Oxford Research Proposal Example: Legal policy adviser to regulation strategy (Score 93)

When an automated decision system causes quantifiable harm — a miscalculated credit score, a wrongly flagged asylum claim, a misdiagnosed medical image — the injured party faces a disclosure problem before they face a liability problem. They cannot easily establish what the system did, who controlled it, or which legal duty was owed, because current UK law does not require deployers of high-risk AI systems to maintain or produce decision-level audit records as a precondition of civil liability. This proposal asks: does the absence of a mandatory algorithmic audit-trail obligation in UK law create a structural barrier to tortious redress for individuals harmed by automated decision systems, and if so, what regulatory design would close that barrier without displacing existing common-law principles? The question is bounded in two respects. It is confined to civil liability rather than criminal or competition law. It is also confined to the post-Brexit UK regulatory environment, where the EU AI Act's transparency obligations no longer apply directly and where the Data Protection Act 2018 and the Equality Act 2010 provide only partial, sector-agnostic coverage. That jurisdictional boundary makes the question tractable within a one-year MSc and practically consequential: the UK government's AI Opportunities Action Plan and the ongoing Product Liability reform consultation both leave the audit-trail question unresolved. The research has three subsidiary aims: first, to map the current disclosure obligations that bear on AI decision records under UK law; second, to assess whether those obligations, individually or in combination, provide a functional equivalent to a mandatory audit-trail requirement; and third, to evaluate two candidate regulatory designs — a sector-specific duty imposed through secondary legislation, and a general duty embedded in a revised Product Safety and Liability Bill — against criteria of legal coherence, proportionality, and enforceability. Two bodies of scholarship bear on this question but have not been brought into productive dialogue. The first is the AI accountability literature, which has developed detailed frameworks for algorithmic transparency and explainability. Scholars in this tradition — drawing on computer science, science and technology studies, and administrative law — have argued that meaningful accountability requires ex ante audit requirements rather than ex post disclosure on request. Work in this area has focused heavily on public-sector decision-making and on the EU regulatory model, leaving the common-law liability context underexplored. The second body of literature concerns product liability and negligence doctrine in the context of software and autonomous systems. This scholarship has examined whether AI systems are better classified as products, services, or processes, and has debated whether the development-risks defence under the Consumer Protection Act 1987 effectively immunises AI developers from liability for design-level failures. What this literature has not done systematically is connect the doctrinal classification question to the evidentiary problem: even if a claimant can identify the correct defendant and the correct cause of action, they may be unable to satisfy the burden of proof without access to decision records that the defendant is not obliged to retain. The gap, stated precisely, is this: neither the accountability literature nor the liability literature has examined whether the absence of a mandatory audit-trail obligation functions as a structural, rather than merely procedural, barrier to redress. Existing legal commentary treats disclosure as a downstream litigation tool rather than as a regulatory design variable that shapes whether liability is practically available at all. The research will proceed in three phases. Phase one is doctrinal analysis. I will map the disclosure obligations currently applicable to AI decision records across four sources: the UK GDPR right to explanation under Article 22 and Recital 71; the Equality Act 2010 public sector equality duty; sector-specific rules in financial services and immigration; and the common-law duty to preserve documents once litigation is reasonably anticipated. The analysis will identify what each obligation requires, who it binds, and what sanctions attach to non-compliance, producing a structured gap map rather than an exhaustive doctrinal survey. Phase two is comparative regulatory analysis. I will examine three jurisdictions that have enacted or proposed mandatory audit-trail obligations for AI systems: the EU AI Act, Canada's Directive on Automated Decision-Making, and Singapore's Model AI Governance Framework. The comparison is undertaken to identify the design variables — scope of covered systems, retention period, access mechanism, enforcement body — that determine whether an audit-trail obligation is legally coherent and proportionate, using the UK's existing regulatory architecture as the tertium comparationis. Phase three is regulatory design evaluation. Drawing on the gap map and the comparative analysis, I will construct two candidate regulatory designs and evaluate each against three criteria: legal coherence, assessed by reference to compatibility with existing common-law principles and the Human Rights Act 1998; proportionality, assessed using published regulatory impact assessment methodology; and enforceability, assessed by reference to whether the Information Commissioner's Office or a sector regulator has adequate powers and resources to monitor compliance. The evaluation will draw on publicly available consultation responses, impact assessments, and parliamentary committee evidence. The method is deliberately doctrinal and comparative rather than empirical. A one-year MSc does not provide sufficient time to conduct primary empirical research on AI harm incidence, and the research question is a question about regulatory design, not about the frequency of harm. The choice of method is therefore proportionate to both the question and the degree duration. All primary materials — legislation, statutory guidance, consultation documents, parliamentary committee reports, and the published regulatory frameworks of comparator jurisdictions — are publicly available. No access permissions, ethics approval, or data-sharing agreements are required. The principal feasibility risk is scope: AI liability reform is an active policy area and new materials may emerge during the research period. I will manage this by fixing a cut-off date for primary materials and treating subsequent developments as a limitation rather than a gap. A secondary risk is that the comparative analysis may surface design variables requiring deeper engagement with administrative law in each comparator jurisdiction than a single researcher can sustain; I will manage this by limiting the comparison to published regulatory texts and official guidance rather than case law. No personal data will be collected and no human participants will be involved, so the research raises no ethics review obligations under standard research governance procedures. The Faculty of Law at Oxford houses research activity in regulatory theory, technology law, and administrative law that is directly relevant to this proposal. The Centre for Socio-Legal Studies and the Oxford Internet Institute both maintain publicly documented research programmes on algorithmic governance and digital regulation, and the Bonavero Institute of Human Rights has published work on automated decision-making and due process that bears on the liability question. The Bodleian Law Library provides access to all primary and secondary sources required. No laboratory facilities, specialist software licences beyond standard legal databases, or fieldwork funding are required. The expected contribution is modest and specific: a structured account of the audit-trail gap in UK AI liability law, a comparative inventory of design variables, and an evaluated set of candidate regulatory responses — a contribution to a live policy debate that is currently conducted without systematic legal analysis of the disclosure problem.