Global AI regulatory update - June 2024

In this edition of our global AI bulletin, we will be looking at:

• Global – Guidance on deploying AI systems and UN’s first resolution on AI
• Asia – Singapore: guidelines on use of personal data in AI
• Europe – EU: updates on the AI Act and Platform Workers Directive and the Global AI Treaty
• Middle East – Universal blueprint for AI
• UK – AI Bill, ICO consultation on the accuracy of Gen AI models and guidance on AI in recruitment processes
• US – 3 new bills introduced, including one to develop AI standards, one on copyright notices and one on transparency in elections

Global

Joint guidance on deploying AI Systems Securely

Multiply agencies from the US, Australia, New Zealand and UK confirmed they had published their joint guidance on deploying AI systems. This best practice guidance applies to organizations that deploy and operate externally developed AI systems themselves but not those leveraging AI systems deployed by others.

Impact: Key messages from the guidance is that AI systems require an ongoing process of identifying risks, implementing appropriate mitigations, and monitoring for issues. By taking steps to secure the deployment and operation of AI systems, should significantly reduce the risks involved. This should protect your intellectual property, models and data from theft or misuse.

UN Approves its first Global Resolution on AI

The United Nations (UN) General Assembly unanimously approved the first UN resolution on AI. This resolution gives global support to an international effort that aims to ensure that AI benefits all nations, respects human rights and is safe, secure and trustworthy. The non-binding resolution, advocates for the strengthening of privacy policies and the support of regulatory and governance approaches related to safe use of AI. This is the first time the General Assembly has adopted a resolution on regulating AI.

Impact: The UN's aim is to encourage the tech industry and governments to take further responsibility when managing AI, with a long-term goal of promoting ethical development of AI and accountability towards its use. The resolution encourages global cooperation to ensure developing nations have access to AI technology, however, as the resolution is non-binding, its success will depend on the voluntary commitment of Member States.

Asia

Singapore: New Guidelines on use of personal data in AI systems

The Personal Data Protection Commission (PDPC) published Guidelines on use of personal data in AI systems. The Guidelines explain when it may be appropriate for organisations to rely on certain exceptions under the PDPA when using personal data to develop AI Systems. It also sets out recommended data handling and accountability measures when deploying AI Systems.

Impact: Whilst the Guidelines are not legally binding, the PDPC is likely to be consistent with them when carrying out enforcements. The Guidelines apply to any organisation that collects and/or uses personal data to develop and deploy AI Systems. Although it also provide recommendations to data intermediaries who provide professional services for the development and deployment of bespoke or fully customisable AI Systems.

Europe

EU: AI Act Update

The Council of the EU approved the EU AI Act (following the European Parliament voting in favour of the EU AI Act with a significant majority). It is expected to become law in the summer of 2024 and will be rolled out in stages. The law will then apply from 24 months following its entrance into force, although some elements will apply sooner. The AI Act applies to various entities, including businesses in the EU’s 27 Member States, and non-EU businesses in circumstances where they make an AI system or general-purpose AI model available on the EU market.

Impact: The EU AI Act will impact operators across the whole AI value chain by setting rules and requirements for AI systems and general-purpose AI models. It will have an extra-territorial reach, meaning that it will apply to in-scope AI systems or in certain cases to general-purpose AI models, that produce an effect in the EU, regardless of where the operator is located.

Read more here, here and here.

EU (and UK): Global AI treaty

The Council of Europe (CoE) adopted the first global treatyon AI. This treaty, which is open to countries outside Europe as well, aims to protect human rights, uphold the rule of law, and maintain democratic standards when using AI. The treaty’s main principles align with those under the EU AI Act, but while the EU AI Act has detailed rules on using AI systems in the EU, the treaty mainly focuses on protecting the human rights of people affected by AI. The treaty will apply to the 46 CoE members (including the 27 EU Member States and the UK). The treaty will be ready for signing on 5 September 2024.

Impact: The treaty mainly aims to control the actions of public authorities, including companies working for them. It also requires parties to manage risks from private companies using AI systems. The treaty does not cover activities related to national security in the lifecycle of AI systems, research and development activities and national defence matters.

EU: Platform Work Directive Update – AI implications

The European Parliament has adopted the Platform Workers Directive (PWD). This is the EU’s first legislation on the status of platform workers and on ensuring the transparency of the use of algorithmic and AI management in platform work. Whilst there are a few steps before the law enters into force, once it does, Member States will have a further 2 years to incorporate the provisions of the PWD into national law.

Impact: PWD aims to ensure that any person performing platform work cannot be dismissed or fired based on a decision taken by an algorithm, AI or an automated decision-making system. Instead, relevant platforms must ensure human oversight on important decisions that directly affect the persons performing platform work and guarantee certain rights for workers, including protection against adverse treatment and protection from dismissal.

Read more in our recent Flash Update.

Middle East

UAE: Universal Blueprint for AI

Dubai has launched the ‘Universal Blueprint for AI’, which aims to fast-track the adoption of AI applications. The first phase includes the appointment of a Chief Executive Officer for AI in each government. The Dubai Centre for Artificial Intelligence, which is part of the Dubai Future Foundation, will assess candidates for this role. It will also see the launch of an AI and WEB3 Incubator, which aims to establish the largest hub for AI and technology companies, with the objective of attracting innovators, start-ups, and AI frontrunners from across the globe.

