I have written some time back about EU AI Act draft circulation. After more than 2 years, there is some more movement in making this a EU Law. In June 2023, the EU Parliament adapted the draft and a set of negotiating principles and the next step of discussions with member countries has started. The EU officials are confident that this process will be completed by end of 2023 and this will become an EU law soon. Like the old Hindi proverb “ Bhagawan Ghar mein Dher hain Andher Nahin”. Or “In God’s scheme of things, there may be delays but never darkness”. EU has taken the first step and if this becomes a law by early 2024, it will be a big achievement. I am sure USA and other large countries will follow soon.
The draft has more or less maintained its basic principles and structure.
The basic objective of the new law is to make sure that AI systems used in the EU are safe, transparent, traceable, non-discriminatory and environmentally friendly. In addition, there is an larger emphasis on AI systems should be overseen by people, rather than by automation alone. The principle of proportionate regulations, the risk categorization of AI systems and the level of regulations appropriate to the risk are the central theme of the proposed laws. In addition, there was no generative AI or ChatGPT like products when the original draft was developed in 2021 and hence additional regulations are added to address this large language models / Generative AI models. The draft also plans to establish a technology-neutral, uniform definition for AI that could be applied to future AI systems.
Just to recall from my earlier Blog, the risks are categorized in to Limited risk, high risk and unacceptable risk.
The draft Law clearly defines systems which are categorized as “Unacceptable risk” and proposed to ban them from commercial launch within EU community countries. Some examples are given below.
- Any AI system which can change or manipulate Cognitive behaviour of humans , especially vulnerable groups such as children, elderly etc.
- Any AI system which classifies people based on various personal traits such as behaviour, socio-economic stataus or race and other personal characteristics.
- Any AI system which does real-time and remote biometric identification systems, such as facial recognition which is usually without consent of the person targeted. The law also clarifies that past data analysis for law enforcement purposes is acceptable with court orders.
The draft law is concerned about any negative impact on fundamental rights of EU citizens and any impact on personal safety. These types of systems will be categorized as High Risk.
1) Many products such as toys, automobiles, aviation products, medical devices etc. are already under existing U Product safety legislation. Any AI systems that are used inside products already regulated under this legislation will also be subjected to additional regulations as per High Risk category.
2) Other AI systems falling into eight specific areas that will be classified as High Risk and required registration in an EU database and subjected to the new regulations.
The eight areas are: –
- Biometric identification and categorisation of natural persons
- Management and operation of critical infrastructure
- Education and vocational training
- Employment, worker management and access to self-employment
- Access to and enjoyment of essential private services and public services and benefits
- Law enforcement
- Migration, asylum and border control management
- Assistance in legal interpretation and application of the law.
Once these systems are registered in the EU database, they will be assessed by appropriate agencies for functionality, safety features, transparency, grievance mechanisms for appeal etc and will be given approvals before they are deployed in EU market. All updates and new versions of these AI system will be subjected to similar scrutiny.
Other AI systems not in the above two lists will be termed as “Limited risk” systems and subjected to self-regulations. At the minimum, the law expects these systems to inform the users that they are indeed interacting with an AI system and provide options to change to a human operated system or discontinue using the system.
As I have mentioned before, the proposed law is covering Generative AI systems also. The law required these systems to disclose to the users that the output document or a output decision is generated or derived by a Generative AI system. In addition, the system should publish the list of copyrighted training content used by the model. I am not sure how practical this is given that ChatGPT like systems are reading every digital content in the web and now moving in to very audio / video content. Even if the system produces this list which is expected to be very large, not sure current copy right laws are sufficient to address the use of this copyrighted material in a different form inside the deep learning neural networks.
The proposed law also wants to ensure that the generative AI models are self-regulated enough not to generate illegal content or provide illegal advice to users.
Indian Government is also looking at enacting AI regulations soon. June 9th 2023 interview, Indian IT minister talked about this. He emphasized the objective of “No harm” to citizen digital users. Government’s approach to any regulation of AI will be thru the prism of “ User harm or derived user harm thru use of any AI technology”. I am sure draft will be out soon and India also will have similar laws soon.
Let us discuss about what are the implications or consequences of this regulation among the various stakeholders.
- AI system developer company ( Tech and Enterprises )
They need to educate all their AI development teams on these laws and ensure these systems are tested for compliance prior to commercial release. Large enterprises may even ask large scale model developers like open.AI to indemnify them against any violations while using their APIs. Internal legal counsels of both the tech companies and API user enterprises need to be trained on the new laws and get ready for contract negotiations. Systems Integrators and outsourcers such as Tech Mahindra, TCS, Infosys etc. are also need to gear up for the challenge. The liability will be passed down from the enterprise to the Systems Integrators and they need to ensure compliance is built in and also tested correctly with proper documentation.
- Governments & Regulators
Government and regulatory bodies need to upskill their staff on the new laws and how to verify and test compliance for the commercial launch approval. The tech companies are very big and throw in best technical as well as legal talent to justify their systems are compliant and if regulatory bodies are not skilled enough to verify then the law will become ineffective and will be only on paper. This is a huge challenge for the government bodies.
- Legal community both public prosecutors, company legal counsels and defence lawyers
Are they ready for the avalanche of legal cases starting from regulatory approvals and appeals, ongoing copyright violations, privacy violations, inter company litigations of liability sharing between Tech, enterprise and Systems Integrators etc.
Massive upskillng and training is needed for even senior lawyers as issues arising from this law are very different. The law degree curriculum needs to include a course on AI regulations. For example, the essence of a comedian talk show “learnt” by a deep learning model and stored deep in to neural networks. Is it a copyright violation? The model outputs similar style comedy speech by using the “essence” stored in neural network. Is the output a copy right violation? Who is responsible and accountable for an autonomous car accident? Who is responsible for a factory accident, causing injury to a worker in a autonomous robot factory? Lots of new legal challenges.
Most Indian Systems Integrators are investing large sums of money to reskill and also create new AI based service offerings. Hope they are spending part of that investment in AI regulations and compliance. Otherwise, they run a risk of losing all the profits in few tricky legal challenges.
More later
L Ravichandran