The EU and the U.S. Disagree on AI Risk Management Regulations: A Transatlantic Comparison - Part I

Here we summarize the main ideas from the paper authored by Alex Engler, published on April 25, 2023, as part of a report produced by Governance Studies.¹

The EU and the U.S. are key to the future of global AI governance. Ensuring that both sides’ approaches to AI risk management are aligned will facilitate bilateral trade, improve regulatory oversight, and enable broader transatlantic cooperation.

The U.S. approach to AI risk management is highly decentralized across federal agencies, with many adapting to AI without relying on other legal authorities. The U.S. has invested in non-regulatory infrastructure, such as a new AI risk management framework, facial recognition software evaluations, and extensive funding for AI research. In contrast, the EU’s approach to AI risk management is characterized by a broader range of legislation tailored to specific digital environments. The EU plans to impose new requirements for high-risk AI in socioeconomic processes, government use of AI, and regulated consumer products incorporating AI systems. Furthermore, other EU legislation allows for greater public transparency and influence over the design of AI systems in social media and e-commerce.

The EU and U.S. strategies share a conceptual alignment on a risk-based approach, agree on the key principles of trustworthy AI, and endorse an important role for international standards. However, the specifics of these AI risk management frameworks exhibit more differences than similarities. With regard to many specific AI applications—especially those related to socioeconomic processes and online platforms—the EU and the U.S. are on a path toward significant misalignment.

The EU-U.S. Trade and Technology Council has demonstrated initial success in addressing AI, particularly through a project to develop a common understanding of metrics and methodologies for trustworthy AI. Through these negotiations, the EU and the U.S. agree to collaborate on international AI standards, while jointly studying emerging risks and the applications of new AI technologies.

However, much more can be done to promote this alignment, in addition to improving each country’s AI governance framework. Specifically:

a) The U.S. should implement federal agencies’ AI regulatory plans and use them to design a strategic AI governance framework aimed at U.S.-EU alignment; b) The EU should allow for greater flexibility in the sector-specific implementation of the EU AI Act, refining the legislation to facilitate future EU-U.S. negotiations and cooperation; c) The U.S. needs to implement a legal framework for the governance of online platforms; however, in the meantime, the EU and the U.S. should work on shared documentation of recommendation systems and network algorithms, as well as conduct collaborative research on online platforms; d) The U.S. and the EU should deepen knowledge sharing at various levels, including the development of standards; AI sandboxes; large-scale public AI research projects and open-source tools; exchanges between regulators; and the development of an AI assurance ecosystem.

Greater collaboration between the EU and the U.S. will be crucial, as these governments are implementing policies that will be fundamental to the democratic governance of AI.

Introduction

AI risk management approaches—shaped by emerging legislation, regulatory oversight, civil liability, soft law, and standards set by private actors—are becoming important facets of international diplomacy and trade policy. In addition to fostering integrated technology markets, a more unified international approach to AI governance can strengthen regulatory oversight, guide research toward shared challenges, promote the exchange of best practices, and enable the interoperability of tools for the trustworthy development of AI.

The EU and U.S. governance approaches cover a wide range of AI applications with international implications, including more sophisticated AI in consumer products; a proliferation of AI in regulated socioeconomic decisions; an expansion of AI across a wide variety of online platforms; and web-hosted AI systems aimed at the general public, such as generative AI and foundational models.

This paper examines the U.S. and EU approaches to AI risk management, compares policy developments across eight key subfields, and discusses collaborative steps taken to date, particularly through the U.S.-EU Trade and Technology Council. In addition, the paper identifies key emerging challenges for transatlantic AI risk management, offering policy recommendations that can promote well-aligned and mutually beneficial negotiations on AI policy between the U.S. and the EU.

The U.S. Approach to AI Risk Management

The U.S. government’s approach to AI risk management can be broadly characterized as risk-based, sector-specific, and highly decentralized across federal agencies. There are advantages to this approach, but it also contributes to the uneven development of AI policies. Although there are several federal guidance documents from the White House on AI-related harms, they have not established a uniform or consistent federal approach to AI risks.

