AI View - 28 November 2023

> Sign up to AI View

This edition brings you:

• Artificial Intelligence (Regulation) Bill proposed in the UK
• EU AI Act likely to adopt new AI definition, aligning with OECD
• Germany, France and Italy push back on regulation of foundation models under EU AI Act
• Spain launches first EU regulatory sandbox for AI
• EU Parliament adopts final text of the EU Data Act

Artificial Intelligence (Regulation) Bill proposed in the UK

On 22 November 2023, a private member of the House of Lords introduced a Bill for the regulation of AI, which would create a new UK AI regulator and mandate the introduction of new binding rules on the use of AI. In summary, the Bill:

• Establishes an "AI Authority" with various functions, including to review existing product safety, privacy and consumer protection regulation, to undertake a gap analysis and to "accredit AI auditors".
• Sets out that AI regulation should deliver safety, security and robustness, appropriate transparency and explainability, fairness, accountability and governance and contestability and redress.
• Mandates the AI Authority to collaborate with regulators to construct regulatory sandboxes for AI.
• Mandates regulation to oblige businesses to have a "designated AI officer".
• Mandates AI regulation which provides that any person "involved in training AI" must supply to the AI Authority a record of third party data and IP used in the training, obtain consent to use that data, and comply with IP obligations. Further, anyone supplying AI must give health warnings and allow consent to be withheld, and any business developing or using AI must allow accredited third parties to "audit its processes and systems".
• Defines AI as: "technology enabling the programming or training of a device or software to:
  (a) perceive environments through the use of data;
  (b) interpret data using automated processing designed to approximate cognitive abilities; and
  (c) make recommendations, predictions or decisions,
  with a view to achieving a specific objective."

While these sorts of Bills don't typically result in law, they do raise awareness of important issues, and this particular Bill could be a sign of mounting pressure on the UK Government to introduce binding AI regulation in the UK.

Read the proposed Bill here.

EU AI Act likely to adopt new AI definition aligning with OECD

On 8 November 2023, the Council of the Organisation for Economic Co-operation and Development ("OECD") updated its recommended principles on AI to introduce a new definition for 'Artificial Intelligence'. The revised definition was handed to EU policymakers in mid-October and is likely to inform the approach adopted in the EU's proposed AI Act.

The new definition has been updated to account for developments in AI over the last five years and make it more 'future proof', with the overall aim of enhancing international alignment of AI definitions. The newly published definition is as follows:

"An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that [can] influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment."

This broadly aligns with the European Parliament's proposed definition in that it refers to AI systems having "varying levels of autonomy" and avoids reference to human-defined objectives for AI. However, the new wording does include (for the first time in the definition's development) reference to an AI system being able to "infer" how to generate outputs. This suggests the OECD's preference for framing AI as being able to operate in a more probabilistic manner as opposed to a deterministic manner. It expressly acknowledges that AI systems can be "adaptable", as they are able to evolve after the design stage (interestingly, the UK White Paper on AI refers to "autonomy" and "adaptability" as two key aspects of AI technologies).

The definition of AI is a fundamental aspect of the proposed EU AI Act. Assuming the final definition in the EU AI Act is broadly in line with the OECD's definition, it remains broad and so will likely still be difficult to apply in practice. Finding a bright line between what is and what is not caught by the definition will not be easy, and while there will be clear examples on either side, there will still be grey area in between.

Read the updated principles on AI here.

Germany, France and Italy push to limit regulation of foundation models in EU AI Act

According to a joint 'non-paper' published on 18 November 2023, Germany, France and Italy have jointly pushed back on the regulation of foundation models under the proposed EU AI Act. While negotiations on the draft EU AI Act have paused (set to be continued on 6 December 2023), the new joint paper may help to accelerate (or bring to a halt) ongoing trilogue discussions between the European Parliament, Council and the Commission. Broadly, the three EU governments have proposed a framework of "mandatory self-regulation through codes of conduct" in the development of AI foundation models, and have called for regulation to focus on the application of AI, rather than the technology as such. In summary:

• Foundation models: The paper opposes strict regulation of foundation models and a two-tier approach, as suggested by the Spanish presidency. The paper recommends mandatory self-regulation through codes of conduct which could follow principles defined at the G7 level through the Hiroshima process and the approach of Article 69 in the draft EU AI Act.

• "Model card" approach: The paper sets out that defining 'model cards' (i.e., documents summarising key information about a model) and making them available for each foundation model would be a mandatory element of the proposed self-regulation approach.

• AI governance body: This would help to develop guidelines and could check the application of model cards. Further, a governance body would ensure that companies have an easy way to report any noticed infringement of the relevant codes of conduct by a model developer. Any suspected violation would be made public by the AI governance body.

• Sanctions: Sanctions would not be applied initially. However, the paper suggests that after an initial observation period, if breaches of the relevant codes of conduct concerning transparency are repeatedly observed and reported without being corrected by model developers, a sanction system could be implemented to address this.

Read the joint non-paper here.

Spain launches first EU regulatory sandbox for AI

On 9 November 2023, the Spanish government published Royal Decree 817/2023, providing for a regulatory sandbox to enable private and public sector organisations to test their AI systems against the proposed EU AI Act, before it takes effect. This initiative follows off the back of certain provisions of the proposed EU AI Act, in which Member States are encouraged to produce their own AI 'sandboxes', i.e., environments in which AI systems can be tested (and developed) under the regulations of the Act and to ensure transparency and compliance. This Decree follows an earlier Decree from August 2022 (729/2023) in which the new Spanish Agency for the Supervision of Artificial Intelligence was established, being the first AI regulatory body of its kind appointed in the EU in anticipation of the EU AI Act.

The Decree contains several key proposals that will be of interest to Spanish companies (or those operating in Spain) seeking to deploy AI in their businesses and those interested in what initiatives in other Member States might look like.

• Co-operation between AI system providers and users: The Decree aims to improve the connection and ease of communication between the providers of AI systems (e.g. developers, AI-focused SMEs, tech companies etc) and the ultimate users (e.g. individuals, SME clients, third parties etc). This will be done through dedicated feedback channels that will allow the providers to understand the effectiveness and security of their systems.

• Testing of AI systems: The principal objective of this decree is to help innovate AI in Spain via compliance with the proposed EU AI Act. The mechanism by which this will be done is by the secure, "controlled" testing of AI systems to ensure improvements at every stage of the development and user experience.

• Development of technical guidance: This objective would be to establish a series of best practices for the use and rollout of AI in business. It is envisaged that this could be produced for use by other Member States and to further develop the European framework on the regulation of AI.

• Creation of AI advisory committee: The establishment of an advisory committee on AI, made up of technical experts, to inform future development of AI.

Read the full Decree here (in Spanish).

EU Parliament adopts final text of the EU Data Act

On 9 November 2023, the EU Parliament voted to adopt the final text of the EU Data Act. The Act's aim is to "ensure fairness in the digital environment, stimulate a competitive data market, open opportunities for data-driven innovation and make data more accessible for all" and was initially proposed by the European Commission on 23 February 2022.

The Act aims to boost the EU's data economy by optimising accessibility and use of industrial data. Specifically in the context of AI, there are provisions that seek to enable the use of AI in protecting and storing data and in the creation of an aftermarket. The Act aims to contribute to the development of new services, particularly in the field of AI, where huge amounts of data are required for training.

Read the full text here.