Regulatory Consultations on Responsible AI: Shaping the Future Across Borders

In an era where artificial intelligence (AI) is being rapidly integrated into everyday life and business operations, privacy concerns have increased. AI systems, which often process vast amounts of personal and sensitive data, necessitate robust guidance and regulations to safeguard privacy and protect individual rights. Governments and regulators worldwide are developing frameworks and seeking stakeholder feedback to ensure the ethical and responsible use of AI.

AI technologies, including machine learning algorithms and generative models, can analyze and utilize personal data in ways that may not always be transparent or understandable to users. These systems can inadvertently reveal personal information, reconstruct sensitive data, or even make decisions that impact individuals’ lives without sufficient oversight. The risk of data breaches, unauthorized data usage, and the potential for discriminatory outcomes highlights the need for stringent privacy protections.

Regulations like the EU’s GDPR, AI Act, and U.S. Colorado’s Consumer Protections for AI provide some essential safeguards. They ensure that AI systems adhere to principles of data protection, such as data minimization, purpose limitation, and transparency.

For instance, GDPR mandates clear consent for data collection, limits data use to specified purposes, and grants individuals rights to access and rectify their data. These regulations aim to mitigate risks associated with data misuse and ensure that AI technologies operate within defined ethical and legal boundaries.

Ethical considerations

In addition to privacy, ethical considerations are integral to AI governance. Regulations often address issues such as fairness, non-discrimination, and the prevention of harmful outcomes. By embedding these principles into legal frameworks, policymakers aim to ensure that AI technologies are developed and used in ways that respect human rights and societal values.

As AI continues to advance and integrate into various sectors, governments and agencies worldwide are developing frameworks and seeking stakeholder feedback to ensure its ethical and responsible use. Recent consultations reveal differing approaches to AI regulation, reflecting each country’s priorities, strengths and potential areas for development.

How mature is your AI risk management? Take the quiz.

What is AI governance?

AI governance refers to the policies, ethical principles, and regulations that guide the creation and application of AI technologies. It involves frameworks to ensure transparency, fairness, and accountability in AI algorithms while addressing issues like data privacy and safety.

Collaboration among AI practitioners, educators, and policymakers is vital for developing robust governance frameworks. Tools like logging GPU usage or maintaining an AI registry could enhance responsible AI governance by tracking algorithm usage, performance, and ownership. This process includes diverse stakeholders to balance representation and effectiveness.

Why does AI governance matter?

The rapid adoption of AI presents significant benefits and risks. Without proper AI governance practices, unintended consequences like bias, privacy violations, and economic disruptions may arise. Trustworthy governance minimizes risks and ensures AI systems operate safely. Implementing AI governance through collaboration, transparency, and safety research fosters ethical innovation and mitigates harm.

Global approaches to AI governance

France – Privacy and compliance based

The CNIL’s recent consultations explore how AI models comply with the GDPR, the resources required for training and developing foundation models, the computing power necessary for such tasks, and the types and sources of data needed.

Specific questions raised by the CNIL address the advantages and disadvantages of using on-site infrastructure versus third-party cloud services, the role of graphics processing units (GPUs), the impact of data from adjacent markets, potential competitive dysfunctions, the influence of minority interests, and the implications of European regulations like the EU AI Act and Digital Markets Act on the sector’s dynamics.

Running until September 1, 2024, the consultations provide a crucial opportunity for businesses and stakeholders to take part in building clear frameworks for GDPR compliance and ensuring that AI models respect privacy and data protection standards.

Under draft guidelines, data controllers are required to justify any deviations from these principles and sort data to retain only pertinent annotations. When creating training datasets for third parties, annotations should be relevant and comply with GDPR. Transparency is crucial, including informing about annotation purposes and security measures, while sensitive data requires strict adherence to legal provisions and enhanced security measures. A data protection impact assessment (DPIA) will be necessary for high-risk scenarios and ensures personal data is reused lawfully, either from public sources or third parties.

UK – A comprehensive and flexible approach

The UK is making significant strides in addressing the multifaceted challenges and opportunities presented by AI. Through a series of guidelines and consultations, the UK government has articulated a clear vision for the development, deployment, and regulation of AI technologies.

The UK emphasizes:

(1) the necessity of a lawful basis for using personal data in AI training, underscoring compliance with data protection laws like the UK GDPR,
(2) purpose limitation, stressing that AI data should be collected and used for specific, explicit, and legitimate purposes,
(3) accuracy of AI outputs for maintaining the credibility and utility of AI applications,
(4) embedding individual rights into generative AI models, and
(5) a proactive approach to AI system security, including staff training, secure system design, threat modeling, and robust asset protection measures.

