Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

UK: CMA report on AI Foundational Models

In this Insight article, Omar Shah, Vishnu Shankar, Jack Ashfield, and Nina Jayne Carroll, of Morgan, Lewis & Bockius LLP, discuss the UK Competition and Markets Authority's (CMA) initial report on AI Foundation Models (the FM report) published in September 2023. This report provided the CMA's early views on how foundation models (FMs) are developed and deployed as well as potential future regulatory interventions. This Insight article considers the key takeaways that market players in the artificial intelligence (AI) space should be mindful of as increased regulatory scrutiny persists. 

nuchao/iStock via Getty Images


FMs are machine learning models, i.e., systems or combinations of systems that are trained on vast amounts of data and can be adapted to operate on a wide range of tasks and operations, including conversational and text processing, creating realistic images from natural language descriptions, summarizing information, and answering complex questions, among other features. 

FMs are deployed in user-facing applications across a variety of industries including social media, productivity software, search functions, legal, healthcare, and robotics. Approximately 160 FMs have been developed by firms ranging from established technology firms to new AI companies. 

The FM report, published by the CMA in late 2023, identified the following potential concerns that FMs may bring: 

  • FM developers with market power dominating downstream markets and preventing downstream businesses without FMs from adequately integrating with, and benefiting from, FMs; and 
  • FM developers being denied key resources needed to compete (e.g., computational resources). Increased UK merger control and antitrust enforcement in markets involving FMs is more likely following the FM report. 

The CMA went on in the FM report to set out key aspects of competition regarding FMs and related concerns that these systems may bring to bear on consumers. In light of this, a number of principles were proposed by the CMA to ensure competition and consumer welfare are protected as FMs are developed and deployed. 

In addition, the CMA announced at the end of the FM report that it had commenced a 'significant programme of engagement' that will take place across the United Kingdom, United States, and elsewhere. The CMA will seek a range of views from consumer groups and civil society representatives, leading FM developers, and major deployers of FMs, among other stakeholders, and intends to publish an update on its thinking and proposed principles (detailed below) in early 2024. These next steps for the CMA align with the current drive in the UK for an AI regulation roadmap, which was recently cited in the 'A pro-innovation approach to AI regulation' white paper also published in 2023. Under the white paper, the UK Government will remain engaged in ongoing AI market research over the coming year and beyond. This will see regulators encouraged to publish guidance in this space - an additional CMA report on FMs and the impact of AI is anticipated in this regard. 

Key aspects of competition regarding FMs and related concerns 

The FM report discussed the following key features of competition in FMs and the related concerns. 

Entrenched market power and downstream availability of FMs 

The CMA noted its concern that FMs may be used to entrench market power in downstream or adjacent markets, potentially allowing firms to leverage that market power to unfairly disadvantage rivals and reduce competition in those markets or related markets, e.g., through anticompetitive tying or bundling of FM products and services. 

Access to proprietary data 

The increased use of proprietary data to develop FMs could disadvantage smaller firms seeking to launch or expand their FMs. Currently, developers have two options for sourcing data to develop FMs: 

  • utilize data that they already own; or 
  • purchase data from third-party providers.

One potential future challenge for FM developers that do not already have access to relevant proprietary data is added costs should proprietary data become a requirement for improving FM performance. In addition, data protection law requirements may limit certain developers' ability to use relevant proprietary data. 

The FM report noted that ensuring reasonable access to such data is likely to be essential for preventing established tech companies from blocking new entrants from launching their FMs or expanding their FM capabilities and presence. 

Access to computing power 

Access to computing power is integral for FM development as there is a correlation between the scale and performance of FMs. Smaller developers may be negatively impacted should they not have sufficient resources or partnerships to increase FM model scale, while larger players stand to gain from this aspect of FMs. The CMA has stated that ensuring access to computing power on fair commercial terms will likely be important in ensuring effective competition. 

First- and early-mover advantages 

First-mover or early-mover advantages might negatively impact the development of certain FMs. For example, the FM report noted that competition may be restricted if established tech companies are the only ones that can access sufficient funding, technical expertise, resources, economics of scope and scale, and feedback data. Furthermore, established tech companies are likely to benefit from existing customer bases, which could prevent new competitors from launching FMs. Equally, the FM report acknowledges that being a first-mover or early-mover 'does not guarantee success or the ability to capitalize on this advantage,' particularly if mistakes are committed (such as intellectual property or data privacy infringements).

Open-source FMs 

Open-source FMs are freely shared and can be used at no cost, subject to their licenses (which may prohibit commercial use). The FM report took the position that open-source models promote innovation, enabling more developers to improve existing FMs and develop new ones. 

The CMA cautioned that incentives to maintain open-source FMs are likely to be affected by monetization and increased costs associated with computing power. Restricted access to key inputs could therefore promote the more widespread use of closed-source FMs of larger technology companies, which may ultimately harm competition. 

Economies of scope 

The FM report suggested that economies of scope related to costs could present a significant advantage to incumbents that may benefit from the ability to spread high development costs across a more expansive range of FM services. This could negatively impact new entrants that may only be active initially in providing a smaller number of FM services. 

Barriers to switching 

The CMA highlighted that switching between different FMs could prove difficult for consumers if individual preferences (e.g., an FM virtual assistant that can mimic a consumer's writing style) were lost should they switch. The CMA may be particularly concerned if there were 'artificial' switching costs that arise purely due to product design decisions taken by providers primarily for the purpose of weakening competition, and may focus its enforcement on such artificial barriers to switching. 

