Brussels answers the call for more coherent AI regulation

When Microsoft unleashed Tay, its AI-pow­ered chat­bot, on Twit­ter on 23 March 2016, the soft­ware giant’s hope was that it would “engage and enter­tain peo­ple… through casu­al and play­ful con­ver­sa­tion”. 

An acronym for ‘think­ing about you’, Tay was designed to mim­ic the lan­guage pat­terns of a 19-year-old Amer­i­can girl and learn by inter­act­ing with human users on the social net­work. 

With­in hours, things had gone bad­ly wrong. Trolls tweet­ed polit­i­cal­ly incor­rect phras­es at the bot in a bid to manip­u­late its behav­iour. Sure enough, Tay start­ed spew­ing out racist, sex­ist and oth­er inflam­ma­to­ry mes­sages to its fol­low­ing of more than 100,000 users. Microsoft was forced to lock the @TayandYou account indef­i­nite­ly less than a day lat­er, but not before its cre­ation had tweet­ed more than 96,000 times.

AI sys­tems are, of course, adap­tive, learn­ing from cues in their envi­ron­ment and chang­ing their behav­iour autonomous­ly. This means that, once they’re put in place, unfore­seen ram­i­fi­ca­tions may ensue, for which humans can quite eas­i­ly avoid respon­si­bil­i­ty. They can also be an invis­i­ble hand that dis­creet­ly influ­ences our choic­es to an extent that goes beyond our under­stand­ing and/or wish­es. 

As these risks pro­lif­er­ate, leg­is­la­tors have stressed the need for clear­er and more con­sis­tent reg­u­la­to­ry frame­works to deal with them. The world’s major economies have yet to estab­lish such mea­sures so far, rely­ing instead on a sub­op­ti­mal patch­work of old laws and stan­dards to police the indus­try. 

But that will change when the Euro­pean Commission’s pro­posed Arti­fi­cial Intel­li­gence Act becomes law. Her­ald­ed as the world’s first legal frame­work designed specif­i­cal­ly to cov­er AI, this will seek to iden­ti­fy and reg­u­late high­er-risk forms of the tech­nol­o­gy – bio­met­ric iden­ti­fi­ca­tion, for instance. It will impose far-reach­ing oblig­a­tions on devel­op­ers, cov­er­ing stan­dards of gov­er­nance, design, trans­paren­cy and data secu­ri­ty. Those that fail to com­ply may be sub­ject to hefty fines. 

Once passed, the act will still need to work its way through the Euro­pean Par­lia­ment for adop­tion – and it will be at least a cou­ple more years before it becomes enforce­able.

Oth­er key mar­kets that have yet to design an AI-spe­cif­ic reg­u­la­to­ry regime, although Chi­na issued guid­ing prin­ci­ples for its reg­u­la­tion in 2017 and, this March, a data pri­va­cy law called the Inter­net Infor­ma­tion Ser­vice Algo­rithm Rec­om­men­da­tion Man­age­ment Pro­vi­sions. 

The UK is await­ing the pub­li­ca­tion of a gov­ern­ment white paper on AI reg­u­la­tion, while the White House start­ed pre­lim­i­nary dis­cus­sions on the need for what it called “a bill of rights for an AI-pow­ered world” in Novem­ber 2021. 

Dr Mari­arosaria Tad­deo is an asso­ciate pro­fes­sor at the Oxford Inter­net Insti­tute and a fac­ul­ty fel­low at the Alan Tur­ing Insti­tute. She believes that a clear “Brus­sels effect” is set­ting the pace for oth­er admin­is­tra­tions to fol­low. 

