The EU AI Act passed. Now the real work begins

Yesterday marked a giant leap for AI regulation. The European Parliament passed the EU AI Act with 523 members voting in favor and 46 voting against. First proposed in 2021—what feels like a decade ago in the current world of AI—the already hotly debated act had to be reimagined to account for the commercial availability and rapid progress of “general-purpose AI systems” like ChatGPT that upended the landscape in late 2022. 

As I reported in December when representatives of EU countries agreed on the terms, the act lays out guardrails and stringent transparency requirements for general-purpose AI (GPAI) systems, particularly for applications it deems high risk. Examples of high-risk areas spelled out in the act include critical infrastructure, education, employment, health care, banking, migration and border management, justice and democratic processes, and “certain systems in law enforcement.” It also bans several applications entirely including untargeted scraping of facial images, emotion recognition in the workplace and schools, biometric categorization systems that use sensitive characteristics, and other AI systems that could be used to manipulate people or exploit their vulnerabilities. Additionally, the act imposes limitations on, but doesn’t ban, the use of biometric identification systems in law enforcement.

The AI Act is not technically at the finish line, as the legal language of the text still needs to go through a final vote in the Council of Ministers—which has already said it will approve if it passes parliament and is largely seen as a formality. But in many ways, the EU AI Act is approaching a new starting line. Now that it has been enacted, it has to be executed and actually be enforced, and that’s easier said than done.

“The EU Artificial Intelligence Act may be the most consequential legislation for the digital economy since the GDPR. Yet the temptation to move on to the next challenge after the formal adoption of the AI Act must be resisted. Laws are not self-executing. The AI Act will require ongoing engagement by civil society,” wrote the Center for AI & Digital Policy in a report, prepared for the European AI & Society Fund, examining the challenges ahead.

Specifically referencing the competition between the U.S., Europe, and China to control the digital economy, the report calls out how tech industry lobbying and corporate philanthropy are squeezing out vital voices advocating for the needs of people and society when it comes to AI. “It is essential that these groups are resourced effectively so that the victories gained in legislation thus far can be enacted in practice,” the report concludes. 

Others such as Gartner analyst Avivah Litan have also questioned how the EU plans to actually enforce these rules, telling TechTarget “the enforcement is going to be really difficult” and that high-risk algorithms in particular are going to be “impossible to regulate.” The EU plans to set up the European AI Office to oversee all things AI across the union and play a key role in executing the act, but there will still be challenges around enforcement consistency across the 27 member states. 

Another factor is whether the penalties will actually do enough to deter companies from breaking the rules. Depending on the violation, the EU AI Act will enable regulators to fine AI providers between $8.2 million and $38.2 million, or between 1.5% and 7% of the company’s global turnover, whichever is higher. But as we’ve seen before, EU fines on tech giants have often amounted to little more than a slap on the wrist or have been considered just a cost of doing business—even when they have amounted to billions of dollars. Last year, the EU fined Meta $1.3 billion for violating privacy laws, and yet the company closed out the year with a blockbuster financial report that sent its stock soaring 20%.

Enforcement is set to roll out in waves, with prohibitions of the banned use cases starting in six months, obligations on providers of general-purpose AI systems going into effect in a year, and most other provisions taking effect in two to three years. That’s a lot of time in the world of AI, where it feels like there’s a new breakthrough and a more capable model rolling out every day. By the time many of these provisions kick in, a lot will have happened, and we may even be dealing with a whole new landscape. So while the EU AI Act is officially here, it’s really just beginning. 

And with that, here’s more AI news. 

Sage Lazzaro
sage.lazzaro@consultant.fortune.com
sagelazzaro.com

AI IN THE NEWS

OpenAI CTO Mira Murati says she’s “not sure” if Sora was trained on YouTube or other social media videos. Murati dodged questions about what data Sora, the company’s new text-to-video model, was trained on during a sitdown interview with The Wall Street Journal’s Joanna Stern, repeating only that it was “publicly available or licensed data.” It seems unlikely that she doesn’t know, but rather that she can’t say due to the whirlwind of lawsuits the company is facing around scraping content without permission to train its models. Murati also went on to say that OpenAI has not yet determined the policies or limitations for Sora, but that the company plans to make it publicly available in 2024, possibly “in a few months.” The full interview is worth a watch. 

OpenAI strikes content deals with French and Spanish publishers. On the topic of OpenAI’s training data, the company yesterday announced partnerships with Le Monde and Prisa Media to help train its models and bring French and Spanish language news content to ChatGPT. Users should begin seeing summaries from the publishers and “enhanced links” to their original articles in the coming months, OpenAI said. It’s not clear how much the deal is worth, but it’s the latest in a short string of deals between OpenAI and publishers including Axel Springer and the Associated Press to use their content for training data and content. Those deals have been reported to have been worth between mid-single-digit millions of dollars per year and north of $10 million per year.

Anthropic releases Claude 3 Haiku, the most affordable of its latest models. Now available in the API and for Claude Pro subscribers, Haiku is positioned as the “fast and light” model in the company’s latest family of models, which includes the more powerful Claude 3 Sonnet and even more powerful Claude 3 Opus released earlier this month. Anthropic says Haiku's pricing model “was designed for enterprise workloads which often involve longer prompts” and boasts a 1:5 input-to-output token ratio.