Proposed principles 

To ensure competition is protected as FMs are brought to market, the CMA proposed several guiding principles: 

  • Accountability: FM developers and deployers are accountable for outputs provided to consumers. 
  • Access to key inputs: Including data, computing power, expertise, and capital without undue restrictions to ensure that new entrants can challenge incumbents and that successful FM developers do not gain an entrenched and disproportionate advantage from their economies of scale. 
  • Diversity of business models: Both open- and closed-source models enable new capabilities. Open-source models help reduce barriers to entry and expansion. 
  • Consumer choice: Sufficient choice so that businesses can choose how to use FMs (e.g., via in-house FM development, partnerships, APIs, or plug-ins). 
  • User flexibility in switching: Interoperability to support firms mixing and matching or using multiple FMs and customers being able to switch and/or use multiple services easily without being locked to one provider or ecosystem. 
  • Fair dealing: No anticompetitive conduct, including self-preferencing, tying, or bundling. 
  • Transparency: Consumers and businesses are to be given information about the risks and limitations of FM-generated content in order to make informed choices. 

The CMA noted that these principles are not exhaustive and will be updated as its consultation continues in 2024. The FM report highlighted several non-exhaustive factors that could undermine the proposed principles such as anticompetitive behavior by large players, mergers and acquisitions (M&A) activity triggering a substantial lessening of competition, switching restrictions on business users between FM providers, and consumer misinformation. Future UK AI regulation and enforcement will likely seek to implement these principles. 

Data privacy considerations 

While the CMA noted that data privacy falls outside the scope of its review, references to privacy considerations were peppered throughout the FM report, highlighting the interplay of privacy with AI technology generally. We have already considered certain of these references above.

In addition, the FM report considers data requirements at each of the different stages involved in developing an FM (especially the pre-training of FMs) and how these requirements could present potential barriers to entry. Specifically, the FM report considers that certain firms may possess advantages relating to data arising from the firm's activities in other digital markets. That is, firms may benefit from owning large datasets (such as web crawling data generated from a search engine business) in the training of FMs. Nonetheless, the FM report acknowledges that a firm's ability to utilize such datasets to train FMs may depend on intellectual property and data privacy considerations. Overall, the CMA has recognized that data advantages may be harmful to competition, and while privacy was not directly in scope for the FM report, reference to privacy as a factor that underpins this competition concern is noteworthy. 

Increased merger control enforcement 

The CMA stated that there will likely be increased M&A enforcement within the markets involving FMs as certain transactions could undermine the principles proposed by the CMA. The FM report flagged that, while efficiencies can arise from certain transactions, the CMA is encouraging businesses in this space to notify transactions that may meet the CMA's jurisdictional thresholds. 

The CMA has wide discretion to review transactions under the 'share of supply test,' pursuant to which the CMA may review transactions wherein the merging parties overlap in the supply of a good or service of any reasonable description in the UK and where their combined share of supply exceeds 25%. Importantly, the CMA can use a wide range of metrics in applying this test and has even reviewed transactions in which the target had no UK turnover. Following the FM report, the risk of the CMA reviewing FM mergers, imposing remedies, and even blocking such transactions is certainly heightened. 

CMA merger control enforcement is distinct from and in addition to national security reviews by the UK Government of transactions involving UK AI businesses under the National Security and Investment Act 2021. 

Increased competition law enforcement 

Following the FM report, increased competition enforcement in markets involving FMs is highly likely. FM developers with strong market positions should regularly review their business practices to ensure that they comply with the rules prohibiting abuses of market power. 

Examples of potentially problematic conduct could include: 

  • FM developers self-preferencing (e.g., generating responses that promote other products or services offered by the developer);
  • large, vertically integrated technology companies that develop FMs denying 'key inputs' to smaller developers (such as computing power or data) with a view to excluding them from the market; and 
  • tying and bundling strategies. 

The CMA may also focus on barriers to switching and questions of data portability and transparency in reviewing markets that involve FMs. 

Key takeaways 

Increased UK merger control enforcement in markets involving FMs is highly likely in light of the FM report. Parties to M&A transactions involving FMs should also ensure that they appropriately address the potentially increased risk of a CMA review (and also a national security review), both in terms of substance and timing. 

Competition enforcement regarding, for example, tying and bundling of FMs with other products, denying FM competitors access to key inputs needed to compete, and preventing customer switching will also likely be a CMA priority. Companies active in this space should be mindful of the CMA's developing views regarding competition and consumer protection to ensure that their business models do not subsequently come under CMA investigation. The CMA has also acknowledged that intellectual property and data privacy considerations are very relevant to assessing the competition impacts of FMs.

In parallel to the evolving regulation of FMs, companies should also be aware of the proposed Digital Markets, Competition and Consumers Bill which, once in force, will enhance the CMA's powers to require specific conduct from firms found to have strategic market status (SMS) in respect of a digital activity. Companies that do not take into account the developing UK regulation of FMs may risk being designated as having SMS and may thereby be exposed to additional regulatory risk and burdens.

In addition, alongside the CMA, the UK's Information Commissioner's Office (ICO) has already commenced high-profile UK General Data Protection Regulation (GDPR) enforcement actions relating to AI, in addition to issuing, and expecting to issue, significant regulatory guidance relating to AI (especially generative AI). 

Omar Shah Partner 
[email protected]
Vishnu Shankar Partner 
[email protected]
Jack Ashfield Associate 
[email protected]
Nina Jayne Carroll Associate 
[email protected]
Morgan, Lewis & Bockius LLP, London