The EU just passed its landmark AI Act—but some say it has nowhere near enough bite

On Wednesday the European Parliament passed the AI Act by a wide majority, with 523 of its 705 members voting in favor. Hailed as the world’s first major effort to regulate AI, the legislation takes a risk-based approach to services or products that use AI. Content recommendation systems, for example, would be deemed low risk and thus subject to relatively lax oversight; medical devices, on the other hand, would face heightened scrutiny around issues like data and transparency.

Brando Benifei, the key legislator who shepherded the law through its passage, heralded the decision in parliament. “We finally have the world’s first binding law on artificial intelligence, to reduce risks, create opportunities, combat discrimination, and bring transparency,” he said.

But others worry that the AI Act is too favorable to industry interests—and fear it sets a bad precedent for other countries.

“For those advocating for human rights, the AI Act is a mixed bag,” says Laura Lazaro Cabrera, counsel and director of the equity and data program at the Center for Democracy and Technology, a digital rights advocacy group. “Whilst we can rightly celebrate that privacy and other human rights are foregrounded in the law, there are too many exemptions that could lead to harmful AI systems posing serious risks to citizens, particularly those in vulnerable situations such as at borders.”

Work on the act began in 2021, before the arrival of ChatGPT, and was intended to draw strict boundaries on how algorithms could be safely used to avoid discrimination. Following the November 2022 release of ChatGPT, legislators rushed to rewrite the law to encompass generative AI. “It was a piece of product safety legislation, a very particular type of EU regulation, with human rights protections kind of bolted on,” says Daniel Leufer, a senior policy analyst at the digital civil rights non-profit Access Now.

But tech companies, seeing the potential of the booming generative AI industry, quickly lobbied legislators to ensure the rules as outlined weren’t overly restrictive on their growth. Those efforts were largely successful: Time previously reported that OpenAI successfully managed to lobby to change the wording of a past draft of the act.

As regulators shifted their attention to focus on generative AI, Leufer says they took their eyes off the original purpose of the act: to limit the most dangerous uses of AI, including in biometric border control and policing. While there are addendums in the act discussing such usage, advocates believe the law as written falls far short. And simultaneously, a controversial clause inserted into the act—Article 6(3)—lets generative AI developers declare their products to be lower-risk, thereby skirting some of the oversight rules.

Leufer worries that the AI Act has set a new global standard, much like the General Data Protection Regulation (GDPR) did in 2018. But compared to the GDPR, which created a precedent for data protection rules, the AI Act is far too lax. “The AI Act from its very inception was already a concession,” he says. “And what we’ve got at the end is really a victory for industry and for law enforcement.”

The process of actually implementing the law still has further stages to go, giving companies time to prepare. And for activists like the Center for Democracy and Technology’s Lazaro Cabrera, that means the fight is far from over. “There’s so much at stake in the implementation of the AI Act,” she says. “As the dust settles, we all face the difficult task of unpacking a complex, lengthy, and unprecedented law.”

https://www.fastcompany.com/91058443/eu-ai-act-nowhere-near-enough-bite?partner=rss&utm_source=rss&utm_medium=feed&utm_campaign=rss+fastcompany&utm_content=rss