“Start­ing with the Gen­er­al Data Pro­tec­tion Reg­u­la­tion and con­tin­u­ing with the Dig­i­tal Ser­vices Act, the Dig­i­tal Mar­kets Act and now the AI Act, the EU has cre­at­ed a frame­work for the coher­ent reg­u­la­tion of dig­i­tal tech­nolo­gies. Any tech provider seek­ing access to the sin­gle mar­ket will have to abide by this,” she says. “I sus­pect that we’ll be mov­ing on to a ‘transat­lantic effect’, because the EU and the US have strength­ened ties over the past year and sought shared points to align their reg­u­la­tions. Oth­er mar­kets are like­ly to fol­low.”

Part of the prob­lem with the cur­rent mish­mash of reg­u­la­tions is that it cre­ates incon­sis­ten­cy. AI-based busi­ness­es would be much bet­ter served by a set of shared inter­na­tion­al stan­dards if they are to build a thriv­ing glob­al indus­try.

Dr Cos­mi­na Doroban­tu, co-direc­tor of the Alan Tur­ing Institute’s pub­lic pol­i­cy research pro­gramme, notes that, in prac­ti­cal terms, AI is a “gen­er­al-pur­pose tech­nol­o­gy” that touch­es all sec­tors. This means that some issues require a com­mon approach, yet often they will be policed by sep­a­rate reg­u­la­tors, each of which may take a dif­fer­ent approach. 

“We know that bias is an issue that crops up in numer­ous machine learn­ing sys­tems,” Doroban­tu says. “We will see it in cred­it scor­ing algo­rithms used by mort­gage lenders, facial recog­ni­tion tech­nolo­gies used by police forces and auto­mat­ed triage sys­tems used by hos­pi­tals, to name but a few exam­ples.” 

In the UK, these appli­ca­tions fall with­in the remit of dif­fer­ent watch­dogs, which increas­es the risk of reg­u­la­to­ry arbi­trage, where­by users seek the path of least resis­tance, she warns. Also, impor­tant prob­lems could fall through the cracks if one reg­u­la­tor were to assume – wrong­ly – that anoth­er author­i­ty is han­dling them.

The EU’s AI Act is not with­out its weak­ness­es. The Euro­pean Commission’s con­sul­ta­tion on the draft leg­is­la­tion attract­ed more than 300 feed­back sub­mis­sions – a far stronger response than its oth­er tech bills have gen­er­at­ed. Crit­i­cisms have focused on the act’s over­ly broad def­i­n­i­tion of AI and what it class­es as high-risk uses of the tech that will be sub­ject to more strin­gent con­trols. Human rights cam­paign­ers, mean­while, are con­cerned that the act is not strict enough in con­trol­ling the use of AI in law-enforce­ment appli­ca­tions such as pre­dict­ing crim­i­nals’ behav­iour and con­duct­ing mass sur­veil­lance using facial-recog­ni­tion sys­tems.

As the glob­al AI mar­ket devel­ops, we may see flash­points when dif­fer­ent juris­dic­tions’ approach­es to reg­u­la­tion clash, Tad­deo pre­dicts. The EU’s approach to dig­i­tal gov­er­nance has his­tor­i­cal­ly been based on val­ues such as human dig­ni­ty. In the US, the focus has been much more on pre­serv­ing free­dom, of speech or of mar­kets. But both val­ue demo­c­ra­t­ic val­ues and basic human rights, even if they may inter­pret these dif­fer­ent­ly. China’s atti­tude to such mat­ters will be hard­er to rec­on­cile. The EU has already vowed to ban AI sys­tems such as Beijing’s so-called social cred­it sys­tem, which enables organ­i­sa­tions and indi­vid­u­als to be tracked and eval­u­at­ed for trust­wor­thi­ness.

Despite their dif­fer­ing approach­es, demo­c­ra­t­ic coun­tries are like­ly to seek reg­u­la­to­ry align­ment wher­ev­er pos­si­ble as they seek to unlock the oppor­tu­ni­ties cre­at­ed by AI, accord­ing to Tad­deo. 

Even if they can’t achieve full align­ment, she says, some mea­sure of con­ver­gence will at least “cre­ate a play­ground that allows dif­fer­ent actors to col­lab­o­rate”.