The February 2019 executive order—Maintaining U.S. Leadership in Artificial Intelligence (EO 13859)—and its subsequent guidance from the Office of Management and Budget (OMB) (M-21-06) introduced the first federal approach to AI oversight.² Issued in November 2020, the OMB guidance clearly articulated a risk-based approach, stating, “the magnitude and nature of the consequences should an AI tool fail. appropriate effort to identify and mitigate the risks.” These documents also urged agencies to consider key aspects of AI risk mitigation through regulatory and non-regulatory interventions. This includes using scientific evidence to determine AI capabilities, enforcing nondiscrimination statutes, considering disclosure requirements, and promoting the safe development and deployment of AI.

In general, federal agencies have not yet developed the necessary AI regulatory plans. In December 2022, Stanford University’s Center for Human-Centered AI released a report stating that only five of the 41 major agencies had created an AI plan as required. In fact, only one major agency, the Department of Health and Human Services (HHS), provided a comprehensive plan in response. HHS extensively documented the agency’s authority over AI systems (through 12 different statutes), its active information collections (e.g., regarding AI for genomic sequencing), and emerging AI use cases of interest (primarily in disease detection). The thoroughness of HHS’s regulatory plan demonstrates how valuable such an effort can be for federal agency planning and for informing the public if other agencies follow in its footsteps.

Instead of implementing EO 13859, the Biden administration revisited the topic of AI risks through the Blueprint for an AI Bill of Rights (AIBoR).³ Developed by the White House Office of Science and Technology Policy (OSTP), the AIBoR includes a detailed account of the harms AI poses to economic and civil rights, five principles to mitigate these harms, and an associated list of actions by federal agencies. The AIBoR endorses a sector-specific approach to AI governance, with policy interventions tailored to individual sectors, such as health, labor, and education. Its approach is therefore heavily reliant on these associated federal agency actions rather than centralized action, especially since the AIBoR is a non-binding guideline.

The AIBoR does not directly require federal agencies to mitigate AI risks. Furthermore—despite the five general principles outlined in the AIBoR—most federal agencies can only adapt their pre-existing legal authorities to algorithmic systems. This is best illustrated by the agencies that regulate AI used to make socioeconomic decisions. This includes the Federal Trade Commission (FTC), which can use its authority to protect against “unfair and deceptive” practices to enforce truth in advertising and certain data privacy safeguards in AI systems.⁴ The FTC is also considering how its authority affects data-driven commercial surveillance, including algorithmic decision-making. The Equal Employment Opportunity Commission (EEOC) can enforce some transparency, require a non-AI alternative for people with disabilities, and enforce nondiscrimination in AI-based hiring.⁵ The Consumer Financial Protection Bureau (CFPB) requires explanations for credit denials by AI systems and could potentially impose nondiscrimination requirements.⁶

Among these principles, the Biden administration has been particularly strict regarding racial equity. In February 2023, it issued the executive order “Advancing Racial Equity and Supporting Underserved Communities Through the Federal Government” (EO 14091). The second executive order on this subject directs federal agencies to address emerging risks to civil rights, including “algorithmic discrimination in automated technology.”⁷ It is too early to know the impact of this new executive order.

Federal agencies with regulatory authority over consumer products are also making adjustments. A leading agency is the Food and Drug Administration (FDA), which has been working to incorporate AI—and, specifically, machine learning—into medical devices since at least 2019.⁸ The FDA publishes best practices for AI in medical devices, documents commercially available AI-enabled medical devices, and pledges to conduct relevant pilot studies and advance regulatory science in its AI action plan. In addition to the FDA, the Consumer Product Safety Commission (CPSC) stated in 2019 its intention to investigate and track incidents of harm caused by AI in consumer products, as well as to consider policy interventions, including public education campaigns, voluntary standards, mandatory standards, and recalls. In 2022, the CPSC issued a preliminary report on how to test and evaluate consumer products that incorporate machine learning.⁹

Alongside the uneven state of AI regulatory developments, the U.S. is investing in infrastructure to mitigate AI risks. Most notable is the National Institute of Standards and Technology’s (NIST) AI Risk Management Framework (RMF), with its final version released on January 26, 2023.¹⁰ The NIST AI RMF is a voluntary framework based on the Organization for Economic Cooperation and Development (OECD) framework for classifying AI systems, offering comprehensive guidance on when and how risk can be managed throughout the AI lifecycle. NIST is also developing a new AI RMF Playbook, featuring concrete examples of how organizations can implement the RMF in the data collection, development, deployment, and operation of AI.¹¹

