Another Vote for the EU AI Act: The Risk-Based, Pro-Innovation Approach to AI Regulation
On March 13, 2024, the European Parliament passed a landmark law intended to uphold and protect human rights, democracy, rule of law, and environmental sustainability. During negotiations, member states expressed needs for stronger cybersecurity to prevent human trafficking and terrorism, increased accountability for compliance with EU copyright law and intellectual property protections, and greater transparency among private technology companies through new codes of practice and robust complaint mechanisms. The co-rapporteurs for the law affirmed its power to “reduce risks, create opportunities, [and] combat discrimination” stressing how it will push Europe to “rethink the social contract at the heart of our democracies, our education models, labour markets, and the way we conduct warfare.” Over 84% of the Parliament voted in favor.
This is the European Union Artificial Intelligence Act – the world’s first ever comprehensive legal framework on AI.
The twenty-first century has seen an unprecedented proliferation of AI, leading to advancements in healthcare, automation, and education, accelerating scientific discovery, economic growth, and societal equity. AI has also inflicted severe harms, many of which were discussed by the European Parliament. It has contributed to trafficking and terrorism, copyright and IP infringements, unlawful tracking and surveillance, unethical autonomous weaponry, and environmental degradation.
Amnesty International reports that current development and deployment of AI systems, reliant on unlawful “web scraping” and data collection processes, violate international human rights law, such as the rights to privacy, equality and non-discrimination, and freedom of expression. Meanwhile, the United Nations outlines how AI can help governments achieve the human rights-based Sustainable Development Goals by 2030 – if proper policy is in place. Otherwise, it threatens to exacerbate challenges.
Amid the mix of hopes and concerns, the question of how to regulate the development and deployment of AI (if at all) has become a heated debate around the world. By the end of 2023, large-scale regulation remained lacking. At the time, the most defining regulatory frameworks included the Hiroshima Process International Code of Conduct, which offered organizations developing advanced AI systems from G7 nations the option to disclose risk-management strategies. Additionally, the Bletchley Declaration that emerged from the inaugural AI Safety Summit didn’t create any obligations for its 28 signatories – nor do much of anything, as even its own website touts.
Enter the EU AI Act: the first law to mandate strict governance, risk management, transparency requirements, national-level compliance oversight, as well as severe financial penalties (up to 7% of annual turnover) for violators. It came into force on August 1, 2024 and is scheduled to roll out in stages until 2030. It applies different rules to different AI systems depending on the level of risk they pose as determined by their intended use – as a safety system or a product – and whether they feature a third-party conformity assessment. AIs are ranked as having minimal, limited, high, or unacceptable risk. Regulations placed on the three highest risk levels range from disclosure obligations for sufficient transparency, to strict obligations around risk assessment, activity logging, and human oversight, to total prohibition.
To be expected for such a unique, sweeping piece of legislation, the EU AI Act has received fierce criticism. Legal experts say Europe is now stuck behind the U.S. and China under such an “ill-advised” law, which they call a “blueprint for hindering AI development.” According to them, European companies are now put at a stark competitive disadvantage by having to meet vague, subjective, even impossible standards. Other experts say the EU AI Act squashes Europe’s chances at being a global leader in AI, and will create “enormous costs and little tangible consumer benefit,” especially given the various benefits of AI.
This encapsulates the main criticism of the risk-based approach to AI regulation: the pro-innovation approach. According to this view, the EU AI Act inhibits technological advancement, economic prosperity, and overall innovation in Europe.
This dispute motivates the idea of a mutually exclusive nature between risk-based and pro-innovation approaches to AI regulation. One is either the former, prioritizing safety by placing strict guardrails proportional to presumed risk that limit AI development and deployment; or the latter, prioritizing technological advancement and economic prosperity through a liberal approach that maximizes them. Under this framing, the logic is that the risk-based approach is synonymous with regulation, and the pro-innovation approach is synonymous with anti-regulation. Since regulation and anti-regulation are mutually exclusive, risk-based regulation is equated with being anti-innovation, assumed to inhibit technological progress and stall development.
As the EU AI Act proves, this is a false dichotomy. Firstly, the act was chiefly created to uphold and protect democracy and human rights given existing and anticipated threats of irresponsible AI. These goals cannot be framed as anti-innovative in themselves. Moreover, the EU AI Act was created for those purposes and for simultaneously “boosting innovation and making Europe a leader in the field.” Under this commitment, the act’s launch has come alongside an array of relevant programs. The AI Continent Action Plan outlines strategies to ensure competitiveness, productivity, and innovative business models for European economic prosperity. The AI Innovation Package supports startups and small businesses in the European development of AI by bolstering digital infrastructure. AI factories connect computing power, data, and talent with financial stakeholders across Europe to challenge the boundaries of AI capabilities across important fields like health, manufacturing, and climate.
Furthermore, equating risk-based with anti-innovation obfuscates the shared intention behind risk-based and pro-innovation. Both approaches seek meaningful progress that can better serve and meet the needs of the world – productivity, in their own ways. Recognizing this likeness enables understanding that they can coexist. Additionally, the equation of pro-innovation with anti-regulation distracts from the vast counterproductivity that has occurred under anti-regulatory approaches to AI: despite potentially yielding more technological discovery, unregulated AI has led developers and deployers to countless lawsuits, giant payouts, and overall pausing operations amid severe repercussions.
A tradeoff doesn’t exist under a framework like the EU AI Act. The development and deployment of AI that occurs under risk-based regulation is responsible and controlled. It puts human wellbeing, technological progress, and economic prosperity at the forefront. It encompasses a dualism of risk-based and pro-innovation.
The EU AI Act is not perfect. Civil society scholars claim that there are too many loopholes for private security agencies, leniency in authorizing biometric use of AI, and double standards for providers who operate outside of the EU, all of which disproportionately harm socially marginalized communities and neglect human rights. Implementing the act has already been difficult, as the European Parliament has already experienced rollout delays. Nonetheless, the EU AI Act is an undeniable and remarkable act of regulatory progress that creates an extensive plan for proper regulation of AI, and perhaps it needed to be enacted to be able to identify its blind spots.
There is optimism that the EU AI Act is already creating accountability for other countries or regions to follow in its footsteps, providing an ethical and legal standard toward which they should strive. Countries like South Korea and Brazil have introduced similar legislation since March 2024, and as of this year, American AI companies are requesting more robust regulation from the EU AI Act out of safety concerns. This affirms how norm creation is an increasingly meaningful pathway for advancing solutions to pressing global issues when existing measures are lacking.
Overall, under a regulatory approach like the EU AI Act, future misconduct can be prevented while supporting responsible technological and economic progress. This sets a standard for the development and deployment of AI that affirms the importance of human-centered governance.