Global AI regulatory update - November 2024

In this edition of our global AI bulletin, we will be looking at:

• Global – WEF and UN reports on AI Governance
• Cross-Border – International AI Convention
• Asia – Hong Kong: AI policy for financial market and HKMA consumer protection, China: AI Safety governance framework, Singapore: AI Security Guidelines
• Europe: EU AI Act Updates, AI Liability Directive, AI Factories and new guidance on AI to public sector bodies
• Middle East – Qatar: WCB AI Guidelines
• UK – AI usage report in investment management, BoE AI Consortium and Public Sector AI Bill
• US – National Security MOU on AI, AI Acquisition guidance for federal agencies and new AI cybersecurity program

Global

Global: World Economic Forum report on governance for generative AI

On October 8, 2024, the World Economic Forum published its report, 'Governance in the Age of Generative AI'. The report outlines an approach for resilient AI policy and regulation.

Impact: The report includes recommendations for policymakers, regulators and industry leaders. It recommends anticipatory governance, international cooperation, and multi-stakeholder collaboration for AI. It also advises addressing regulatory tensions, enhancing enforcement capacities, and promoting knowledge-sharing.

Global: UN report on Governing AI for Humanity

In September 2024, the UN AI Advisory Body published its final report on Governing AI for Humanity. The report makes 7 key recommendations to address critical gaps in AI governance arrangements.

Impact: The report emphasizes the need for a globally inclusive and distributed architecture for AI governance based on international cooperation. It calls on all governments and stakeholders to work together in governing AI to foster development while furthering respect, protection, and fulfillment of all human rights. The proposed mechanisms are designed to complement existing efforts and foster inclusive global AI governance arrangements that are agile, adaptive, and effective in keeping pace with AI's rapid evolution. 

Cross-Border

UK, US and EU: Sign AI Convention

On September 5, 2024, the UK, US and the European Commission signed the Council of Europe’s Framework Convention on AI and human rights, democracy and the rule of law (Convention). The Convention applies to the full life-cycle of AI systems and provides for signatories to take measures to identify, assess, prevent and mitigate risks to human rights, democracy and the rule of law posed by AI.

Impact: Once the Convention is in force, signatories will be required to take legislative, administrative or other measures to give effect to its terms. It will enter into force on the first day of the month which is three months after five signatories (at least three of which must be member states of the Council of Europe) have expressed their consent to be bound by the Convention.

Read more in our briefing.

Asia

Hong Kong: Government unveils AI policy for financial market

On October 28, 2024, the Government issued a policy statement on the responsible application of AI in the financial market. The policy promotes responsible AI application and addresses potential risks. It emphasizes a dual-track approach to promote AI development. The policy aims to enhance Hong Kong’s status as a financial hub. It also aims to foster a sustainable and innovative financial environment.

Impact: The policy recommends that financial institutions should adopt risk-based AI governance strategies for procurement, use, and management, ensuring robust cybersecurity and data privacy protections.

Singapore: AI Security Guidelines and Companion Guide

On October 15, 2024, the Cyber Security Agency of Singapore (CSA) launched guidelines to secure AI systems. The guidelines address cybersecurity risks including adversarial attacks and supply chain threats. They also emphasize securing AI by design and default. They cover the AI lifecycle: planning, development, deployment, operations, and end-of-life.

The Companion Guide is a community-driven resource offering practical measures and controls for AI security. It curates practical measures, security controls, and best practices from both industry and academia. It addresses risks such as supply chain attacks and adversarial machine learning.

Impact: The CSA encourages business leaders, owners, and AI practitioners to adopt the Guidelines to help enhance the security of systems. Identifying and mitigating risks such as adversarial attacks and supply chain vulnerabilities is also recommended. The guidelines aim to build user confidence in AI functioning as intended, fostering innovative, safe, and effective outcomes.

China: AI safety governance framework

On September 9, 2024, the National Information Security Standardization Technical Committee announced that it had developed the first version of the 'Artificial Intelligence Security Governance Framework' and released it to the public. The Framework aims to uphold a people-centered approach and adhere to the principle of developing AI for good. The Framework highlights key principles, which include development, innovation, an inclusive approach to AI research and application, the identification of AI safety risks from the technology and its application, and the implementation of tailored preventive measures.