NIST also plays a role in evaluating and publicly reporting on the accuracy and fairness of facial recognition algorithms through its facial recognition vendor testing program. In one analysis, NIST tested and compared 189 commercial facial recognition algorithms for accuracy across different demographic groups, providing valuable insights to the AI market and enhancing public understanding of these tools.¹²

A variety of policies address algorithmic harm, contributing to future institutional preparedness and thus warranting mention, even if AI risk is not their primary focus. Launched in April 2022, the National AI Advisory Committee can play an external advisory role in guiding government policy on AI risk management in areas such as law enforcement, although it is primarily concerned with advancing AI as a national economic asset.¹³ The federal government has also conducted several pilot programs for an improved hiring process, with the goal of attracting data science talent to the public service—a key aspect of preparing for AI governance. Currently, the “data scientist” occupational series is the federal government position most relevant to the technical aspects of AI risk management. However, this role is more focused on conducting data science than on reviewing or auditing AI models created by private-sector data scientists.

The U.S. government first published a national Strategic Plan for AI Research and Development in 2016, and by 2022, 13 federal departments were funding AI research and development.¹⁴ The National Science Foundation has funded 19 interdisciplinary AI research institutes, and the academic work of some of these institutes is advancing trustworthy and ethical AI methods. Similarly, the Department of Energy has been tasked with developing more reliable AI methods that can inform commercial activity, such as in materials discovery. In addition, the Biden administration will seek an additional $2.6 billion over six years to fund AI infrastructure under the National AI Research Resource (NAIRR) initiative: promoting trustworthy AI is one of its four main objectives.¹⁵ Specifically, NAIRR could be used to better study the risks of emerging large AI models, many of which are currently developed without public scrutiny.

In a recent and significant development, a number of states—including California, Connecticut, and Vermont—have introduced legislation to address algorithmic harm.¹⁶ While these measures could significantly enhance AI protections, they may also create future challenges for the passage of federal privacy legislation that would supersede various state laws.¹⁷

The EU’s Approach to AI Risk Management

The EU’s approach to AI risk management is complex and multifaceted, based on existing legislation, particularly the General Data Protection Regulation (GDPR), encompassing the recent Digital Services Act and the Digital Markets Act, as well as the actively debated legislative initiative, the AI Act. The EU has developed different regulatory approaches for different digital environments, each with a varying degree of emphasis on AI.

In addition to its data privacy implications, the GDPR contains two important articles related to algorithmic decision-making. First, the GDPR states that algorithmic systems must not make significant decisions affecting legal situations without any human oversight.¹⁸ Based on this provision, in 2021, Uber was required to reinstate six drivers who had been terminated solely by the company’s algorithmic system.¹⁹ Furthermore, the GDPR guarantees an individual’s right to “meaningful information about the logic” of algorithmic systems—sometimes controversially referred to as a “right to an explanation”—regarding algorithmic decisions. There are many open questions regarding this provision, including how often affected individuals request this information, the value of the information to them, and what happens when companies refuse to provide it.²⁰

The EU AI Act will be a particularly critical component for AI risk management across many high-risk areas of activity.²¹ Although the AI Act is not yet finalized, enough can be inferred from the European Commission’s April 2021 proposal, the EU Council’s final proposal from December 2022, and the information available from ongoing discussions in the European Parliament to analyze its key features.

Although often referred to as “horizontal,” the AI Act implements a hierarchical system of regulatory obligations for a specifically enumerated list of AI applications.²² Various AI applications—including deepfakes, chatbots, and biometric analysis—must clearly disclose their use to the individuals affected. A distinct set of AI systems posing “unacceptable risks” would be completely banned, potentially including AI for social scoring, AI-enabled manipulative technologies, and—with several important exceptions—biometric identification by law enforcement in public spaces.

