Commercially Connected Shorts - 7 February 2024

Round-up of knowledge

This week we look at:

• Supply chain: new EU law aimed at ensuring stability of supply in the event of future crisis
• Consumer: EU “right to repair” Directive a step closer
• Privacy: are you cookie compliant?
• UK and EU AI update

EU reach provisional agreement on preparing and responding to crisis

The European Council and Parliament are close to agreeing the (soon to be named) Internal Market Emergency Resilience Act (IMERA) (but currently known as the Single Market Emergency Instrument).

The new law is aimed at “guaranteeing an internal market that ensures the stability of supply chains for critical goods and services” putting the EU on the front foot should future crisis occur (using lessons learned from COVID, conflicts between neighbouring countries and energy supply).

Being prepared includes continuous monitoring of the global landscape for developing crisis situations, having “vigilance or emergency modes” ready for activation in the event of clear threats and establishing a governance structure so member states (“MS”) can provide a coordinated response. A Commission and MS led advisory group is also proposed (with a reporting requirement to Parliament) together with emergency measures such as:

• targeted information requests to economic operators on their supply stocks in times of crisis
• information sharing between MS and joint emergency procurement in emergency situations
• priority-rated requests for crisis-relevant products - a fast-track procedure to bring certain products onto the market without liability for defaulting on contractual obligations
• derogations from product-specific rules

MS will be encouraged to stress test their emergency plans.

Once both the Council and Parliament have formally adopted the proposals MS will have 18 months to implement the new rules from them coming into force.

“Right to repair” Directive: EU consumer right legislation a step closer

The EU Council and Parliament have reached provisional agreement on a bill to reduce waste and improve accessibility to repairs of products.

Key measures include:

• an obligation on manufacturers to repair common household products (such as washing machines, smart phones and vacuum cleaners)
• enhanced consumer awareness of the manufacturer duty to repair and web access to local repair shops
• ability for consumers to borrow a device whilst theirs is being repaired or take a refurbished alternative
• online access to repair pricing with manufacturers obliged to make available spare parts for a reasonable price and MS obliged to support the pricing regime (e.g. either through less tax or vouchers)
• additional one year extension to legal guarantee for repaired goods
• manufacturers to be prevented from implementing measures to obstruct repair (be it by 3rd party repairers or using contract terms)

Once formally approved and published in the Official Journal, member states will have 24 months to implement the directive nationally. Manufacturers of products placed on the EU market should start planning how they will be compliant with the new requirements and engage with their consumers. This proposal was announced in 2020 in the New Consumer Agenda and Circular Economy Action Plan and complements other new EU measures on eco-design and green transition.

Cookie compliance: further warning from ICO

In November we highlighted the ICOs threat of action against websites who chose to ignore cookie compliance. Last week further warnings were issued by the ICO to “proactively make advertising cookies compliant”.

The ICO report that their call to action and targeted messaging to some of the top 100 websites in November resulted in 38 out of 53 websites making changes to their cookie banners (with a further 4 committing to compliance by the end of this month). Other organisations are looking at alternative compliant advertising models (which the ICO plan to issue further guidance on shortly).

The ICO will continue their roll out of targeted comms to the top websites and are planning to use AI to identify non-compliance.

Have you checked your cookie compliance? The ICO are seeing a ripple effect of their actions and advise organisations to “address your cookies now before the regulator comes knocking”.

UK report published on large language models (LLMs) and generative AI whilst EU Council publishes latest AI Act text

The UK House of Lords Communications and Digital Committee have published their report into LLMs and Gen AI.

Numbering nearly 100 pages, the inquiry focussed on trends over the next 3 years and identifies priority actions to ensure the tech benefits people, our economy and our society. A period of “heightened technological turbulence” lies ahead. Key messages include:

• “room for improvement in the UK Government’s priorities, policy coherence, and pace of delivery” – have we pivoted too far towards a narrow focus on AI safety?...This risks leaving the UK behind the curve. A more positive balanced approach is required
• greater support for commercial opportunities and academic excellence
  
  • measures to boost computing power and attract private sector investors
  • equitable access to high end computing facilities (researchers and SMEs)
  • build and support the infrastructure, skills and academic spinouts
  • a “sovereign LLM capability” – bespoke and secure, to benefit public service
• prioritise open competition and transparency
  • review the security implications of open and closed AI models and look to support competition. Open AI offers greater access and competition but a risk of uncontrolled capability versus closed AI which offers that security control but less competition. UK mid-tier business (which is a strength) will benefit from a balanced approach here
  • be transparent in AI appointments to avoid and mitigate conflicts of interest
• further action to prevent breaches of copyright – the current legal framework is “failing” – support rightsholders in checking and protecting their rights (consider whether an update to copyright legislation is required to achieve this) and encourage tech firms to use licenced materials
• address immediate risks which pose threats to public safety and financial security – faster mitigations are needed in cyber security, counter terror, child sexual abuse and disinformation. An AI risk taxonomy would be beneficial
• AI Safety Institute should
  • review catastrophic risks (i.e. those which lead to >1000 deaths and/or financial damages >£10bn such as biological/chemical release; destructive cyber tools; critical infrastructure failure) and what the warning indicators might be with safety tests for high impact high risk models. Focus on safety by design rather than retrospective guardrails
  • develop robust techniques to mitigate societal risks – LLMs are prone to discrimination and bias. An ethical focus is required
• it is “almost certain” that existential risk will not manifest within the next 3 years and as knowledge grows it is hoped concerns about risks to existence decline
• further resource, standardised powers and guidance for the UK regulators responsible for AI so their oversight is achievable and meaningful. Avoid overregulation. Support the upskilling and reskilling of workers in industries most at risk from AI deployment and disruption and further clarity on how data protection is applied to LLM processes
• Law Commission should review legal liability across the LLM value chain
• the UK can learn from the EU, US and China but “forge its own path” on AI regulation. International co-operation should continue but not divert from domestic action

Meanwhile, the EU Council have published the latest text of the EU AI Act following approval on 2 February. This text will be considered by MEPs in the European Parliament (scheduled for mid-April) with the Act expected to come into force later in the year.

This report is intended to give you a general overview of legal developments in certain areas. It is provided for information purposes only and is not intended to be comprehensive or to constitute advice on which you may rely.