Soheir El Sherbiny‏‏

On 2 February 2024, the EU member states unanimously approved the Artificial Intelligence Act, following extensive negotiations among representatives of the Council of the European Union, European Parliament, and European Commission. Despite concerns in recent years about this type of law stifling European innovation, the EU member states gave the green light to the final text of the European AI Act. The AI Act was proposed by the European Commission in April 2021 to help address the challenges of rapid technological progress and the potential risks associated with AI, and to prevent its misuse through various unethical practices. However, the process of developing the law encountered major disruptions in December 2022 after ChatGPT was developed. This made it necessary to change the draft law and to establish guidelines specific to generative AI. Debate continued up until the adoption of the act, which is scheduled to be put to an official vote on 10-11 April 2024.Main ObjectivesEuropean lawmakers hope that the AI Act will achieve various objectives and goals, including the following:1. Establish ethical standards for technology: The European Commission intends for this "historic" law, which is the first in the world to regulate the use of AI, to help establish ethical standards and human rights principles that would govern the use of AI both in the European Union and the world as a whole.2. Demonstrate European leadership in AI ethics: In light of the importance of AI, which has been adopted across industries and sectors, the AI Act endeavors to position the European Union as a global leader in the field of human-centered and ethical artificial intelligence. It aims to bolster European innovation and its competitive edge in this field through providing guidance on the use of AI.3. Create a framework for AI developers: According to the EU, "the AI Act aims to provide AI developers and deployers with clear requirements and obligations regarding specific uses of AI. At the same time, the regulation seeks to reduce administrative and financial burdens for business, in particular small and medium-sized enterprises (SMEs)."4. Ensure security and fundamental rights of individuals and companies: The updated EU Coordinated Plan on Artificial Intelligence provides for a regulatory framework to "guarantee the safety and fundamental rights of people and businesses when it comes to AI." This framework will "strengthen uptake, investment and innovation in AI across the EU."5. A tool to protect society and business ties: The new AI Act is hoped to be part of a growing movement to protect society from the negative potentials of emerging technologies such as AI. At the same time, it is a way for companies to protect their brands and final outputs, even if they are not seeking this help.6. Banning dangerous AI systems: As per the AI Act, "all AI systems considered a clear threat to the safety, livelihoods and rights of people will be banned, from social scoring by governments to toys using voice assistance that encourages dangerous behavior." This regulation therefore aims to ensure the security of society as a whole.Contents of the LawThe new law provides a regulatory framework for AI across four categories of risk: unacceptable, high, limited, and minimal/none, and outlines mechanisms for enforcing the act. These include the following provisions:1. Define the parameters of high-risk technologies: According to the EU, AI systems identified in the law as high-risk include those systems used in "critical infrastructure (e.g. transport), that could put the life and health of citizens at risk; educational or vocational training, that may determine the access to education and professional course of someone’s life (e.g. scoring of exams); safety components of products (e.g. AI application in robot-assisted surgery); employment, management of workers and access to self-employment [...]; law enforcement that may interfere with people’s fundamental rights; [and] migration, asylum and border control management (e.g. automated examination of visa applications)," among others.2. Establish systems capable of evaluating and mitigating risk: The law states that high-risk AI systems will be subject to strict obligations before they can be put on the market. According to the EU, these obligations include "adequate risk assessment and mitigation systems; high quality of the datasets feeding the system to minimize risks and discriminatory outcomes; clear and adequate information to the deployer; appropriate human oversight measures to minimize risk; [and] a high level of robustness, security and accuracy," among others.3. Set parameters for limited risk AI systems: The act indicates that limited risk in AI systems refers to the degree of transparency the system contains. For example, according to the EU, "when using AI systems such as chatbots, humans should be made aware that they are interacting with a machine so they can take an informed decision to continue or step back."4. Allow free use of lower-risk AI technologies: The AI Act allows for the free use of AI technologies that are lower risk, including AI-enabled video games and spam filters. According to the EU, "the vast majority of AI systems currently used in the EU fall into this category."5. Provide enforcement mechanisms: According to the EU, "once an AI system is on the market, authorities are in charge of market surveillance, deployers ensure human oversight and monitoring, and providers have a post-market monitoring system in place. Providers and deployers will also report serious incidents and malfunctioning."6. Impose a series of strict obligations on service providers: The AI law imposes strict obligations on providers and deployers of high-risk AI systems, but also on importers and distributors of these systems. The obligations of