Legal Brief: The World’s First Attempt at AI Regulation

The European Parliament is pushing for stricter restrictions on biometrics stemming from fear that the technology could enable mass surveillance and infringe on citizens’ privacy and other rights. Consequently, the law bans some uses of AI that infringe on human rights and civil liberties. It also identifies certain “high-risk” AI systems (such as systems intended to monitor workers and those involving critical infrastructure, law enforcement, border control, etc.).

As to those systems, the developers must provide details on training, ensure transparency for users, and offer opportunities for appeal and redress. The rules ban cognitive behavioral manipulation, the untargeted scrapping of facial biometrics from the internet or CCTV footage, social scoring, and biometric categorical systems (i.e., systems that infer political, religious, philosophical beliefs, sexual orientation, and race).

The EU regulatory framework allows consumers to bring complaints if they believe their rights were violated by the use of these systems. Violators are subject to fines – which can vary depending on the circumstances.

Possible Exceptions

Not all are pleased with these developments, as some EU member countries want to use AI to fight crime and terrorism. As a compromise, the rules allow real-time biometric surveillance in public spaces for certain crimes, prevention of genuine threats, such as terrorist attacks, and searches for people who are suspected of the most serious crimes. Also, the rules will not apply to systems used exclusively for military or defense purposes, systems used for the sole purpose of research and innovation, and to people using AI for non-professional reasons.

Some believe these rules will stifle innovation and are yet another example of hyper-regulation. Others think the rules do not go far enough – claiming, for example, that public use of facial recognition violates the privacy rights of the public.

The legislation is expected to enter into force early in 2024 and should apply two years after that. That timetable is ironic, because the technology may be very different by then!

Although the EU regulations do not apply directly in the U.S., companies who do business with the EU will have to study them and comply. Further, the laws could become the blueprint for other governments – including individual U.S. states, cities, or the U.S. federal government.

The regulators remain two steps behind the technology, but, in Europe, at least they are off the couch.