How the EU Artificial Intelligence Act Will Impact You

Maybe a little, maybe a lot. Definitely some.

Photo by Taylor Flowe on Unsplash

I love reading legislation. Not as much as I love reading case law, but legislation lets me play the "OK, so what's the real impact here?" game that's pretty addicting. From mapping out chilling effects across an industry to the creation of new opportunities, to the :raised-eyebrow: WTAF is this trying to do - mapping out impacts of legislation gives you a really broad understanding of whether legislation is good or bad, for whom. 

There's been a lot of ink spilled about the impacts EU Artificial Intelligence Act (AIA) on a very narrow group of people and companies, like OpenAI. This article isn't about them - this article is about the rest of us and what some of the impacts are going to be. The regulation is still pending, so this could all change, but I wanted to ignore the OpenAIs of the world and instead think of individuals and the majority of companies out there that are not OpenAI and their ilk. 

This week on BSE I'm finally diving into the EU AI Act. I read the entirety of the legislation several times, and there's way more nuance than I can give here -- so I'm sticking to the high level. There's a lot more to say here, especially about the high-risk usage, but I wanted to keep this piece introductory and assume you don't know much about the AI Act at all. I hope, by the end of this you'll have a better idea of what the AI Act says, and how it might impact you. 

EU AI Act (AIA) Cliff Notes

The AIA breaks the use of AI systems into 4 tiers based on risk. The regulation starts with the highest risk tie. They define this tier as "Unacceptable Risk." This is where the use of AI systems is never permitted. They give examples of things like social scoring, anything considered to be a threat to the safety, rights, or livelihoods of natural people (as opposed to legal people, which can include corporations and other groups), and real-time biometric scanning in a public area for law enforcement purposes.  

Next, as expected, they have "High Risk." The bulk of the legislation, as well as most of the controversial bits, live here. This category covers a broad range of uses of AI systems, but they still follow a general theme of uses where AI could cause harm if not properly managed. So these are things like critical infrastructure, education and vocational training, employment, social services, law enforcement, things like that. 

With the High-Risk classification, companies have a large number of obligations--things like documentation, registration, and attestations. These obligations represent substantial operational overhead for impacted companies. 

Then, we have Low-Risk AI systems like chatbots. These systems don't have much in the way of obligations, just a transparency requirement on the output of the AI system, and in the case of chatbots, companies have to disclose to users that they are talking to a chatbot. 

The bottom tier is "No Risk" or "Minimal Risk" uses of AI systems. This tier is whatever else doesn't qualify for any of the other tiers, and doesn't come with any obligations outside of transparency. 

The dry stuff is out of the way, so let's dig in - how does this impact you?  

Photo by Arnaud Jaegers on Unsplash

As a Private Citizen... 

Impact: Transparency and trustworthiness

Intensity: EU citizens - high, EU Economic Partners - Medium

The legislation is an unambiguous win for private citizens. It gives you the tools to be aware of when AI is being used so that you can make informed decisions about which tools to use, and which ones to avoid. It will also increase the general trustworthiness of AI systems that are governed under the AIA, meaning that you can assume that those systems have achieved a level of "not abusive, exploitative, and evil." 

Thanks to the Brussels Effect, legislation in the EU "raises the floor" for the rest of the world, so everyone across the globe should see at least some positive impact. EU citizens will get the greatest benefit, and then citizens of the EU's close economic partners will see quite a bit too. 

As a Company without any European employees or customers... 

Impact: Transparency and trustworthiness

Intensity: Minor

The legislation will be largely neutral for you. But most companies have multiple vendors to handle different aspects of their business, and those vendors are much more likely to be global, and obligated to adhere to the AIA. You are likely to get many of the transparency and trustworthiness benefits that private citizens do, but their impact on your business isn't likely to be dramatic. It will allow you to be better informed and make a baseline assumption about the AI Systems, which should enable decision-making for your business if you pay attention to it. 

As a Company with European customers or Employees 

Impact: Increase Costs

Intensity: Substantial

The legislation is going to result in increased costs for you. You'll need to either contract with or hire AI governance professionals to ensure that your processes, disclosures, audits, and monitoring of your AI systems match the legislative requirements. It will take you longer to deliver your AI software in the beginning as navigating through all the legislative requirements will be new, which can result in opportunity losses as your time-to-mark is longer than expected.

In addition to hiring or contracting with specific governance staff, you’ll also have ongoing costs for the monitoring and resubmission as the model evolves.

And you'll have to do it for each system. The legislation assigns risk based on how companies are using AI systems. That means if you have multiple systems or one system used for multiple purposes, you'll have to meet the regulatory requirements for each system and use combination. It will be a sizeable commitment to meet the regulatory requirements as written, and for high-risk uses, you'll also have ongoing monitoring requirements. 

AI regulation is a fast moving target right now, and will evolve substantially, and that will require work and rework. As more legislation is passed, new requires will come into play and more specialized knowledge will be needed to remain compliant across multiple jurisdictions.

Photo by Bradyn Trollip on Unsplash

Unintended Consequences ... 

Impact: Uncertain 

Intensity: Uncertain

This is a bit of a catch-all for things we can't predict well. Experts have already raised concerns about the definition of AI the AIA uses, saying that as it is written, it impacts systems beyond what is anticipated. As I mentioned in a previous article on Section 230, poor definitions here could unintentionally impact things we've used for years - like autocorrect on your phone, or deleting the photobombing tourist from your photos. The same is true here as the definition of AI in the regulation is too broad. 

The 'No Section 230 Immunity for AI Act' Misses the Mark

I allude to this above, there is potential for substantial operation overhead requirements for companies who make heavy use of AI to remain compliant. One of the unintended consequences is that the AIA has a strong chance of chilling AI development globally by creating an environment where only big, multinational companies can afford the overhead required to develop or use AI systems.  

The result of operational overhead is that the regulation pushes the market control into a small subset of mega-corporations that develop most of the world's AI. We are already seeing this as OpenAI's ChatGPT is being used by companies left and right. This reinforces the existing inequalities between companies and harms development overall by stifling innovation and diversity (and lack of diversity results in more biased models) and centralizes the development of AI into the hands of just few ultra-powerful companies.

Wrap up 

It's an easy thing to say that yes, the EU AI Act will impact you whether you are a European citizen/company or not. Overall, the legislation does a lot of good for a lot of people -- it forces companies to be open and upfront about their AI, which is absolutely something that we need. But how it will impact you and me is still very up in the air. As much as I love reading legislation, knowing how effective this legislation will be in 6 months is hard to say. AI is evolving at a breakneck pace with breakthroughs happening weekly. 

But what do you think? Is the AIA a good thing, a bad thing, or something in the middle? Let me know in the comments!