Impact: As part of the first phase, a new Dubai Commercial Licence for Artificial Intelligence will be introduced aimed at enhancing AI investments and attracting specialised companies and talented individuals from all over the world to work in an enabling environment. Land for data centres will also be fast-tracked to provide a conducive environment and to continue to develop world-class digital infrastructure. The Blueprint also aims to transform Dubai into a global hub for AI governance and legislation.

UK

AI (Regulation) Bill proceeds to third reading

The Artificial Intelligence (Regulation) Bill (Bill) has passed through the House of Lords and has now been sent to the Commons. The Bill was originally introduced as a Private Members Bill back in November 2023 and its primary purpose is to establish a framework for the regulation of AI in the UK. The aim is to put AI regulatory principles on a statutory footing and establish a central AI Authority responsible for overseeing the regulatory approach to AI.

Impact: Most Private Members' Bill (PMBs) do not progress. However PMBs can serve a valuable legislative process by encouraging discussion on emerging important issues and some have successfully become law.

ICO launches consultation on accuracy of generative AI models

The Information Commissioner's Office (ICO) launched the third chapter of its consultation serieson Gen AI. In particular, this third consultation focuses on how the accuracy principle of data protection applies to the outputs of Gen AI models and the impact that accurate training data has on the output. The consultation, which outlines how the accuracy principle under the GDPR should be applied by developers and deployers of Gen AI models, closed on 10 May 2024.

Impact: The ICO warns that if the use of inaccurate training data leads to inaccurate outputs, and the outputs have consequences for individuals, then it is likely that the developer and the deployer have breached the accuracy principle. For example, consequences arising from the spread of misinformation could include damage and distress for anyone to whom the inaccurate data relates, as well as reputational damage for the organisation responsible for that output. That organisation could also be exposed to enforcement action from the ICO and liability for compensation payable to those individuals who have suffered damage.

Read more in our recent article here.

Government guidance on AI in recruitment processes

The Government published new guidance on procuring and deploying AI technology and systems responsibly in HR and recruitment. The guidance warns that these technologies can expose companies to novel ethical risks and recommends various mechanisms to evaluate the performance of AI systems, manage risks and ensure compliance with statutory and regulatory requirements. The guidance also states that employers should be transparent and explain to candidates where AI is being used and how. In particular, this will ensure candidates have all the information they need to request reasonable adjustments.

Impact: The guidance accepts that not all risks will be identifiable via testing and some unintended consequences, including discrimination bias, may only be first identified and raised by a user. We may start to see an increase in reported cases of unintended discriminatory bias emerge as more AI systems are rolled out.

Read more in our recent article.

US

US: Bill to develop AI standards and promote innovation

A bipartisan group of senators introduced the Future of Artificial Intelligence Innovation Act (Bill). The Bill incorporates key cybersecurity measures including the development of international standards, metrics, and AI testbeds. It also includes provisions for increased collaboration between the public-private sector and governments both domestically and abroad.

Impact: This legislation aligns with President Joe Biden’s October 2023 AI Executive Order, which stated the intention to pursue a multi-stakeholder approach to AI for society’s benefit. If implemented correctly, this Bill has the potential to improve the AI advancement ecosystem and support the development of standards that improve AI cybersecurity.

US: Bill for Generative AI Copyright Notice

The Generative AI Copyright Disclosure Act (Bill), was introduced to the House of Representatives. The Bill highlights requirements for persons who create or significantly alter a training dataset used in building Gen AI to summarise all copyrighted works used and the URL. This summary is to be submitted to the Copyright Office at least 30 days prior to the release of a new Gen AI system. The Bill will apply retroactively to previously created systems. Failure to follow these rules will result in a financial penalty of no less than $5,000.

Impact: Whilst the majority of bills that are introduced never make it all the way through the process to become law and, while it remains to be seen whether this particular bill will be enacted, it seems inevitable that the legislature will step in to provide guidance on what is and isn’t protected under copyright law.

US: Bill on AI Transparency in Elections

The AI Transparency in Elections Act of 2024 (Bill) was introduced to the Senate. In particular, the Bill requires that political advertisements that use an image, audio, or video that is substantially generated by AI to include a disclaimer that the content was generated by AI. The Bill would require the Federal Election Commission (FEC) to create criteria for determining when a ‘covered communication’ contains content that has been substantially generated by AI. The FEC would also be required to deal with violations promptly.

Impact: This is not the first attempt we have seen with similar laws being introduced. If enacted, this particular Bill would exempt media that has only undergone minor AI alterations, such as color editing, cropping, or resizing. This is on the basis that they would not significantly change the media's interpretation from what a person would understand as compared to the original version.

Co-authored by Clare Johnston, supported by Molly Scott (Knowledge)

Further reading

EU and UK: Technology Law Shorts

Singapore: New Generative AI Governance Framework

The future of Financial Services - Decoding AI: Episode 9

EU AI Act legal insights podcast - Episode 4

Regulating AI at work in the shadow of a UK election

Commercially Connected - April 2024

EU and UK: Technology Law Shorts

How the regulatory landscape in the UK and EU is shaping the medical devices industry

A changing landscape for AI patenting in the UK

Navigating the New Frontier: AI Patentability at the European Patent Office

AI Foundation Models – UK Competition and Markets Authority flags concerns