Momentum is building (again) for AI regulation in Australia

The EU is pressing ahead with the proposed European law on artificial intelligence (the AI Act) which would be the first general law on AI by a major regulator anywhere. As a result, the AI Act is expected to exhibit the ‘Brussels effect’ experienced with the General Data Protection Regulation (GDPR) introduced in 2018. The GDPR harmonised data privacy laws across Europe and went on to set the international benchmark for data privacy for international businesses.

The approach taken in the AI Act recognises that it is impractical to regulate the technology itself so focuses on regulating the use of the technology where AI applications and systems present a high or unacceptable risk. The AI Act adopts a risk-based approach imposing obligations on providers, developers and users based on the level of risk the AI system can generate.

“AI systems with an unacceptable level of risk to people’s safety and intrusive and discriminatory uses would be strictly prohibited, including systems that deploy subliminal or purposefully manipulative techniques, exploit people’s vulnerabilities or are used for social scoring (classifying people based on their social behaviour, socio-economic status, personal characteristics).”³

High-risk applications including harm to people’s health, safety, fundamental rights or the environment are subject to specific legal requirements (for example influencing voters in political campaigns or CV-scanning tool that ranks job applicants). Applications that are neither explicitly banned nor classified as high-risk are largely left unregulated.

For the significant number of applications of AI systems that are neither banned as unacceptable, nor regulated as high-risk, they will likely fall outside the regulatory permitter of the regime.

The AI Act sensibly recognises that compliance with legal principles is often challenging in the case of rapidly evolving technology. As a result, the AI Act will lean heavily on the role of international technical standards to evidence compliance. To support industry, the AI Act seeks to impose the burden of evaluation on the regulator not the individual company.

The current hype around generative AI has resulted in updates to the draft bill since its first iteration. Generative foundation models (the language model engines underpinning chat bots like ChatGPT, Microsoft Bing, and Google Bard) will be required to guarantee robust protection of fundamental rights, health and safety and the environment, democracy and rule of law. They would need to assess and mitigate risks, comply with design, information and environmental requirements and register in the EU database. Obligations in respect of transparency will require disclosure that the content was generated by AI, design features to prevent the model form generating illegal content and transparency with regards to training data which is subject to copyright⁴.

After extended period of consultation and debate, earlier this month the Internal Market Committee and the Civil Liberties Committee of the European Parliament adopted a draft negotiating mandate for the text by resounding majority. If Parliament votes to accept the text at the upcoming plenary vote scheduled for mid-June, this will provide the mandate for subsequent trilogue negotiations with the Council and the Commission. The proposal of the EU AI Act will become law once both the Council representing the 27 EU Member States and the European Parliament agree on a final version of the text, expected by the end of 2023/beginning of 2024.⁵

The U.S. has a well-established tech industry and motivation to promote investment and economic activity in AI. Historically the U.S. has relied on voluntary standards, self-regulation and the patchwork of existing laws and regulations that apply to AI systems. High profile Senate hearing in mid-May signalled a potential shift in approach towards considering domestic AI regulation with lawmakers questioning C.E.O. of OpenAI, Sam Altman on how AI should be regulated⁶. While the U.S. released the National Institute of Standards and Technology (NIST) AI Risk Management Framework, the Blueprint for an AI Bill of Rights, there is no genuine indication yet of a unified federal law on AI. The U.S. is however, playing a key role in the harmonisation and convergence of international standards, an vital part of the international AI governance response. At the fourth ministerial meeting of the EU-US Trade and Technology Council on 12 May 2023, representatives resolved to strengthen translantic co-operation on emerging technologies (including AI).

China was one of the first countries to introduce specific legislation directed as particular use cases of AI models and systems including recommendation algorithms and deep synthesis technology (responsible for deep fakes). We expect China to continue to adopt this targeted approach.