AI Regulation: And Now?

Over the last few years governments and regulatory bodies have acted as quickly as possible to ensure that they would be able to strike a balance between, on one hand, fostering innovation and investment to reap the full benefits of Artificial Intelligence (AI) for individuals, organisations, societies and nature, and, on the other hand, setting out rules to protect against possible harms of that fast-evolving, transformational technology.

Never before so many public authorities have done so much to introduce regulatory frameworks for a technology. Even for the Internet of Things (IoT), which allows to connect billions of devices to sense and respond to environmental situations on behalf of humans, or even for them without their knowledge, hence generating serious ethical concerns, regulation has never been an issue attracting wide and deep attention.

In the case of AI, conversations, discussions and debates are taking place all around the world without discontinuity, at national, regional, international and multilateral levels.

On 17 May 2024, "the Council of Europe adopted the first-ever international legally binding treaty aimed at ensuring the respect of human rights, the rule of law and democracy legal standards in the use of artificial intelligence (AI) systems. The treaty, which is also open to non-European countries, sets out a legal framework that covers the entire lifecycle of AI systems and addresses the risks they may pose, while promoting responsible innovation. The convention adopts a risk-based approach to the design, development, use, and decommissioning of AI systems, which requires carefully considering any potential negative consequences of using AI systems." It is the outcome of two years' work by an intergovernmental body, the Committee on Artificial Intelligence (CAI), which brought together the 46 CoE member states, the European Union, and 11  non-member states (Argentina, Australia, Canada, Costa Rica, the Holy See, Israel, Japan, Mexico, Peru, the United States of America, and Uruguay), as well as representatives of the private sector, civil society and academia, who participated as observers.

Less than a week later, on 21 May, after three years of legislative debate, the Council of the European Union adopted the EU AI Act, which once published in the EU Official Journal in June, will become the first set of AI regulations that has undergone a full legislative approval process. The final text totals a remarkable 50,000 words, divided into 180 recitals, 113 Articles, and 13 annexes, and is a holistic set of risk-based rules applicable to all players in the AI ecosystem, from developers to exporters to deployers. Therefore, the AI Act is expected to shape the future of how this fast-evolving technology will be regulated for years to come.

On the next day, as a member of the Global Forum Association, I joined an Advisory Board ZOOM Meeting to discuss the programme of the next Global Forum, an onsite event that will take place in Muscat, Oman, 5-7 November. The meeting, chaired by Ingrid Andersson (IKED, Sweden), covered several thrilling topics - Building City Resilience, Combining Blockchain and AI, Nature Regeneration and Climate Change, Emerging trends and the Need for Change in Governance, Water & Energy transition, Global Challenges and Perspectives in Healthcare, Global Education Co-Creation & Civil Society Engagement, and, last but not least, a topic that I have the honor and privilege to lead: Regulation & Ethics Applying to AI.

Keeping track of AI regulatory developments around the world is a daunting task. I do my best to follow and analyze them, in particular thanks to the great job done by LinkedIn contacts like Tom Whittaker or Oliver Patel, AIGP, CIPP/E , among others.

There are a few pointers, which I would like to share here.

1. A prolific set of regulations

Regulatory developments take place at all levels - city, state, regional, international, multilateral. IAPP monitors closely in its tracker 24 jurisdictions (including EU), which of course does not represent the extent to which jurisdictions around the world are active on AI governance legislation.

As individual jurisdictions press ahead with their own frameworks and approaches, multilateral efforts to coordinate different approaches are also developing. The OECD (Organisation for Economic Co-operation and Development's AI principles), the G7 (Hiroshima AI Process), UNESCO, the International Standardization Organization, the African Union and, again, the Council of Europe are all working on multilateral AI governance frameworks. In addition, the U.K. government organized on 1-2 November 2023 at Bletchley Park the first AI Safety Summit bringing together government and industry stakeholders to agree upon, evaluate and monitor the most significant risks from AI.

Nation-states, even in the EU until the AI Act has been fully adopted, are pursuing their own AI strategies. For example, speaking ahead of the technology fair Vivatech this week in Paris, a four-day event that is expected to bring in some 150,000 visitors, and where another Global Forum Association member, Geneviève Fieux-Castagnet , will present the SNCF AI Governance Strategy, French president Emmanuel Macron announced a new investment in the artificial intelligence (AI) and quantum ecosystem as well as training programmes to build tech talent.

Furthermore, as Paul Wormeli pointed to me last year, U.S. cities are also developing their own AI policies, e.g., the City of Tempe, Arizona. In the absence of a Federal Government regulation, which has been under discussion for several months, there is the risk in the U.S. that state and city-level policies will prevail and become somewhat in competition or in contradiction with each other. It should be noted that on 15 May 2024 the U.S. Senate released a so-called Bipartisan AI Roadmap, which may open the way to a future AI legislation.

2. AI, a "character in search of an author"

Until now, the definition of "AI" and "AI system" varies from one jurisdiction to another - where it actually exists. The definition proposed by OECD - "An AI system is a machine-based system that , for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment" - is the one that is most considered in the world. The EU AI Act (and, in a more concise way, Canada) has adopted a definition which, though not identical to the OECD's definition, is based on it - 'AI system' means "a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments."

The ASEAN Guide on AI Governance and Ethics, more sophisticated, defines AI as "an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments" and AI system as "a machine-based system that is capable of influencing the environment by producing an output (predictions, recommendations or decisions) for a given set of objectives. It uses machine and/or human-based data and inputs to (i) perceive real and/or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (e.g., with machine learning), or manually; and (iii) use model inference to formulate options for outcomes. AI systems are designed to operate with varying levels of autonomy."

However, for international companies that have to take innovation and investment decisions, the definition of AI remains largely, to parody Pirandello, a "character in search of an author".