Between these two levels are “high-risk” AI systems, which is the most inclusive and far-reaching of the designations under the EU AI Act. Two categories of AI applications will be designated as high-risk under the AI Act: regulated consumer products and AI used for high-impact socioeconomic decisions. All high-risk AI systems will have to meet standards for data quality, accuracy, robustness, and non-discrimination, in addition to implementing technical documentation, record-keeping, a risk management system, and human oversight. Entities that sell or deploy covered high-risk AI systems—known as providers—will need to meet these requirements and submit documentation attesting to the compliance of their AI systems; otherwise, they will face fines of up to 6% of their annual global revenue.

The first category of high-risk AI includes consumer products that are already regulated by the New Legislative Framework, the EU’s single-market regulatory regime, which covers products such as medical devices, vehicles, boats, toys, and elevators.²³ Generally speaking, this means that AI-enabled consumer products will still undergo the pre-existing regulatory process under the relevant product harmonization legislation and will not require a second, independent conformity assessment solely for the requirements of the AI Act. The requirements for high-risk AI systems will be incorporated into existing product harmonization legislation. As a result, when going through the existing regulatory process, companies will have to pay closer attention to AI systems, reflecting the fact that some modern AI systems may be more opaque, less predictable, or plausibly updated after the point of sale.

Notably, some EU agencies have already begun to consider how AI affects their regulatory processes. A key example is the European Union Aviation Safety Agency, which first established an AI task force in 2018, published an AI roadmap focused on aviation safety in 2020, and issued comprehensive guidelines for AI that assists humans in aviation systems in 2021.²⁴

The second category of high-risk AI consists of a list of AI applications that includes impactful socioeconomic decisions by the private sector —that is, hiring, access to education, access to financial services, and workforce management—as well as government applications in public benefits, law enforcement, border control, and judicial proceedings. Unlike consumer products, these AI systems are generally viewed as posing new risks and, until now, have not been regulated. This means that the EU will need to develop specific AI standards for all these various use cases (i.e., how accuracy, non-discrimination, risk management, and other requirements apply to all the various AI applications covered). This is expected to pose a very significant implementation challenge, given the number of high-risk AI applications and the novelty of AI standards. These standards will likely play a major role in the effectiveness and specificity of the AI Act, as complying with them will be the surest path for companies to achieve legal compliance under the AI Act.

In addition, companies that sell or deploy high-risk AI systems will have to affirm that their systems meet these requirements by submitting documentation to that effect in the form of a conformity assessment. These companies must also register their systems in an EU-wide database that will be made available to the public, creating significant transparency regarding the number of high-risk AI systems, as well as the extent of their social impact. Finally, although not included in the Commission’s original proposal, the Council of the EU has proposed—and the European Parliament is considering—new regulatory requirements for “general-purpose AI systems,” including language and image models.²⁵ Regulatory requirements for general-purpose AI may include standards for accuracy, robustness, non-discrimination, and a risk management system.

The EU AI Act is not the only significant legislation addressing AI risk. The EU has already adopted the Digital Services Act (DSA) and the Digital Markets Act (DMA), and a future AI Liability Directive may also play an important role. The DSA, adopted in November 2022, considers AI as part of its holistic approach to online platforms and search engines. By establishing new transparency requirements, mandating independent audits, and allowing independent research on large platforms, the DSA will reveal a great deal of new information about the role and harms of AI on these platforms. In addition, the DSA requires large platforms to explain their AI systems for content recommendations—such as populating news feeds—and to offer users an alternative recommendation system that does not rely on users’ sensitive data. To the extent that these recommendation systems contribute to the spread of misinformation and large platforms fail to mitigate this harm, they may face fines under the DSA.²⁶

Similarly, the DMA broadly aims to increase competition in digital markets and considers certain AI implementations within this scope. For example, large technology companies deemed “gatekeepers” under the law will be prohibited from giving preference to their own products and services at the expense of third parties—a rule that will certainly affect AI-driven search rankings and product listings on e-commerce platforms. The European Commission will also be able to conduct inspections of gatekeepers’ data and AI systems. Although the DMA and DSA are not primarily about AI, these laws signal a clear intent by the EU to regulate AI embedded in highly complex systems.

In the second part—to be published next month—we will examine the contrasting approaches of the EU and the U.S. to AI risk management and how collaboration between the two blocs will actually unfold, given the emerging challenges in risk management and effective public policies aimed at harmonization.

