on copyright and artificial intelligence under Section 137 of the Data Use and Access Act.18 The report addresses how copyright works are used in AI training and, based on the strong concerns on the proposal, it confirms the government will not pursue a broad copyright exception but will work with industry on input transparency and best practices. Whatever one thinks about the copyright questions, the report signals that the UK government is actively thinking about what data goes into training AI systems and how.

This should concentrate minds in Douglas, but perhaps from the opposite direction. The UK’s concern is about protecting copyrighted works from being scraped for AI training without permission. The Isle of Man’s concern should be that its legal data is not being used for AI training at all, because it is not systematically and publicly available. AI tools used by Manx advocates will produce outputs trained overwhelmingly on English, American, or Australian law, but very little Manx law. Even if the island wants to position itself as AI-friendly, that positioning is not effective if its own body of law is largely invisible to AI systems. The government’s current decision to block bots from indexing government websites actively prevents AI systems from learning about the Isle of Man as a jurisdiction.

Issuing guidance on AI use in legal practice is necessary. But it is not sufficient. The work of making the Isle of Man’s legal system legible (to humans and to machines) remains the foundation. Not as a concession to technology companies, but as a precondition for the island’s AI adoption ambitions to mean anything.

The question is whether anyone is going to set the rules before something goes wrong.

AIOM is published fortnightly from the Isle of Man. Next issue: I’ll look at the UK Jurisdiction Taskforce’s consultation on AI liability and what it means for the Isle of Man.

This country is often the least well known British Crown Dependency, with a population of 85,000 and a physical island the size of Singapore. It offers a beautiful UNESCO recognised biosphere, rolling hills of farmland, a low tax environment, plenty of strong wind, and a community willing to pour resources to educate its population (and to find ways to entice the young to return).

For a small jurisdiction, the question is not “can we keep up with AI?” but “can we build something specific and useful faster than the big states can build something comprehensive and slow?” and “how do we equip the population when technology is changing the world so rapidly?”

I’m starting this substack to keep track of the AI experiment in this small jurisdiction, and to scan the horizon of how it compares to others. 2026 will be a pivotal year. As someone who came to this island with fresh eyes and was invited to the table, I decided my contribution will be my perspective, of learning about the Isle of Man while drawing on what I’ve experienced elsewhere.

It is fair to say the Isle of Man is not reaching for first mover advantage with AI. If our advantage is not speed, could we at least be interesting and insightful with how we handle it?

In my view, the Isle of Man has an infrastructure gap it needs to plug before any kind of serious AI development.

As I have been expressing my surprise since I started working in this jurisdiction, the Isle of Man needs to make its laws more accessible. It is one of the few common law jurisdictions that do not publish their judgments on the World Legal Information Institute (WorldLII) network. It does not yet have its body of case authorities and legislation reliably accessible online in a searchable format. The government websites have a script banning bots, search engines and AI from indexing and reading their contents. Some secondary legislation, such as the Civil Service Regulations, does not have an official full body of text available1.

There is no way to tell how many investors and potential businesses have been put off by this lack of publicly accessible information, or have simply skipped over this jurisdiction because things are much clearer online for other countries. These are the digital foundations for building a functional regulatory environment. Companies need to be able to access and evaluate the legal landscape. This is true even if you’re not talking about AI, but even more so when a company is evaluating whether to deploy AI from the Isle of Man. Without that, any regulatory certainty advantage evaporates.

This is a credibility issue. You cannot credibly govern AI if your own laws are not accessible. This is not a criticism, but a sequencing issue. You need to build the foundation before the tower. Without the foundations solidly prepared, any rushed move will show up as first mover disadvantage instead.

It’s been two months since the establishment of the National AI Office. If small democratic jurisdictions can build credible AI governance, they create options. If they can’t, the conversation defaults to the giant players. But the Isle of Man will not do AI like the US, China, or Singapore. It’s a completely different regulatory environment. I’ll try to explain how and why, and share my observations from watching AI and the law, in writing here. With some luck, I also hope to improve my writing skills for non-legal drafting. I’ll post every fortnight. Thanks for your time.