On AI regulation, the EU and the U.K. set wildly divergent courses

It’s been another busy week for AI regulation. And we can see some pretty stark divisions emerging in the way different countries and regions are approaching the technology.

The European Union reached a deal late on Friday on the final text of its landmark AI Act. For more on the elaborate final negotiations between the EU’s member states, the European Commission, and the European Parliament, I recommend this Politico story.

The final law is extraordinarily complex. If you want to get a sense of just how complicated it will be for companies to comply, check out this “one page” flow chart that Tom Whittaker and his colleagues at the law firm Burges Salmon put together to help clients navigate the act’s many requirements. (I guess it’s a one-pager if you’re using a papyrus scroll or something.)

Needless to say, this will not be easy for businesses to navigate. And remember the EU AI Act doesn’t just apply to companies headquartered in the EU, but to international firms that have European customers and employees, too.

It is hard to look at Burges Salmon’s flow chart and disagree with critics who say the EU’s approach is too heavy-handed. There’s already a yawning gap between companies’ stated AI ambitions and what they are putting into practice. Companies are being held back by fears about cost, ethics, hallucinations, security risks, and more. And this law will further lengthen the time it will take to bridge that gap. It may also mean that some companies decide, as OpenAI has at times threatened, to simply not sell AI technology in Europe.

Companies “should start to think about compliance now,” Whittaker says, especially as AI systems may soon be fundamental to a company’s business model or, at least, the delivery of specific products and services. Adapting to the new law may be difficult and take time. And failing to comply, he cautions, could mean big fines and the possibility regulators will force your business to stop using or selling the AI in question.

That said, the EU’s approach does have some components that the U.S. and other countries could borrow. Calibrating regulatory requirements to different risk categories is a particularly worthwhile framework. The final text helpfully also makes it more clear which AI uses are unlikely to be high-risk, which should give businesses some peace of mind.

On the controversial issue of how to regulate general-purpose AI models, such as OpenAI’s GPT-4 and Alphabet’s Gemini models, the final text divides these models into two buckets. There are run-of-the-mill general-purpose models, which it defines as pretty much every LLM and chatbot currently on the market. These are mostly subject to transparency requirements: Tech companies have to tell the EU’s new AI Office, which was created as part of the final negotiation last week, how their models work. They also have to make public a summary of their training data and show that they have policies in place to respect copyright laws. That last bit may be hard for many AI companies to comply with. Most models to date have been built using copyrighted data taken without consent from across the internet. In a sop to France, free and open-source general-purpose models, such as those offered by Parisian AI darling Mistral, are subject to lighter risk assessments. (But only up to a point. More on that in a minute.)

Then the act creates a whole separate category for general-purpose models that pose a “systemic risk.” This would seem to apply only to models more powerful than those that currently exist. These will have to comply with a set of testing and safety procedures that the AI Office will develop. The software companies creating them will have to show the AI Office that they’ve thought hard about wider risks, from bioterrorism to the sort of killer AI scenarios that are a staple of science fiction, and developed ways to mitigate those threats. They also will have tighter cybersecurity obligations to protect these models.

The big question then is what happens to open-source? The trend has been that the open-source companies have been able to come close to replicating the performance of the most capable proprietary models, but with about a six-month lag. They have also been doing so with models that are smaller, making them easier and cheaper to use. At some point soon, the best proprietary models will cross into this systemic risk category. And with the AI Act written as it is, it isn’t clear that open-source companies will be allowed to follow them. There’s no real way for an open-source model to comply with some of what the EU seems to be envisioning—the whole point of open-source software is that users can do whatever they want with it (and while companies have licensing terms to try to prevent misuses, a lawsuit for license violations is not about to stop a bioterrorist or The Terminator).

Another thing that’s intriguing about the final text of the AI Act is some of the powers it gives to the AI Office. The new department will be able to rule on whether partnerships between AI startups and Big Tech giants, such as OpenAI’s relationship with Microsoft, and whether vertical integrations, such as Alphabet’s ownership of DeepMind, impede competition. So it is taking on a competition enforcement role usually left to the EU’s antitrust regulator or national competition authorities.

