Governing AI in the legislative gap: What we can learn from Scotland’s AI strategy

Artificial intelligence (AI) is already being put to use across Scotland.  

In hospitals, AI tools are being used in both medical and administrative work - the NeurEYE project uses AI to scan retinal images for early signs of dementia, for example.  

In schools, a tool called Trellis helps teachers manage the complex safeguarding of pupils with additional needs. 

However, a unique challenge exists for the Scottish government when it comes to AI.  

Whilst it is responsible for delivering health and education outcomes, it does not have the power to regulate the underlying technology used within vital public services.  

This power sits with the Westminster government in London, and creates a “governance gap.” 

The governance gap 

There is a distinct irony in Scotland’s current predicament. Scotland launched its first AI Strategy in 2021, before the UK’s own national framework was published.  

But despite this first-mover advantage, Scotland’s voice has been notably absent from high-profile global stages, such as the 2023 UK AI Safety Summit. 

Furthermore, a significant strategic divergence is emerging between Edinburgh and London.  

While the UK government has favored a sector-led, non-statutory approach to regulation of AI, the Scottish government’s approach since 2021 has signaled a preference for a more structured, rights-based model. 

Although Scotland is not legally bound by the EU AI Act, the government is choosing to align with many of its principles such as classifications of high-risk sectors. 

Beyond policy: the battle for social license 

The country’s new AI Strategy is an ambitious attempt to fill this governance gap through physical and economic levers.  

Central to this is an £8.2 billion (SG$14.1 billion) AI Growth Zone in Lanarkshire, a 9,000-acre site designed to deliver over 3,400 jobs and position Scotland as a European hub for AI infrastructure. 

Infrastructure projects such as the AI Growth Zone face a critical hurdle in acquiring social licenses.  

Several large-scale data centre planning proposals have been rejected in Scotland over the past few years, due to concerns about the massive energy and water demands needed to sustain the data infrastructure. 

For Scotland to meet the targets outlined in its AI Strategy, it must frame these construction projects as community-first assets, working with local residents and emphasising sustainable data centre designs. 

Strategy as pragmatism: control vs. risk 

The most telling aspect of Scotland’s new strategy is its focus on an “AI Stack”.  

By organising action across different layers of AI landscape - such as semiconductor imports, data centres and SME adoption - the Scottish parliament is doubling down on the areas that it has direct agency over. 

Because Scotland cannot legislate AI safety, the government is pivoting its approach to focus on procurement and transparency as its primary tools of digital governance.  

These are softer instruments than formal regulation but will shape behaviour across the public sector if used consistently. 

The most visible expression of this is Scotland’s AI Register, which aims to increase visibility of AI use across all public bodies, moving toward what the strategy calls “transparency floor”. 

This register is a publicly accessible database where public sector bodies disclose what AI tools they are using, how they are using them for and what data they rely on.  

Launched in March 2023, the register is currently voluntary and does little to paint a comprehensive picture of public sector AI use in Scotland. 

However, a phased approach is being taken towards mandatory registration, starting with Scottish government departments. 

Alongside this sits a “chain of trust” approach to the wider regulatory environment.  

By aligning with OECD AI principles and actively advocating UK regulation that mirrors the EU AI Act, Scotland is attempting to construct a de facto regulatory environment from the outside-in.  

It cannot write the rules, but it can position itself so that when the rules are written, Scotland’s public sector is already compliant, and its AI industry already has market access. 

Taken together, these are not stopgap measures.  

The success of Scotland’s 2031 vision will not be measured by the number of infrastructure projects they are successful in completing, it will be measure by public trust emerging in the systems being used in hospitals and schools. 

By focusing on what it can control, Scotland is quietly building a governance infrastructure around AI that is designed to outlast the legislative gap itself. 

Whenever Westminster does act and moves to regulate AI use, Scotland will already be ahead of the curve. 

The article was originally published on interweave.gov’s Substack here. 

----------------------------------------------

Currently a Master of Public Policy candidate at the Hertie School, the author is a Tech Policy & Digital Governance writer at interweave.gov, a digital platform and newsletter focused on fostering global public sector innovation, particularly in GovTech across Europe and Asia.