Since several of the draft AI regulations have extraterritorial effect, which means that more than one AI regulation may apply simultaneously in a given country or region, companies are likely to face complex situations that will lead them to adopt, whether they like it or not, the regulation that is based on the strictest applicable standard.

3. Different legal forms of regulation

Regulatory efforts include the development of comprehensive legislation (e.g., the EU AI Act), focused legislation for specific use cases, national AI strategies or policies, and voluntary guidelines and standards. There is no standard approach for bringing AI under state regulation, even if common patterns can be observed.

The choice between legislation and whatever form of soft law is not easy. As argued by Rob van Kranenburg and Alex Gluhak in their paper, "New Instruments of Governance for our Societies", "Common sense seems to contradict our assumptions that (i) citizens can be educated into breaking down their notion of autonomy, privacy and security into autonomies, privacies and securities, (ii) governments can be educated to dismantle themselves into semi-organized networks with flat and efficient properties, and (iii) industry to rethink their business models. Common sense, however, also shows us throughout history that changes in data information models (print, radio, tv, web) have been disruptive to the extent of revolutions breaking down both the good and efficient in the old systems." It is obvious to me, in this respect, that the Global Forum 2024 Session that will set up a conversation on the need of a new paradigm of Governance will be an essential one.

Everyone would agree that the absence of AI governance raises the risk of privacy violation, biased algorithms, and misuse of AI for malicious purposes whilst the existence of a robust governance framework ensures transparency, accountability, and the responsible development and deployment of AI systems.

History, culture, and ideology combine their influences to determine, in each country or region, where the swinging pendulum should stop in between (i) hard law (i.e. legally binding, compulsory regulations issued by parliaments and regulators) (ii) soft law (i.e. non-binding, but intended to have normative effect(s) and strongly encouraged principles issued by regulators or by influential, reputable industry groups) and (iii) self-regulation by the industry, based on written or unwritten non-binding principles. Irrespective of the choice, all decision makers agree that international cooperation among the stakeholders (governments, international organizations, companies, civil society, and academia) must take place to address AI challenges and promote AI-centric AI (ethics, transparency, fairness, safety, etc.).

It is clear that today the regulatory landscape around AI is fragmented. This is not good news for international trade and, more generally, for the expectation of reaping the full benefits of AI across world regions and industry sectors. AI knows no border and cannot be successfully and efficiently controlled by solely one nation-state.

Some are contemplating the perspective of a 'global' (not just 'international') framework to regulate AI. ICAO (Convention on International Civil Aviation) and IAEA (International Atomic Energy Agency) theoretically offer, in this respect, interesting models, but after more reflection I do not believe that such a model will ever apply to AI, on one hand because a number of countries, primarily China, will stay reluctant to join it, second because a cross-cutting technology like AI, used in various sectors and applications, cannot be covered in all its aspects by a single approach.

4. The purpose of AI governance - To innovate or to protect? Both

Given the transformative nature of AI technology, the challenge for jurisdictions has been so far to find a balance between innovation and regulation of risks. Therefore, governance of AI generally begins with a jurisdiction rolling out a national strategy or ethics policy.

For example, Biden's Executive Order "establishes new standards for AI safety and security, protects Americans' privacy, advances equity and civil rights, stands up for consumers and workers, promotes innovation and competition, advances American leadership around the world, and more." The EU AI Act "aims to foster the development and uptake of safe and trustworthy AI systems across the EU’s single market by both private and public actors. At the same time, it aims to ensure respect of fundamental rights of EU citizens and stimulate investment and innovation on artificial intelligence in Europe." In a February 2024 White Paper, the U.K. Government considered that "introducing binding measures too soon, even if highly targeted, could fail to effectively address risks, quickly become out of date, or stifle innovation and prevent people from across the UK from benefiting from AI."

Once again, what most jurisdictions aim to do is striking a balance between innovation and investment, on one hand, and creating and enforcing protective rules in terms of human rights and liberties, on the other hand.

5. The ambivalence of flexibility

Jurisdictions are wisely seeking to create AI regulations that can adapt to technological advances - who had anticipated the generative AI surge before November 2022? Therefore, they introduce flexibility in their regulations, either by deliberately using high-level wording, or by allowing for future interpretation and application by courts and regulators ('jurisprudence').

There is a high degree of flexibility in the EU AI Act and it will be interesting how the law can follow the speed at which technology develops. However, from an investor point of view, flexibility in this area creates the disadvantage of uncertainty regarding whether, why and how regulations could change over time - since AI is a technology demanding high-level investment to be competitive, such uncertainty could prevent European companies from investing in AI, hence jeopardizing their potential competitiveness.

6. Will there be an AI "Brussels Effect"?

The EU AI Act is on track to set the pace for AI governance in the world - it is indeed expected to become a global standard through the so-called “Brussels Effect” that has been noted following the adoption of the General Data Protection Regulation (GDPR). However, the comparison between the AI Act and the GDPR should not go too far at this stage: The AI Act does not regulate every and all uses of AI, compared to the GDPR, which applies to essentially every type of data processing; in addition, the GDPR was coherently framed within a fundamental rights philosophy whereas the AI Act, pro-innovation and pro-ethics at the same time, is a patchwork of objectives.

There are other pointers that we could have mentioned, for instance the possible harmful effects of overlap between AI regulation and other areas of law. But all of those that have been presented in this paper demonstrate that the proliferation of AI governance frameworks across many jurisdictions at all levels of government and across various industry sectors will lead to more political disruptive debates in the future. It is too early to express clear views about the fate of AI regulation, even if each of us may have her opinion. What matters is to use our knowledge and experience to contribute to the continuous debates in such a way that AI will be 'good for all'.