AI Policy

Grok's Designer Is The Defendant, Not The Platform

A UK member of parliament is suing xAI as the builder of Grok under data protection law, and asks the High Court to order permanent technical measures on the model.

AI PolicyBy Servola Tech Desk2026-07-294 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Grok's Designer Is The Defendant, Not The Platform

Key takeaways

A UK member of parliament filed at the High Court on 3 June against xAI as the model's developer rather than against the platform that carried the images, which means a single data subject can pursue an engineering remedy without waiting for a regulator.
The causes of action are breach of data protection law and misuse of private information, both of which long predate the Online Safety Act and neither of which requires Ofcom to act first.
The remedy sought is an order that xAI implement effective and permanent technical measures, so the thing under judgment is how the model was configured rather than what a moderator failed to remove.
Ofcom opened its investigation into X on 12 January and it is still open, while the House of Lords launched a review of the Act itself on 27 July with written evidence due by 5pm on 7 September.

The claim names xAI, not X

On 3 June a Labour member of parliament, Jess Asato, filed a claim in the High Court in England over sexualised images of her that users generated with Grok in early January, after she had publicly criticised Elon Musk and the product. The causes of action are breach of data protection law and the tort of misuse of private information. The defendant is xAI, the company that built and deployed the model. It is not the platform that distributed the output.

That choice of defendant is the whole story. Her solicitors at AWO, led by Ravi Naik with Lucie Audibert and Alex Lawrence-Archer, describe it as one of the first claims to test liability for the design of an artificial-intelligence system. Naik's framing is that the outcome "was a choice, not a glitch", and Asato's own statement puts it in the same terms: the capability "is not an accident, nor misuse, it is a design choice by its creators". Reuters reported on 28 July that she is seeking an order requiring xAI to implement "effective and permanent technical measures". xAI has not commented.

Two instructions that cannot both hold

What makes the design argument more than rhetoric is what the filings put on the record. According to the court documents, the model was instructed to refuse to assist with criminal activity, and in the same configuration told that it had no restrictions on adult sexual content or offensive content, and no restrictions on fictional adult sexual content with dark or violent themes.

Those two instructions sit in one system. A court does not need to understand transformer architecture to read them side by side and ask which one the developer expected to win. That is the evidentiary shape of a design claim, and it is why the system prompt has quietly become the most consequential document a model deployer writes.

It is worth being precise about what is not being argued. Nobody is claiming the users who produced the images are blameless, and nobody is arguing the model malfunctioned. The claim is that a foreseeable output was permitted by configuration, and that permitting it is an act the developer performed.

Seven months of regulator, one open case

The statutory route has been running in parallel and has produced less. Ofcom opened a formal investigation into X on 12 January under the Online Safety Act, covering compliance with the core duties on illegal content and child safety. The maximum penalty is 18 million pounds or 10 percent of qualifying worldwide revenue, whichever is higher. In late July the investigation is still open. The Information Commissioner's Office has a separate data-protection inquiry, and the European Commission is examining the same conduct under the Digital Services Act.

On 27 July the House of Lords Communications and Digital Committee launched its own inquiry into whether the Act works at all. Its chair, Baroness Keeley, said the legislation was seen as a watershed moment when it passed and that "it is now clear that the Act is not working as well as it should". The committee is examining Ofcom's pace, interpretation and enforcement as well as the statute, and it wants written evidence by 5pm on Monday 7 September.

Set the two tracks against each other. One is a regulator seven months into a case against a platform, with a money penalty at the end of it. The other is one individual asking a judge to order a change to a model. The second is faster, needs no regulator, and asks for something a fine cannot deliver.

What to change if you ship a model

The exposure this opens is not confined to xAI or to image generation. Any company that builds, fine-tunes or deploys a generative model that can reproduce a real person is handling that person's personal data, and in the United Kingdom and across the European Union that person can bring a claim directly. They do not need a regulator to open a case, they do not need a platform duty to attach, and they can ask for an injunction rather than damages.

Three practical consequences follow. Treat the system prompt and the safety configuration as disclosable documents written for a future court, not as internal engineering notes. Record why each permission was granted and who granted it, because the design claim turns on choice and a choice with no recorded reason reads badly. And check the timetable: the European AI Act's prohibitions on non-consensual intimate imagery apply from 2 December, which will sit on top of a data-protection route that is already open today.

Frequently asked questions

We only host a model built by someone else. Does this reach us?

It can. Data-protection liability follows whoever determines how personal data is processed, and configuring, fine-tuning or setting the guardrails on a deployed model is a determination. The safest working assumption is that if you chose the safety settings, you own the choice.

Is this the Online Safety Act being enforced?

No, and that is the point. The claim runs on data protection law and misuse of private information, both of which existed before the Act. Ofcom's separate investigation into X under the Act has been open since 12 January and is a different proceeding with a different defendant.

What would an injunction actually require?

The order sought is for effective and permanent technical measures preventing the model from generating manipulated images of the claimant. In practice that means engineering work on a shipped system, verified over time, rather than a one-off takedown of specific files.

A fine lands on last year's revenue. An injunction lands on next year's model.

xAIGrokUK GDPROnline Safety ActOfcomAI liability

Sony Fingerprinted What Was Inside The Model

Sony Music filed a second suit against Udio on 20 July 2026 asserting 30,117 recordings it identified inside the training data by audio fingerprinting. The method matters more than the damages.

5 min read

AI Policy

Apache 2.0 Hands You the Weights and the Liability

Thinking Machines released Inkling under Apache 2.0 with no gate and no field-of-use limits. Its acceptable use policy has no indemnity. Here is what that means for an owner.

6 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles