Global AI regulatory update - September 2024

In this edition of our global AI bulletin, we will be looking at:

• Cross-Border – UK, EU and US Competition Authorities joint statement on AI regulation
• Asia – China: AI Guidelines, Hong Kong: AI Framework, Singapore: AI Framework,
• Europe – an update on the EU AI Act, plus GenAI guidelines for the public sector and guidance for firms using AI in investment services
• Middle East – UAE: AI Charter
• UK – AI Bill and AI Opportunities Action Plan
• US – Deepfake Bill and a request for information on the use of AI in the financial sector

Cross-Border

UK, EU & US: Joint statement on competition in AI foundation models

On July 23, 2024, the competition authorities of the EU, UK, and US published a joint statement on the regulation of Gen AI. The statement identifies key concerns, such as the concentration of critical AI inputs and the risks associated with industry partnerships.

Impact: Aiming to foster innovation and protect consumers, the regulators have focused on fair dealing, compatibility of systems, and preserving choice in AI markets.

Asia

China: Cyberspace Administration issues AI guidelines

On July 3, 2024, the Cyberspace Administration of China released its Guidelines for the Construction of a National AI Industry (Guidelines). Its goals include creating over 50 new national and industry standards by 2026, and at least 20 global standards to boost AI industry development. Among other things, the Guidelines cover key technical standards for AI-related technologies such as machine learning, biometric recognition, and large models.

Impact: Upcoming years will see new standards shaping AI development. To advance AI, the Guidelines propose improving organizational structures, establishing technical organizations, building a talent pool, and promoting standards. They emphasize that organizations should be guided to follow standards and make sure that AI is developed in a sustainable way.

Hong Kong: New AI-related data protection framework

On June 11, 2024, the Office of the Privacy Commissioner for Personal Data (PCPD) announced the publication of the Artificial Intelligence: Model Personal Data Protection Framework (Framework). The Framework is based on general business processes and sets out recommendations and best practices related to procuring and implementing AI in line with Hong Kong data protection law.

Impact: The Framework is aimed at all companies that buy, implement and use AI systems involving personal data. It is not currently binding but reveals what the data privacy regulator will look out for in situations where there has been a data breach.

Read more here.

Singapore: New AI governance framework

On May 30, 2024, the Government announced the publication of the Model AI Governance Framework for Generative AI (Framework). The Framework sets out recommendations guiding companies as they develop or deploy Gen AI and are based on key themes such as safety, transparency, and security.

Impact: Amongst other things, the Framework recommends that companies should:

• use technologies to enhance privacy such as anonymisation techniques
• adopt best practices in AI development, using “food label”-type transparency and disclosure to enhance broader awareness and safety over time
• set up structures and processes to enable incident monitoring and reporting

Europe

EU: AI Act Updates

The EU AI Act (Act) came into force on August 1, 2024. In this past quarter, activities in relation to the Act have included discussions on the role of the European Data Protection Board and the AI code of practice. The European Securities and Markets Authority (ESMA) has also recently released its first formal guidance on the use of artificial intelligence (AI) in the provision of retail investment services.

1. European AI Office codes of practice

Part of the Act requires that the AI Office facilitate the drawing-up of codes of practice to help make sure providers of AI tools and systems comply with the Act. In line with this, on July 30, 2024, the AI Office opened a call for expression of interest to participate in the drawing-up of the first General-Purpose AI Code of Practice, which closed on August 25, 2024. In parallel with this, the AI Office further launched a multi-stakeholder consultation on trustworthy general-purpose AI models under the Act, which closes on September 18, 2024. The Code of Practice will set out detailed rules for general-purpose AI model providers. Providers can use this Code to show they are following the rules set out in the Act.

Read more here.

2. Data Protection Authorities role

On July 16, 2024, the European Data Protection Board adopted a statement on the Data Protection Authorities’ role in the framework of the Act. It is noted that, according to the Act, Members States shall appoint Market Surveillance Authorities at a national level before August 2, 2025, to supervise the application and implementation of the Act.

3. Consultation to provide guidance to financial sector on the Act

On June 18, 2024, the European Commission launched a consultation to look at use cases, benefits, barriers, risks and stakeholder needs in the financial sector. The input received will be used to provide guidance to the sector for the implementation of the Act. The consultation closes on September 13, 2024.

Read more here.