Impact: Like other international regulations, the Framework takes a risk-based approach to AI governance and ties the risk level to specific mitigations. It also stresses the need for ongoing assessments of AI systems to ensure they meet safety standards and do not pose unintended risks. The Framework is part of China’s stated goal to be a global leader in AI by 2030, and purports to reflect a balancing act between the desire for innovation with the need for regulating the development and use of AI that is safe and ethical.

Hong Kong: Consumer protection in respect of use of GenAI

On August 19, 2024, the Hong Kong Monetary Authority (HKMA) issued guiding principles for the use of GenAI in customer-facing applications by authorized institutions. These principles focus on governance and accountability, fairness, transparency and disclosure, and data privacy and protection.

Impact: The HKMA emphasizes the need for responsible use of GenAI, ensuring customer protection, and maintaining trust through clear policies, human oversight, and adherence to ethical standards.

Europe

EU: AI Act Updates

The EU AI Act (Act) aims to ensure AI systems are safe and respect fundamental rights, whilst also stimulating investment and innovation. The Act applies to producers, distributors, deployers and users of AI systems within the EU. Market surveillance authorities in each Member State will enforce the EU AI Act. Key developments that have happened in the last quarter include:

1. On October 24, 2024, the European Commission's Joint Research Centre published a Science for Policy Brief on harmonized standards for the Act. The Brief details quality attributes for AI standards such as risk prioritization, lifecycle coverage, clarity, cross-sector applicability, state-of-the-art alignment, and cohesion.
   
   It specified deliverables covering risk management, record-keeping, human oversight, robustness, quality management, data governance, transparency, accuracy, cybersecurity, and conformity assessment. The Joint Technical Committee has outlined 37 standardization activities to support the Act, with a fast-tracked drafting process to meet compliance requirements for high-risk AI systems by August 2026.
2. On September 2, 2024, the European Parliament published a briefing paper on the Act. The paper outlines key provisions like scope, risk-based approach, sandboxing, enforcement, and timelines for entry into force.

EU: AI liability directive

On September 19, 2024, the European Parliamentary Research Service proposed a directive to adapt AI civil liability rules. It addresses shortcomings in the Artificial Intelligence Liability Directive (AILD) and the Product Liability Directive (PLD).

Impact: The proposal calls for new categories to trigger evidence disclosure and establish rebuttable presumptions of fault and causality in AI incidents. It introduces ‘high-impact AI systems’ to include high-risk AI and other systems under the EU Artificial Intelligence Act. It also suggests a presumption of causality for damages from non-compliance with AI monitoring obligations. Additionally, it recommends expanding the AILD to cover general-purpose AI systems and areas of liability like discrimination not included in the PLD.

EU: New guidance on AI and equality available to public sector bodies

On September 12, 2024, the Equality and Human Rights Commission released new guidance to help the public sector integrate equality considerations into their policies, especially when using AI technologies.

Impact: This guidance aims to prevent unlawful discrimination and promote equality. It emphasizes the importance of assessing both positive and negative impacts of AI on people with protected characteristics, ensuring compliance with the Public Sector Equality Duty and data protection laws.

EU: AI factories

On September 11, 2024, the European Commission launched a call for setting up AI factories which will help AI developers train their large generative AI models by using European high-performance computing supercomputers and providing access to data, computing and storage devices.

Impact: The AI factories, which are a part of the AI innovation package announced in January 2024, will connect the AI initiatives of Member States and advance the development of AI industrial and scientific applications in key European sectors including healthcare, automotive and transport, Agri-tech, energy etc.

Middle East

Qatar Central Bank releases AI Guideline

On September 4, 2024, the Qatar Central Bank (QCB) published its AI Guideline. The Guideline mandates licensed entities to create a defined AI strategy, ensure Board accountability, and manage AI risks. Entities must maintain an updated AI systems register and obtain QCB approval for certain AI activities.

Impact: The Guideline emphasizes human oversight, especially for high-risk AI systems, and outlines requirements for outsourcing and customer interactions, including the right to review decisions and submit complaints.

UK

UK: AI usage report in investment management

On October 10, 2024, the Investment Association published a report produced by the technology working group to HM Treasury's asset management taskforce that considers the current and future usage of AI in investment management. The report considers how AI is currently being deployed and developed in the industry and analyzes the factors that are enabling innovation as well as those that could potentially hinder the realization of AI's potential, together with recommended measures for policymakers and industry.

