A draft of the Commission's proposed REGULATION ON A EUROPEAN APPROACH FOR ARTIFICIAL INTELLIGENCE has been leaked (as reported by Politico). This draft - if close to final as reported - indicates an intention by the Commission to seek to regulate AI in the broadest terms. It defines as a regulated "AI system" as "software that is developed with one or more of the approaches and techniques":
"(a) Machine learning approaches, including supervised, unsupervised and reinforcement learning, using a wide variety of methods including deep learning;
(b) Logic- and knowledge-based approaches, including knowledge representation, inductive (logic) programming, knowledge bases, inference/deductive engines, (symbolic) reasoning and expert systems;
(c) Statistical approaches, Bayesian estimation, search and optimization method;"
which, "for a given set of human-defined objectives" can "generate outputs such as content, predictions, recommendations, or decisions influencing real or virtual environments."
A definition of this breadth covers everything from spell checkers to autonomous vehicles, though it does seem that the EU is - surprisingly - less concerned about systems that might want to kill or control us given the proposed Regulation "does not apply to AI systems exclusively used for the operation of weapons or other military purposes" and nor does it apply to practices "practices ... authorised by law and ... carried out [by public authorities or on behalf of public authorities] in order to safeguard public security".
The prohibitions mooted in the leaked draft do not in fact quite extend so far as to outlaw spell checking, but they would catch many uses already common in the market. For example, Art 4(1)(a) would prohibit: "AI systems designed or used in a manner that manipulates human behaviour, opinions or decisions through choice architectures or other elements of user interfaces, causing a person to behave, form an opinion or take a decision to their detriment." Personalised pricing algorithms anyone, given that they are intended to maximise the price extracted from consumers?
Art 4(1)(c) prohibits "AI systems used for indiscriminate surveillance applied in a generalised manner to all natural persons without differentiation. The methods of surveillance may include large scale use of AI systems for monitoring or tracking of natural persons through direct interception or gaining access to communication, location, meta data or other personal data collected in digital and/or physical environments or through automated aggregation and analysis of such data from various sources." Analytics anyone? The whole advertising ecosystem?
Now we know that the legislative process will flush out, and likely deal with, some of the potential overreach, but the leak does indicate an EU intention to approach AI regulation with a GDPR-style approach - high fines (4% of global turnover) - and some fundamental misunderstandings of how machine learning works. For example, the draft the draft mandates that "training and testing data sets shall be relevant, representative, free of errors and complete and shall have the appropriate statistical properties, including as regards the persons or groups of persons on which the high-risk AI system is intended to be used." Is there ever a large data set that is "free of errors".
One of the potentially most impactful provisions relates to information requirements associated with "high risk AI systems". The draft includes a requirement to provide publicly information about "any known and foreseeable circumstances that may lead to unintended outcomes deriving from the use of the high-risk AI system and creating residual risks to safety and fundamental rights obligations, including known biases against specific groups protected under applicable EU non-discrimination law". This looks a lot like healthcare regulation, which will be applied in addition to CE conformity marketing.
The draft does contain "Measures in Support of Innovation", but - to be blunt - this basically boils down to regulatory sandboxes and not much more at first glance.
And - of course - there will be a "European Artificial Intelligence Board". Because there was never a tough policy challenge that a regulatory board could not solve :-)
Maybe I am being too cynical, but this leaked draft seems unlikely to deliver the intended "fostering of the development and uptake of artificial intelligence" while at the same time protecting European citizens. Given the pace of technological development, it looks more like a recipe for a compliance burden that might just rival - over time - GDPR for any companies developing or using advanced digital technologies....
A legal framework setting up a European approach on artificial intelligence is needed to foster the development and uptake of artificial intelligence that meets a high level of protection of public interests, in particular the health, safety and fundamental rights and freedoms of persons as recognised and protected by Union law. (Recital 3)