Meanwhile, across the English Channel from the EU, the U.K. government published its policy approach to AI today. It is strikingly different than the EU’s. The British government has ruled out updating any of the country’s laws to address novel issues raised by AI. It is instead planning to let existing regulators figure out how to apply existing laws to the new technology. In many cases, this will give businesses the freedom to implement AI faster. But in others, such as the government’s decision earlier this week to rule out changing U.K. copyright law to create an exception for AI, it may slow tech companies down.

In talking about its approach, the U.K. is championing “ease of compliance” as a major selling point. “Regulation must work for innovators,” the government says, and it has even created a service where tech companies and startups can ask regulators for advice on compliance before they launch a product. The government says it realizes new, binding rules for AI development may be needed at some point—but, it insists, that time is not now. (Never mind that the U.K. and the U.S. took a similar approach with the internet and social media, and look where that got us.)

Unlike the EU, which despite an AI Act text that runs to nearly 900 pages, left most of the specific standards and procedures companies will need to implement to be defined at a later date, the U.K. has already published some voluntary technical standards and assurance techniques. It also announced it is creating a new cross-government body on AI so that sector and industry-specific regulators can share expertise. And it’s spending £10 million to help regulators boost their AI knowledge and capabilities as well as £9 million for a new partnership with the U.S. on responsible AI. But given that many top AI researchers are now commanding multimillion-dollar pay packages at the likes of OpenAI and Google, that £10 million may not buy much expertise.

Ironically, the only area where the British government has broken with this mostly laissez-faire approach is when it comes to the AI risk that remains most theoretical: the idea, as Sam Altman says, that AI could mean “lights out for all of us.” Here, the U.K. has led the world, spending £100 million on an AI Safety Institute that is going to come up with guardrails and safety tests for the most advanced general-purpose models. That Institute has managed to hire some impressive experts from academia and leading AI companies, including Google DeepMind.

Another irony: It is usually the U.K. that stakes out a position midway between the American and European approaches. But this time, it may be the U.S. that finds the middle ground, emulating aspects of both London’s and Brussels’s AI policy ideas.

For more on how AI policy is shaping up, I encourage you all to read my colleague Vivienne Walt’s look at the global battle lines over AI regulation in the latest edition of Fortune magazine. You can check it out here.

With that here’s the rest of this week’s AI news.

Jeremy Kahn
jeremy.kahn@fortune.com
@jeremyakahn

Correction, Feb. 6: An earlier version of this story misspelled the name of law firm Burges Salmon.

AI IN THE NEWS

Con artists used live deepfakes to help steal $25 million. That’s according to Hong Kong police who said that fraudsters targeted a finance employee based in the city for a multinational firm and then used live deepfakes to impersonate the company’s chief financial officer and other executives on a video call. Using the deepfake-generated disguises, the con artists convinced the employee to wire company funds to them, CNN reported. In a “multi-person video conference, it turns out that everyone [he saw] was fake,” senior superintendent Baron Chan Shun-ching told the city’s public broadcaster RTHK, according to the story. As Fortune has previously reported, live “face-swapping” technology, sometimes combined with audio deepfakes, will increasingly play a role in such frauds, as well as in espionage and political disinformation campaigns.

Microsoft teams up with publication Semafor on AI-driven news feed. The tech giant is collaborating with the two-year-old news organization to create a chatbot that can deliver a breaking news feed to users called Signals, the Financial Times reports. The news in Signals will be written by human journalists, according to Semafor cofounder Ben Smith, but some of the research they use will be AI-generated. Microsoft has been trying to show its support for journalism while facing a New York Times copyright infringement lawsuit that accuses it and its close partner OpenAI of jeopardizing the industry’s future by stealing copyrighted news stories to build AI software that then dissuades users from visiting news sites.

Data labeling company Appen has fallen on hard times. The Australian company became a tech sensation by helping companies gather, prepare, and label data for machine learning and AI applications. But the company has recently lost customers, in part because generative AI is allowing tech companies to increasingly use AI itself to label data or generative synthetic data. Google, a key anchor customer, decided not to renew its contract with Appen, possibly because the Washington Post had reported on accusations of unfair labor practices that had affected Appen workers who were being used to help train Google’s Bard chatbot. Its CEO Armughan Ahmed announced his resignation today. And the company’s stock, which once traded for 35 Australian dollars, is now trading for pennies. You can read more in The Register.  