EU: EDPS guidelines on Gen AI for EU institutions and bodies

On June 3, 2024, the European Data Protection Supervisor (EDPS) published new orientations for EU institutions on the processing of personal data when using generative AI systems. The orientations are intended to aid EU institutions, bodies, offices and agencies in their compliance with relevant requirements when processing personal data using generative AI systems and formulating new policies.

Impact: Key points from the orientations include that web scraping for data collection may violate data protection principles (even if the data is publicly available). The orientations further highlight that data protection officers need to ensure all necessary documentation is in place and review compliance before data sharing. It is also underpinned by the orientations that data minimization can be achieved by limiting data collection and processing, and accuracy can be ensured by verifying the structure and content of the datasets used for training models.

ESMA guidance for firms using AI in investment services

On May 30, 2024, ESMA published a statement providing initial guidance for investment firms using AI in the provision of investment services to retail clients. ESMA and the national competent authorities plan to continue monitoring the use of AI in investment services and the relevant EU legal framework to determine whether further action is needed in this area.

Impact: ESMA states that, when using AI, it expects firms to comply with relevant MiFID II requirements, particularly in relation to organizational aspects, conduct of business, and their regulatory obligation to act in the best interest of the client. Potential uses of AI that would be covered by MiFID II requirements include customer support, fraud detection, risk management, compliance, and support to firms in the provision of investment advice and portfolio management. 

Middle East

UAE: AI Charter

On July 30, 2024, the UAE's Artificial Intelligence, Digital Economy and Remote Work Applications Office launched the Charter for the Development and Use of Artificial Intelligence.

Impact: The Charter focuses on creating a safe environment for AI applications. It sets out principles for safe and fair AI development, aiming to strengthen human-machine relationships, enhancing AI awareness, and complying with relevant laws.

UK

UK: AI Opportunities Action Plan

On July 26, 2024, the Government published its AI Opportunities Action Plan, which outlines their plan to develop a roadmap towards an AI Bill (also see below) that will capture the opportunities of AI and harness its potential for economic growth.

Impact: The Action Plan will consider how the UK can be globally competitive in the AI market and how it can be used to boost economic growth. It will also consider how to improve public services with AI and aims to enhance the foundations for AI adoption through such things as improvements in data, infrastructure and regulatory frameworks.

UK: King’s speech references AI legislation

On July 17, 2024, King Charles III announced the Government’s plan to introduce AI-specific legislation. Whilst not expressly mentioned in the King’s speech, the new Labour Government is expected to introduce an AI bill which follows Labour’s recent manifesto pledge to introduce new legislation to govern development of AI technologies.

Impact: No details has yet been provided on the status of the AI bill but the Labour manifesto did reference introducing binding regulations in relation to AI. The timing of the bill is yet uncertain.

US

US: Deepfake Bill introduced to Senate

On July 11, 2024, a Bill for the Content Origin Protection and Integrity from Edited and Deepfaked Media Act (COPIED) was introduced to the Senate. If it becomes law, COPIED will deliver guidelines for voluntary standards on the detection of synthetic content as well as recommending the provision of watermarking and content provenance information.

Impact: COPIED will also require developers and deployers of AI systems and apps used to generate synthetic content to give users the option to attach content provenance information within two years. COPIED will also prohibit removing, altering, tampering with, or disabling content provenance information, with security exceptions. It will also prohibit the use of 'covered content' with content provenance to either train an AI/algorithm-based system or create synthetic content without express informed consent and adherence to the terms of use of such content, including compensation.

US: Uses of AI in financial services sector

On June 6, 2024, the Department of the Treasury (DT) submitted a request for information (RFI) on the uses, opportunities and risks of AI in the financial services sector. The DT also wants to examine potential barriers that could hinder the responsible use of AI within financial institutions.

Impact: The RFI queries the extent of AI's impact on various stakeholders, including consumers, investors, financial institutions, businesses, regulators, and end-users. The DT is likely to use all of this information to improve legislative, regulatory, and supervisory frameworks related to AI in financial services.

Co-authored by Clare Johnston and Kirath Bharya, supported by Jon Botham (Knowledge)

Further reading

Deepfakes and deception: the global rise of AI and the risks it poses

How AI is redefining Employment in the Middle East

How AI Treaty Will Further Global Governance Cooperation

AI Washing: impact on UK businesses and consumers

Singapore – New AI guide on synthetic data generation proposed

German Federal Supreme Court confirms that AI system cannot be named as inventor

The Future of Financial Services: Decoding AI

Hong Kong issues Artificial Intelligence – Model Personal Data Protection Framework