The ICO UK requires developers to pass a three-part test addressing the purpose and necessity of processing, and a balance of interests, to justify using legitimate interest as a legal basis under UK GDPR. The ICO is particularly interested in how developers can demonstrate the necessity and impact of their processing while ensuring effective risk mitigation. Developers must ensure that model accuracy aligns with its intended purpose and transparently communicate this to users. For applications requiring accurate outputs, such as summarizing customer complaints, the accuracy of the model is crucial.

However, for creative purposes, like generating storylines, accuracy is less critical. Both developers and deployers are responsible for implementing risk-mitigating controls and providing clear information on accuracy and usage to avoid misuse. Businesses must have processes for respecting individuals’ rights throughout the AI lifecycle, from training and fine-tuning to model output and user queries. This involves clear communication about data use, providing access to personal data, and respecting rights such as erasure and restriction while considering impacts on model fairness and accuracy.

The UK’s Department of Science, Innovation and Technology (DSIT) proposed a voluntary Cybersecurity Code of Practice aimed at enhancing AI system security. The Code advocates for proactive security measures, including staff training, secure system design, threat modeling, and robust asset protection.

It covers various stakeholders, from developers and operators to data controllers and end-users, emphasizing secure development, deployment, and maintenance of AI systems.

The UK’s approach to AI regulation is deeply rooted in ethical and legal principles, particularly around data privacy and protection. This contrasts with the more laissez-faire approach seen in some other regions, where rapid innovation is sometimes prioritized over regulatory compliance. A consistent theme across the UK’s guidelines is the emphasis on transparency and accountability.

US – Focus on consumer protection and fairness

Recent consultations and requests for information (RFIs) from various government bodies underscore the complexities and multi-faceted nature of AI implementation and oversight. The AI definition provided by the National Institute of Standards and Technology (NIST) and the Department of the Treasury, generally aligns with President Biden’s Executive Order on Safe, Secure, and Trustworthy Development and Use of AI. This consistency is crucial for establishing a unified approach to AI across different regulatory frameworks. The evolving scope of AI applications, from consumer protection to financial services, reflects the expanding role of AI in various sectors.

Across all consultations, there is a strong emphasis on identifying and mitigating risks associated with AI, and there is a specific interest in how AI can improve the efficiency and effectiveness of these processes while ensuring fairness and transparency. The guidelines will significantly impact businesses by imposing stricter requirements for transparency, fairness, and accountability in AI systems.

The FTC’s proposed rules to combat AI-driven impersonation scams, aim to strengthen protections against scammers who impersonate government agencies or businesses by using their logos, email addresses, or web addresses. The rule would allow the FTC to pursue direct federal court actions to recover funds from such scams and includes new prohibitions on impersonating individuals for unlawful purposes.

NIST’s draft guideline for secure AI software development outlines practices for AI model producers, system producers, and system acquirers. The guidelines cover defining security requirements, managing software vulnerabilities, and using automated tools to support secure development throughout the software lifecycle, and emphasize protecting code and data, designing secure software, and addressing vulnerabilities. The aim is to help organizations implement a risk-based approach to secure AI model development and ensure robust software security.

Canada – Ethical standards for SMEs

The Canadian Digital Governance Standards Institute (DGSI) is currently in consultation on its second edition of standards for the ethical use of AI by small and medium organizations, which are entities with fewer than 500 employees.

Open until September 16, 2024, the consultation aims to establish a comprehensive framework for integrating ethics into AI systems, covering both internally developed and third-party tools. The framework includes identifying key actors and their responsibilities, implementing risk assessment and mitigation strategies, and ensuring continuous monitoring and transparency.

Additionally, the standard emphasizes creating a robust risk management framework with oversight, risk assessments, and strategies to mitigate bias and harm. Businesses are encouraged to document and regularly review their AI systems’ performance and ethical impact, including the data used for training models, and should ensure that there is a process for affected individuals to appeal AI decisions and handle data responsibly.

The ethical standards will require businesses, especially small and medium-sized ones, to implement comprehensive risk management frameworks, including oversight and regular risk assessments of their AI tools. Businesses will need to address biases, ensure data protection, and establish processes for transparency and appeals. This will likely increase operational costs and administrative efforts but will enhance ethical practices and accountability in AI deployments.

Peru – Risk-based and ethical approach

The government of Peru sought comments on a draft regulation concerning high-risk AI systems to ensure their responsible use while promoting economic and social development. The draft categorizes AI systems based on risk levels: unacceptable, high, medium, and low, setting strict requirements for high-risk systems, such as those used in biometric identification or credit evaluation. Unacceptable risks, including manipulative or discriminatory AI uses, are strictly prohibited.