EYE ON AI RESEARCH

Interacting with a chatbot helped more people access mental health services. That’s the finding of a study from the U.K. that looked at data from almost 130,000 people who visited websites that help provide access to 28 different counseling and talk therapy services for England’s National Health Service. Half of those websites had a chatbot, not to provide the therapy, just to assist people in answering questions that would determine whether they were eligible for the therapies and help triage them. The other half did not have the chatbot and simply asked people to fill in online forms to gather this information. The referrals from the website using the chatbot, which was created by a tech company called Limbic, increased by 9% more than the website that didn’t use it. But what was even more striking was that the chatbot assistance particularly helped members of minority groups access the services. Referrals from people who identified as sexually nonbinary were 179% higher for the chatbot service, while referrals from those who identified as Asian were 39% higher and Black 40% higher. The study was published in the journal Nature Medicine but you can read more about it in this MIT Tech Review story.

FORTUNE ON AI

Huawei shrugs off U.S. sanctions to take top place in China’s smartphone market—but its new AI chips might be an even bigger achievement – by Nicholas Gordon

Mark Zuckerberg explained how Meta will crush Google and Microsoft at AI—and Meta warned it could cost more than $30 billion a year – by Alexandra Sternlicht

Sam Altman says ChatGPT ‘should now be much less lazy!’ Users complained it was refusing and ignoring too many prompts – by Sunny Nagpaul

Disinformation isn’t just an AI matter, as Meta’s Oversight Board just reminded everyone – by David Meyer 

Care.com’s founder has a new AI startup that aims to make the ‘chief household officer’s’ life easier by jockeying emails, calendars, and appointments – by Rachyl Jones 

Forget the Turing Test. AI needs to pass the Summer Camp Test before it can take over the world – by Kathy Pham (Commentary) 

AI CALENDAR

Feb. 21: Nvidia reports earnings 

March 18 - 21: Nvidia GTC AI conference in San Jose, Calif.

April 15-16: Fortune Brainstorm AI London (Register here.)

May 7-11: International Conference on Learning Representations (ICLR) in Vienna, Austria

June 25 - 27: 2024 IEEE Conference on Artificial Intelligence in Singapore

BRAIN FOOD

How AI is revealing hidden secrets of the Roman world. There’s a fantastic cover story in Bloomberg Businessweek about how Nat Friedman, the CEO of GitHub, became fascinated with the Herculaneum papyri, ancient papyrus scrolls that have been found on the site of a large Roman villa in that ancient city which was buried in volcanic ash following the eruption of Mount Vesuvius in 79 A.D.

The scrolls were badly charred by the hot ash and gases, crumbling to dust during any attempt to unroll them. Even when people have succeeded in unrolling parts of them, they cannot be read with the naked eye because the ink and paper are too blackened. But classicists very much want to read them. Believed to come from the library of Julius Caesar’s father-in-law, Piso, scholars think they could contain lost works of ancient literature, drama, poetry, and philosophy, as well as possibly containing texts that would shed light on the early Christian Church.

Friedman became fascinated by the prospect of using technology similar to that used for medical CT scans to create three-dimensional images of the scrolls without attempting to unroll them, and then using AI to try to distinguish between the charred paper and ink in those scans, and finally to decipher the letters themselves, enabling scholars to read the ancient texts. No one was sure the idea would work. But Friedman set up a contest, The Vesuvius Challenge, with $1 million in prizes to whoever could train an AI model that could read just four short passages from a single scroll. An army of machine learning enthusiasts have risen to the challenge and so far they’ve unlocked far more than just those four passages, deciphering entire paragraphs from the scroll.

It's a great tale and also an indication of how AI tools are transforming the practice of science, archaeology, classics, and pretty much everything else. But what really stands out in the story, which was cowritten by the great Ashlee Vance and Ellen Huet (full disclosure: both Vance and Huet are former colleagues of mine), is not the technology but the people. AI does not operate in a vacuum. If it weren’t for Friedman’s quirky obsession and the ingenuity of the machine learning sleuths like Luke Farritor, the 22-year-old undergrad who ultimately won the Vesuvius Challenge’s grand prize, we wouldn’t be any closer to unlocking these secrets of the Roman world.