Google unveils SIMA, an AI agent training to game more like a human. SIMA, which stands for Scalable, Instructable, Multiworld Agent, mixes natural language instruction with image recognition and understanding 3D worlds to play games more like a human as opposed to an ultra-efficient AI. “SIMA isn’t trained to win a game; it’s trained to run it and do what it’s told,” said Google DeepMind researcher and SIMA co-lead Tim Harley, according to The Verge. It was trained on games including No Man’s Sky, Teardown, Valheim, and Goat Simulator 3 and is expected to eventually be able to play any game, even open-world games with no clear path. SIMA is currently only in research and is still learning to adapt to new games it hasn’t played before. 

PAI publishes a collection of case studies with OpenAI, TikTok, and more to show how disclosure efforts around AI-generated content are going. The nonprofit Partnership on AI (PAI) one year ago announced a framework for responsible practices around synthetic media, with 10 companies joining the effort as launch partners: Adobe, BBC, Bumble, CBC/Radio Canada, D-ID, OpenAI, Respeecher, Synthesia, TikTok, and WITNESS. Together with PAI, each of the companies this week published a case study on how its efforts are going so far. The case studies—which can all be found here—show the range of different approaches the companies are taking and the unique challenges they’re facing.

For example, the BBC described how it used AI “face swapping” to anonymize interviewees, while CBC News concluded that moving quickly to use AI to conceal a news source’s identity was not worth “the risk of potentially misleading viewers.” Under key lessons learned in its case study about building disclosure into every DALL-E image, OpenAI said it learned that “no current provenance approach is a silver bullet” or “checks all of the boxes,” though it will roll out the DALL-E 3 provenance classifier sometime in the first half of this year. And in line with my reporting from last week discussing how AI-generated content labels on TikTok are currently more confusing than they are helpful, the company in its case study detailed that its biggest challenge has been defining what falls in and out of scope.

FORTUNE ON AI

Nvidia-backed CoreWeave’s new CFO—a Google, Amazon, and Microsoft alum—explains building ‘the next generation of cloud infrastructure’ —Sheryl Estrada

Executives say technology is moving too fast for their employees to keep up: ‘It can be very daunting’ —Trey Williams

‘Democratizing AI education’: How Mark Cuban is helping teach students to disrupt industries with AI skills —Preston Fore

AI CALENDAR

March 18-21: Nvidia GTC AI conference in San Jose, Calif.

April 15-16: Fortune Brainstorm AI London (Register here.)

May 7-11: International Conference on Learning Representations (ICLR) in Vienna

June 25-27: 2024 IEEE Conference on Artificial Intelligence in Singapore

PROMPT SCHOOL

AI Prompt engineering is dead. Or at least that’s what IEEE Spectrum declared in response to new research suggesting the effectiveness of human prompt engineering is too inconsistent to be worth the time and effort—and that the models are actually far superior at prompting themselves. 

“It’s both surprising and irritating that trivial modifications to the prompt can exhibit such dramatic swings in performance. Doubly so, since there’s no obvious methodology for improving performance,” concluded the VMware researchers, who tested three open-source language models—Mistral-7B, Llama2-13B, and Llama2-70B—with 60 different prompt combinations each.

Almost as soon as ChatGPT dropped, prompt engineering—the idea that you can improve an LLM’s response by optimizing how you word a prompt—took centerstage. Users flooded the internet with prompt tips and tricks for getting better results (and bypassing the models’ guardrails), including everything from simply asking the model nicely to intricate formats and sentence structures for how to frame specific requests. Some are even downright silly—for example, users have reported getting ChatGPT to respond to requests it originally denied by simply typing “bro…” And this wasn’t limited to everyday users or viral social media tips either; the role of Prompt Engineer quickly skyrocketed to become one of the hottest new jobs in tech, with some positions fetching salaries as high as $300,000. 

While interesting, it seems unlikely the results of the VMware research will lead tech companies and users to abandon all human prompt engineering efforts just yet. But the idea that models may be better equipped to prompt themselves is something AI companies have started experimenting with. Amid the recent Google Gemini image generation controversy, Bloomberg reported the model’s use of “prompt transformation” was partially to blame, referring to a newer approach to LLMs where the model covertly rewrites the user’s prompt to make it more detailed rather than just acting on the prompt as written. 

While this approach backfired in Gemini’s case, it makes sense that models could be better at prompting themselves than we are. They’re not actually speaking our language, but rather doing a whole lot of math we’re not capable of. As part of their study, the VMware researchers asked the models to create optimal prompts and found that in almost every case, the automatically generated prompt performed better than the best human prompt discovered through trial-and-error. But these prompts were so bizarre and random, no human would have ever come up with them. For example, one was just a Star Trek reference: “Command, we need you to plot a course through this turbulence and locate the source of the anomaly. Use all available data and your expertise to guide us through this challenging situation.”

“I literally could not believe some of the stuff that it generated,” VMware researcher Rick Battle told IEEE Spectrum.