The European Union regulated artificial intelligence (AI) with a new law that will came into effect in 2021. The regulation required companies to disclose their use of AI and the data they collect on individuals, as well as ensure that AI systems are tested for safety and accuracy. The regulation also banned the use of AI for certain purposes, such as mass surveillance and biometric identification. This is the first time the EU has attempted to regulate AI, and it is seen as a response to concerns about the technology‘s impact on privacy and civil liberties. The regulation is also intended to level the playing field between large tech companies and small businesses, by ensuring that all companies using AI are subject to the same rules.
The EU’s new AI regulation
Prefer to listen?
If you prefer to listen to, instead of reading the text on this page, all you need to do is to put your device sound on, hit the play button on the left, sit back, relax and leave everything else to us.
The European Union’s Artificial Intelligence (AI) regulation was released on April 21 2021. The proposal sets out a nuanced regulatory structure that bans some uses of AI, heavily regulates what the proposed regulation calls ‘high-risk uses’ and also regulates less risky AI systems. It also includes a Coordinated Plan that sets out the necessary policy changes and investment at Member States level to try to bolster Europe’s position in the development of human-centric, sustainable, secure, inclusive and trustworthy AI.
The regulation adopts an approach that goes against the general trend in mainstream regulatory policy that advocates a cautious hands-off approach when it comes to regulating emerging technologies.
If it had to be accepted, the proposed regulation would require providers and users of high-risk AI systems to comply with rules on:
- data and data governance;
- documentation and record-keeping;
- transparency and provision of information to users;
- human oversight; and
- robustness, accuracy and security.
A major novelty in this proposal (which sets a dangerous precedent for other emerging technologies) is a requirement for ex-ante conformity assessments to establish that high-risk AI systems meet these requirements before they can be offered on the market or put into service.
An additional novelty comes in the form of an obligation for a postmarket monitoring system to detect problems in use and to mitigate them.
The new AI regulation has some very stark similarities to GDPR and is similar to a bill that was introduced in the US Congress in late 2017. However, the US bill is weaker than the EU regulation, according to the American Civil Liberties Union (ACLU). Both GDPR and the proposed US legislation only apply to companies that are domiciled in those jurisdictions. If you’re a company based in the US but doing AI research, then you are not subject to the regulation. And while both GDPR and the proposed US legislation broadly define what constitutes an AI tool, both also include language that allows for subjectivity and interpretation, which could lead to different interpretations by different countries or regions.
The ACLU has put forward a number of sensible recommendations that include that legislators craft legislation in ways that “make clear what AI tools will be regulated, how they will be regulated, and how they will be enforced”. It also recommends that governments should desist from creating any new laws that require a human being to determine whether an AI tool is harmful or not. Finally, it recommended that governments create multi-stakeholder councils and government agencies charged with ensuring compliance with regulations.
The European AI regulation is likely to be adopted in the first half of next year (2021), even though it must be stressed that GDPR had taken longer to adopt. In the US, a federal regulation on the issue is also being contemplated. As AI grows in importance, so too do concerns over data privacy and how it can be misused by companies and governments. The European Commission is thus trying to introduce new rules that would address some of those concerns. The European Commission proposed a mandatory code of conduct for how companies should handle personal information when using automated decision-making processes. The draft law has gone through a public consultation.
“The rapid development of AI raises fundamental questions about the future of our society”, said Andrus Ansip, Vice President for the digital single market at the European Commission. “This legislation will help us harness its benefits while safeguarding against potential risks.” The commission wants to see AI “be developed safely and responsibly”, according to its draft law, which aims to create a framework for data protection and privacy by design. It adds that “existing EU legislation on data protection should be updated in order to ensure that it is fit for purpose in an age of big data and machine learning.” The draft bill also proposes that companies “will be required to demonstrate compliance with the code” and will have to notify customers if an automated decision process has “legal or similarly significant effects on them”.
Businesses will also be required to meet standards on cybersecurity measures, including protecting against cyberattacks and preventing unauthorised access or modification of personal data. Companies are also obliged to report any breaches within 72 hours after they have discovered it.
Several market operators working in the AI space were not very enthusiastic about the compliance burden that another heavy-handed set of rules is likely to mean for their business, especially in view of the fact that they already have to work within the heavy-handed strictures of GDPR. Ultimately, this makes AI development more burdensome and more costly in Europe than in other jurisdictions, and may make Europe even more of a laggard in AI than it already is.