It will also require businesses to implement robust risk management and transparency measures for AI systems, particularly for high-risk applications. Businesses will need to provide clear disclosures about AI interactions, maintain detailed records, and develop ethics policies.

Compliance will involve managing biases, protecting privacy, and ensuring human oversight, potentially increasing operational costs but also fostering trust and responsible AI use.

Taiwan – Human-centered and innovative approach

In the Asia-Pacific, Taiwan’s National Science and Technology Council (NSTC) consultation on AI law stands out for its attempt to balance innovation with societal impacts, and its comprehensive approach to AI principles. The consultation seeks public feedback on principles governing human autonomy, data protection, transparency, and accountability. Comments are invited until September 13, 2024, to refine this regulatory approach.

The law will require businesses to adhere to new regulations on data protection, transparency, and risk management. Businesses will be required to ensure their AI systems comply with principles of fairness, accountability, and privacy, potentially increasing operational costs. They will also need to adapt to new standards for data sharing and risk assessments, and may benefit from access to a regulatory sandbox for innovation. Additionally, fostering AI literacy and addressing potential biases will become integral to their operations.

Who gets AI right – AI oversight across borders

The global landscape of AI governance is marked by diverse approaches reflecting each region’s regulatory priorities and philosophies.

Consistency in definitions and focus

The US stands out for its consistent AI definitions across consultations, facilitating clarity for stakeholders. France also maintains consistency through GDPR, though it may be less adaptable. Taiwan covers principles such as human autonomy, sustainable development, societal well-being, and information security.

Risk management and governance

All regions emphasize robust risk management and governance, but approaches vary. The UK’s flexible framework contrasts with France’s rigid GDPR compliance, while Peru’s focus on high-risk systems and Taiwan’s holistic model offers different balances between regulation and innovation. Canada’s standard outlines a comprehensive risk management framework, including oversight, risk assessments, and mitigation measures.

Sector-specific concerns

The US provides detailed sector-specific guidance, particularly in financial services, highlighting its tailored approach. In contrast, other countries like Canada and Taiwan offer more generalized frameworks that apply across sectors.

Ethical considerations

Canada’s approach is notable for its detailed guidance tailored to small and medium-sized businesses, emphasizing practical implementation of ethical principles. Taiwan’s human-centered principles and Peru’s focus on ethics in high-risk applications highlight a strong commitment to ethical AI. The UK and the US also address ethical considerations but within broader regulatory contexts.

Engagement with stakeholders

The US’s inclusive approach in seeking stakeholder feedback contrasts with the more prescriptive models of other countries, reflecting a broader effort to incorporate diverse perspectives into AI governance. Taiwan promotes innovation through regulatory sandboxes and public-private partnerships, with a broad focus on aligning AI with societal goals.

How diverse regulatory approaches shape business practices and innovation

The diverse approaches to AI governance across France, the UK, Peru, Taiwan, Canada, and the US significantly impact how businesses develop and deploy AI technologies. In France, strict GDPR compliance necessitates rigorous data protection practices, requiring businesses to justify data handling practices, ensure robust data protection, and implement detailed data governance and quality assurance protocols, potentially increasing operational costs but ensuring robust privacy safeguards.

The UK’s flexible framework encourages innovation while balancing regulatory oversight, which may benefit businesses by providing clearer guidelines and fostering adaptive practices. The emphasis on clear communication and accountability contrasts with more opaque regulatory environments.

Peru’s focus on high-risk AI applications and transparency imposes stringent requirements on high-impact sectors, including clear disclosures and detailed ethics policies. This approach aims to balance innovation with responsible AI use.

Taiwan’s human-centered approach, requires companies to align with principles of fairness and transparency, adapt to new data protection standards, and use a sandbox environment to test innovations. This approach seeks to harmonize technological advancement with societal impacts promoting ethical AI development and broader societal acceptance.

Canada’s tailored guidance requires SMEs to implement comprehensive risk management practices, address biases, and establish clear processes for transparency and appeals, potentially increasing operational costs but enhancing ethical standards.

The US provides comprehensive, sector-specific guidelines that address various risks and opportunities, offering clarity for businesses operating in specific industries but potentially leading to regulatory fragmentation. In the US, businesses face rigorous requirements for transparency and fairness, with a focus on preventing misuse and ensuring secure development practices. This reflects a growing concern for protecting consumers and ensuring robust AI governance.

While each country approaches AI governance with distinct strategies, common themes emerge around the need for transparency, ethical considerations, and effective risk management. Each framework offers valuable insights into balancing innovation with responsibility, reflecting the global effort to navigate the complexities of AI technology in the modern world.