Mid-year update: Developments in the global regulatory approach to AI

Rapid developments in AI coincide with significant policy attention and action, which according to the OECD are evidenced by more than 1000 AI initiatives in over 70 countries and jurisdictions. Advances in recursive models that can automatically discover new or optimised AI algorithms without human intervention could also significantly and rapidly advance AI model capabilities over the coming years. 

Meanwhile regulators are still grappling with the challenge of how best to regulate this pervasive technology and taking different approaches whether through hard law, soft law, horizontal and vertical/sectoral approaches. At the mid-year point we take stock of developments across key regions in the first half of 2024.

EU 

The flagship EU AI Act has now been adopted with implementation being phased in over the next three years. Given the tiered, risk based approach, the most burdensome obligations will apply in the relatively narrow range of “high risk” use cases  which include credit scoring and employee monitoring. 

While in practice many AI systems will only be subject to light obligations, note that the territorial scope of this legislation is exceptionally broad. In scope businesses need to be taking steps now to prepare for compliance.

AI systems continue to be heavily regulated under other EU frameworks, particularly the GDPR and consumer protection law. These regimes are due to be supplemented by the proposed AI Liability Directive and new Product Liability Directive, although progress on the former has stalled, calling into question the suitability of this legislative project. 

Meanwhile the EU’s data protection regulators are gearing up to regulate AI under existing frameworks, have issued preliminary assessments (notably a preliminary report from the EDPB on the work of the ChatGPT Taskforce) and have already launched investigations into AI companies in multiple jurisdictions (for example re ChatGPT in Italy). 

EU regulatory eyes are also focusing on potential anti-competitive effects of GenAI where competition between tech companies is fierce as rivals seek to influence industry direction by investments in AI companies.

UK 

In the UK, while the key digital regulators who cooperate through the Digital Regulatory Cooperation Forum (DRCF) have signalled that existing regulatory frameworks are sufficient to manage AI risks – for now, the CMA has specific concerns and will be looking to flex new digital powers coming its way to protect consumers and markets from potential anti-competitive effects. 

FCA recently confirmed that there are no plans for detailed rules on AI, pointing to existing financial services frameworks, and the oversight to be provided by new powers in financial services to regulate critical third parties - such as cloud computing providers. 

To tackle the lack of targeted domestic protection for individuals subject to unfair or biased algorithmic decision-making in employment, the Trades Union Congress has published a draft AI (Regulation and Employments Rights) bill.

However, a change in government following the upcoming general election could result in a pivot on the approach to AI regulation in the UK. Labour has taken a more vocal stance than the incumbent Conservatives and in its manifesto has committed to introducing “binding regulation” - specifically regulating the biggest AI firms developing “powerful AI” to ensure safe development. More details are expected when Labour launches its AI strategy in the next couple of weeks as part of a broader plan for the tech industry. 

Asia

After moving quickly to enact mandatory rules on the development and deployment of generative AI last August, the PRC has since formulated more granular technical standards on training data and model security, protection of data (including that of children), and the requirements for completing the government's security assessment process.

The PRC courts have released case judgments which clarifies IP positions in AI deployment, including the Beijing Internet Court’s ruling on the first AI output copyright infringement case in November 2023 and the personality rights infringement case relating to AI-generated voice in April 2024. 

Meanwhile ASEAN has put out guidance on AI governance and ethics. Hong Kong's data protection regulator has issued a Model AI Framework for businesses procuring predictive and generative AI services from third parties, updating its ethical AI guidelines from 2021 targeting businesses developing their AI models in-house.

And in Singapore, the communications and media regulator has issued some helpful practical guidance for the development and deployment of GenAI, and also made some policy recommendations. The guidance builds on the existing voluntary soft law regime and in a sign of things to come, states that legal frameworks in Singapore may need to be updated to deal with AI risks. 

US

In the US, building on the momentum of the Biden AI Executive Order and NIST AI Risk Management framework, and the AI Bill of Rights, federal and state regulation is starting to emerge. This includes the Utah Artificial Intelligence Policy Act, the New York AI Bias Law and, most recently, the Colorado Artificial Intelligence Act. With a classification system akin to the EU’s AI Act, Colorado’s AI Act seeks to protect against algorithmic discrimination and is expected to significantly impact several sectors.

As in the EU and UK, regulators are concerned about anticompetitive effects of AI on markets, and have opened antitrust enquiries with a number of large tech players.

Looking ahead

The pace of change in AI development and its accelerating adoption continues to challenge regulators with new risks constantly emerging. As more AI specific law comes online, we will continue to monitor and report on global developments and the evolving regulatory landscape.

Read more on the global approach to regulating AI:  AI in Financial Services 3.0 (linklaters.com)