distributors and importers are primarily linked to determining whether an AI system that is being distributed or imported is high risk or not.7. Clarify obligations for public and private sector entities: According to the law, public bodies and private sector agencies that provide public services such as education, healthcare, housing, or social services must carry out a special evaluation of risk level and oversight measures, propose measures to mitigate risks, and included affected parties in this process.8. Right to file a complaint with the Market Surveillance Authority: The AI Act provides for the right of any legal or natural person to file a complaint with the Market Surveillance Authority, if they have "grounds to consider that there has been an infringement of the provisions of this Regulation," according to the text of the act. This is different from other regulatory tools such as the EU’s General Data Protection Regulation, which does not permit data holders to make complaints unless personal data has been compromised.9. A complex governance structure: The AI Act will be implemented through a complex and multi-layered governance structure that includes various entities such as notified bodies, conformity assessment bodies, an AI committee, an AI office, competent national authorities, and market surveillance authorities. All of these entities will be responsible for supporting innovation through creating environments with regulatory protections for AI and special measures applicable to small and medium-sized enterprises and start-ups.10. Focus on intellectual property and data protection provisions: The new AI Act also includes intellectual property provisions enabling access to AI patents, copyright protection for programs, and content use licenses for training purposes. The data protection part of the law is grounded in the principles of transparency, a basic prohibition against profiling, and adherence to the provisions of the law.Challenges AheadThere are various challenges in implementing the new European AI Act, including with regard to the following:1. Rights organizations highlight dangers of new law: The new EU AI Act covers the use of biometric categorization systems using data such as fingerprints, and predictive systems such as AI lie detectors. This has prompted various rights organizations such as Homo Digitalis, Algorithm Watch, and I Have Rights to warn about the dangers of using these systems especially in the context of migration. These groups are concerned that AI could be used in that context to unjustly target marginalized groups and curtail their legal freedoms.2. Concerns about hindering start-ups’ creativity: The new AI Act was initially received negatively by some European countries. Vienna opposed the provisions on data protection, while Paris and Berlin warned that the regulations around advanced AI models could create roadblocks for the creativity of AI startups in Europe. These startups include French company Mistral and German company Aleph Alpha. Although these countries eventually backed the act after heated debate, there are fears of renewed controversies about enforcement mechanisms for the law in practice.3. Managers of institutions likely to fail to predict nature of risks: Some analysts have noted that there are potential gaps in future enforcement of the law with regard to the ability of administrators to accurately assess changing risk levels with regard to various AI applications. The failure to assess risks correctly, such as if a manager decides that a given technology is high risk when it is really minimal risk, could lead in various problematic directions. Likewise, categorizing a technology as minimal risk when it is really high risk could create other problems. If inaccurate risk assessments increase, it is possible that there could be discrepancies or contradictions among regulations that are supposed to be applied. The failure to continuously evaluate and improve data from which AI learns could also lead to various ethical and regulatory problems, such as biased outputs.4. Capacity development in the field of AI risk assessment: Many of the responsibilities for risk and compliance assessments with regard to the rules and regulations of the AI Act fall on data engineers and scientists. However, to ensure this act is successfully enforced and to avoid various obstacles and risks, managers and personnel will need extensive learning and development opportunities. This training would provide a background in AI ethics and regulations so that they are able to oversee and manage the trajectory of the work.5. Need for stringent and comprehensive regulation of AI systems: Much of the AI Act requires strict and comprehensive regulation of high-risk AI systems. It is therefore critically important that companies working in AI technology determine whether a given AI system being developed, imported, distributed, or deployed is high risk or not. The key challenge is that AI developers might have divergent opinions on whether systems should be considered high risk, a categorization which entails specific obligations and requirements.&nbsp;In conclusion, the EU intends for the AI Act to establish ethical regulations for the use of AI as its applications spread across all sectors. It aims to produce ethical standards for AI, in order to ensure that it is not misused in ways that infringe upon the security of society. The act also protects the intellectual property rights of companies and individuals. The main challenge will be how to apply this law across the EU, and the extent to which officials can enforce the law. To enforce the law, they will need to assess the nature of risks posed by a particular system and carry out the corresponding regulations and obligations to ensure the law is implemented correctly.

Understanding Europe’s New AI Act