Regulating AI: a risk-based approach for Europe

The European Union proposes to apply ex-ante regulation to high risks Artificial Intelligence to enable a trustworthy and secure development of AI in Europe.

One of the two strategic papers presented by the European Union on February 19^th was the White Paper on Artificial Intelligence. Two unfinished drafts were shared in the previous weeks, raising some interesting debates. One of them was about the proposal to enforce a three years moratorium for, i.e. banning for three years, the usage of facial recognition in public spaces. This trial balloon highlighted the diverging views on the issue by two relevant IA agents: Google and Microsoft. While Alphabet’s CEO supported the call for the moratorium, Microsoft’s chief legal officer was dismissive about it. So, this disagreement has added some salt and pepper in the waiting for the publication of the White Paper that is to shape the role Europe will play in the AI race the years to come.  

The released White Paper proposes an AI industrial strategy for Europe to adopt and lead on AI and sets out options for a legislative framework to boost trust in AI while respecting Europe’s fundamental rights and ethics. The proposed regulatory framework for AI can be summarized in three basic ideas

• Current EU legal framework, which already applies to AI, needs to be adapted to address the challenges raised by specific characteristics of AI.
•   High risk AI is to be regulated ex-ante, including going through a certification process to guarantee compliance with defined obligations prior to its use.
• Non high-risk AI is not subject to specific regulation but can voluntarily adhere to a Labeling scheme to be defined in order to provide a higher degree of trustworthiness on the service to citizens. Compliance of obligations included in the labelling scheme is mandatory for those voluntarily joining it.

The risk-based approach, as already proposed in the Opinion of the Data Ethics Commission of the German Federal Ministry of Interior, seems a fit approach to address Artificial Intelligence challenges. Certainly, the legal and human rights effects on individuals varies greatly from an AI based system recommending movies to Movistar TV customer, to a fully autonomous self-driving vehicle or a system evaluating the patient’s success rate of a heart transplant for a group of potential recipients. Thus, the legislative and regulatory approach should be a combination of ex-ante and ex-post rules increasing its intervention upon increasing risk; that is, ranging from a lighter to null intervention for low risk AI, to a high intervention for high risk AI.

As it is always the cases for regulatory proposals, the devil hides in the details, meaning more precise definition of the framework is needed to assess it is fit for purpose. These are some concerns, or proposals of improvement to the EU policy proposal:

• The dual cumulative criteria to define high risk AI, based on the sector of applications and the usage case seems fit for purpose. A more precise definition is needed to provide legal certainty on what is high risk and thus subject to ex-ante regulation. On this regard, treating biometric identification as a special high-risk case without recurring to a time-limited moratorium in its usage is a positive approach avoiding making Europe to lag behind and limiting its industries to develop a use cases.     
• The provided set of obligations need to be more precisely defined in order to be effective and implementable. This is relevant in terms of defining the prior certification process, which should not be too burdensome neither have a significant impact on time-to-market of AI services: time to pass the certification process should be kept short. The fast pace of change of new technologies and AI, the potential continuous updates of AI systems and the self-learning  capacity of some AI need to be taken into utmost consideration for the certification processes to remain effective while at the same  time not delaying the evolution and improvement of AI.
• While the ex-ante regulation and prior certification process is a valid approach, the proposal does not consider the adoption of Regulatory Sandboxes. At this early stage, Sandboxes could foster a more enabling framework for innovation to take place while providing a more secure and trustworthy environment for new AI systems and for Authorities to get a deeper knowhow on supervising and enforcing regulation.   
• The White Paper proposes a new framework for AI in Europe, but AI is already playing a role in our lives that will be much more relevant by the time this framework is approved and enforced; some of the uses will be rated as high risks while others will not. Therefore, an impact assessment of how this new regulation will affect and will be enforced on already existing AI based services is required. This should allow such services not to be disrupted while also foster defining a more effective and fit for purpose framework for AI.
• The scope of the proposed framework, affecting all providers of AI based products or services offered in the EU irrespectively where the provider is based – in a similar fashion of GDPR– paves the way for a level playing field where all companies can fairly compete. Nevertheless, cherry picking in search of the most flexible implementations should be avoided. As such, EU should predefine, for each sector -finance, pharmaceuticals, aviation, medical devices, consumer protection, …- the Authority of which Member State will have the mandate to supervise non-EU based companies providing services in such sector.      

After all the hard work of EU officials leading to the publication on February 19^th of the White Paper on AI, the bad news for EU officials is many busy days are yet to come for the final adoption of an EU strategy and policy framework for AI.  on June 14^th is the next relevant milestone for this process, when commenting period of the open consultation for the White Paper on AI will come to an end.

The good news for European officials, and for the whole of Europe, is the White Paper is a first step in the right direction for Europe to lead a human centric, ethical and European values-based development and adoption of AI. The adopted changes from the two unofficial drafts to the released White Paper are already encouraging, with the consultation process assuring an even fitter approach for the aimed objective of trustworthy AI in Europe. We should all now contribute to the discussion on the new AI policy framework to build a better and stronger Europe where no one is left behind.