EU taking steps to set out and enforce AI regulations

Many believe that the transformative power of generative artificial intelligence (GenAI) has potential to reshape the financial sector in the time to come. With such hype comes enhanced regulatory focus, as AI, including GenAI, is increasingly posing many risks, including the risks to stability of the financial system. For instance, the European Central Bank (ECB) recently discussed the financial stability implications of AI in a recent piece as part of its financial stability review. Although regulators worldwide are moving to put in place rules to mitigate the overall risks posed by the rapidly increasing use of AI, European Union (EU) is far ahead in the game and US is looking to catch up as well. EU and US recently agreed to work on interoperable and international standards while committing to a risk-based approach to advancing safe, secure, and trustworthy AI technologies. This announcement was made at the sixth ministerial meeting of the Trade and Technology Council in Belgium.

While risk-based, cross-sectoral regulatory approaches to AI appear to be emerging in both the EU and in the US, the EU approach seems more prescriptive while the US approach, so far, looks to lean toward a less consistent patchwork of regulations across different states and agencies. Nevertheless, the US-EU cooperation aims to contribute to making progress with the implementation of the Joint Roadmap on Evaluation and Measurement Tools for Trustworthy AI and Risk Management. Another aim is to minimize divergence in the respective emerging AI governance and regulatory systems. Also released was an updated AI Taxonomy and Terminology, which contains mutually accepted joint definitions. The Joint Statement issued post this meeting in Belgium also notes that the EU and the US established a Quantum Task Force to address open questions on science and technology cooperation on quantum technologies, with the aim to bridge research and development (R&D) gaps and harmonize efforts in quantum technology advancements.

Another key announcement in EU involves the approval of the EU AI Act by the European Council, on May 21, 2024. The comprehensive EU AI Act sets prescriptive, risk-based rules via a common framework for the use and supply of AI systems in the EU. The Act will be published in Official EU Journal in the coming days and will enter into force 20 days after this publication. The Act will apply two years after its entry into force, with high-risk systems having 36 months to comply. As part of the governance architecture to ensure proper enforcement, several governing bodies will be set up. These include an AI Office within the European Commission (EC) to enforce the common rules across EU, a scientific panel of independent experts to support the enforcement activities, an AI Board with member states’ representatives to advise and assist EC and member states on consistent and effective application of the AI Act, and an advisory forum for stakeholders to provide technical expertise to the AI Board and EC. The Act can apply to both providers and deployers of AI systems (including banking sector entities) that pose risk. The Act also considers systemic risks that could arise from general-purpose AI models, including large GenAI models.

Another EU rule, called the Digital Services Act, which became fully applicable from February 17, 2024 and applies to broader digital services, could govern aspects of AI as well. As part of this, on May 17, 2024, EC issued a legally binding request for information to Microsoft, based on the suspicion that Bing may have breached the Digital Services Act for risks linked to GenAI, such as so-called “hallucinations,” the viral dissemination of deep-fakes, as well as the automated manipulation of services that can mislead voters. This recent request for information follows the earlier request from March 14 to which answer was not received on specific risks stemming from Bing's generative AI features, notably “Copilot in Bing” and “Image Creator by Designer.” The company now has until May 27 to provide the requested information to EC. Under the Digital Services Act, designated services, including Bing, must carry out an adequate risk assessment and adopt respective risk mitigation measures (Articles 34 and 35). Bing was designated as a very large online search engine under this act on April 25, 2023. With futuristic and ground-breaking rules like the AI Act and strict enforcement of rules like the Digital Services Act, EU seems to be establishing itself as a global leader in the regulation of AI systems.

Related Links

• ECB on financial stability implications of AI
• EC on US-EU agreement
• AI taxonomy and terminology (PDF)
• EU council on AI act
• EC on GenAI risks on Microsoft Bing
• List of designated entities under Digital Services Act