Impact: Key recommendations include establishing regulatory clarity and consistency to enable developers and users of AI to plan and invest with confidence. This would include closer coordination between regulators and the further development of AI standards. The report also recommends building a UK fintech ecosystem, joint public and private sector action on AI-enabled fraud. And managing systemic risk through collective understanding and identifying best practices in risk management.

Bank of England establishes AI Consortium

On September 25, 2024, the Bank of England published a new webpage announcing the establishment of the Artificial Intelligence Consortium. The Consortium will provide a platform for public-private engagement to gather input from stakeholders on the capabilities, development, deployment and use of AI in UK financial services.

Impact: The BoE has launched a call for interest for membership of the Consortium, which closed on November 8, 2024. The BoE plans to review all applications and select around 30 members, based on the selection criteria which relate to knowledge and experience, understanding of policy perspective, and time commitment.

Public sector AI Private Members' Bill introduced in House of Lords

On September 9, 2024, Liberal Democrat peer Lord Clement-Jones introduced a Private Members' Bill (PMBs) to the House of Lords to regulate public sector use of automated and algorithmic systems in decision-making processes.

Impact: Generally speaking PMBs in the House of Lords do not become law.  However, they are worthwhile paying attention to as even if not enacted, the Bill may help galvanize and set political debate. It is notable that the Bill focuses specifically on the public sector procurement and use of AI.  This particular PMB is not a government-backed but does broadly aligns with the new Labour government's more active approach to regulating AI, as outlined in the King's Speech. That said, it seems likely at this stage that the government will remain focused on legislation regulating the most advanced foundation models, like the large language models that power the latest AI chatbots. In any event, the government will likely take some time to consult in this area prior to introducing any formal legislation, given the inherent complexities and financial/social significance.

US

US: First ever National Security Memorandum on AI

On October 24, 2024, the White House released the ‘first-ever’ National Security Memorandum (NSM) on AI. The NSM directs the Pentagon and other US national security agencies to increase their adoption of AI technologies in a safe and responsible, but expedited, manner. The scope of the NSM is not limited to the implementation of AI in the national security context. It also considers an expansive AI supply chain—including not just semiconductors and computing equipment, but also energy and power generation—and the effects of AI for commercial use as being vital to US national security.

Impact: While the NSM is not enforceable outside of the executive branch of the government, the requirements are yet another indicator of how the current White House is thinking about and approaching AI. As many of these government arms are expected to be involved in future regulation of AI at a federal level, the NSM is an important resource in understanding how regulators may approach regulating the use of AI by private-sector organizations.

US: AI acquisition policy for federal agencies

On October 3, 2024, the Office of Management and Budget released new requirements and guidance to ensure responsible AI acquisition by federal agencies. This new policy builds on previous guidelines for managing AI risks and performance. It emphasizes early involvement of privacy officials, promotes a competitive marketplace, and implements governance structures.

Impact: The policy requires early involvement of privacy officials in government AI acquisition to manage risks and ensure compliance. Agencies must work with vendors to identify AI acquisitions and manage associated risks. They are also instructed to negotiate contracts that ensure vendors provide necessary information for risk management and impact assessments.

US: NIST launches GenAI profile and cybersecurity program

On July 26, 2024, the National Institute of Standards and Technology (NIST) released NIST AI 600-1, a Generative Artificial Intelligence profile that is a companion resource to last year’s release of the NIST AI Risk Management Framework.  The profile provides insights into how risk can be managed across various stages of the AI lifecycle and for GenAI as a technology.

On September 19, 2024, NIST launched a program to address cybersecurity and privacy risks in AI. The program aims to develop standards, guidelines, tools, and practices for managing these risks and will leverage NIST's existing research and publications. The program will also collaborate with the National Cybersecurity Center of Excellence to adapt current frameworks to AI's unique challenges.

Impact: The profile and the program will enhance NIST's AI Risk Management Framework by focusing on risks specific to GenAI and the overall impact of AI systems on cybersecurity and privacy.  The GenAI profile includes suggested actions to mitigate the specific risks associated with GenAI systems.  The AI cybersecurity and privacy policy addresses risks such as re-identification, data leakage, and increased surveillance, as well as AI's potential to improve threat detection and privacy management.

This has been co-authored by Clare Johnston and Jon Botham (Knowledge)

Further reading

Navigating the GenAI Revolution | Legal Telescope - AI & ESG

Regulation of Artificial Intelligence in the Pharmaceutical Sector

AI deepfakes and deception