__________

---

1. Regarded as an independent and leading voice in the realm of domestic policymaking, the Brookings Governance Studies program is dedicated to analyzing policy issues, political institutions and processes, and contemporary governance challenges, identifying areas in need of reform and proposing specific solutions to improve governance worldwide, with a particular emphasis on the United States.
2. "Executive Order 13859 of February 11, 2019, Maintaining American Leadership in Artificial Intelligence," Federal Register, 84 FR 3967 (January 14th, 2019): 3967-3972; Office of Management and Budget. Guidance for Regulation of Artificial Intelligence Applications, by Russell T. Vought, (Washington, D.C. 2020).
3. The White House, Blueprint for an AI Bill of Rights (Washington, D.C., 2022).
4. The Federal Trade Commission, Aiming for truth, fairness, and equity in your company's use of AI (Washington D.C., 2021); The Federal Trade Commission, Keep your AI claims in check (Washington D.C., February 27, 2023); Kaye, Kate, "The FTC's new enforcement weapon spells death for algorithms." Protocol, March 14, 2022.
5. lex Engler, "The EEOC wants to make AI hiring fairer for people with disabilities" The Brookings Institution, May 26, 2022.
6. Consumer Financial Protection Board, CFPB Acts to Protect the Public from Black-Box Credit Models Using Complex Algorithms (Washington D.C., 2022); Consumer Financial Protection Board, Consumer Financial Protection Circular 2022-03 (Washington, D.C., 2022).
7. The White House, FACT SHEET: President Biden Signs Executive Order to Strengthen Racial Equity and Support for Underserved Communities Across the Federal Government. (Washington D.C., February 2023).
8. The Food and Drug Administration, Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) (Washington D.C., 2019).
9. Nevin J. Taylor, "Applied Artificial Intelligence and Machine Learning Test and Evaluation Program for Consumer Products" Consumer Product Safety Commission, August 24, 2022.
10. National Institute of Standards and Technology, AI Risk Management Framework: Initial Draft (Washington D.C., 2022); National Institute of Standards and Technology. AI Risk Management Framework. (Washington D.C., 2023).
11. National Institute of Standards and Technology, NIST AI Risk Management Framework Playbook (Washington D.C., 2023).
12. Patrick Grother, Mei Ngan, and Kayee Hanaoka, "Face Recognition Vendor Test (FRVT) Part 3: Demographic Effects." National Institute of Standards and Technology.
13. The National Artificial Intelligence Initiative Office, THE NATIONAL AI ADVISORY COMMITTEE (NAIAC) (Washington D.C., 2022).
14. National Science and Technology Council Networking and Information Technology Research and Development Subcommittee. National AI Research and Development Strategic Plan (Washington D.C., 2016).
15. The National Artificial Intelligence Initiative Office, Strengthening and Democratizing the U.S. Artificial Intelligence Innovation Ecosystem: An Implementation Plan for a National Artificial Intelligence Research Resource (Washington D.C., 2023).
16. California Assembly Member Bauer-Kahan. An Act relating to artificial intelligence. (Sacramento, January 30, 2023); Alison Cross, "CT government AI use is extensive, raising equity and privacy concerns. Here's what a proposed bill would do." The Hartford Courant, March 4, 2023; Vermont General Assembly. An act relating to restricting electronic monitoring of employees and employment-related automated decision systems. (2023).
17. Sorelle Friedler, Suresh Venkatasubramanian, and Alex Engler, "How California and other states are tackling AI legislation." The Brookings Institution, March 22, 2023.; Cam Kerry, "Will California be the death of national privacy legislation?" The Brookings Institution, November 18, 2022.
18. The European Commission, Can I be subject to automated individual decision-making, including profiling?
19. Natasha Lomas, "Uber hit with default 'robo-firing' ruling after another EU labor rights GDPR challenge" TechCrunch, March 30, 2021.
20. Steve Wood, "Data Protection - Regulatory action and recent case law from the EU and UK courts: the emerging direction for GDPR regulation" JDSupra, March 9, 2022.
21. Lilian Edwards, "Expert explainer: The EU AI Act proposal" The Ada Lovelace Institute.
22. Joshua P. Meltzer and Aaron Tielemans, "The European Union AI Act: Next steps and issues for building international cooperation in AI" The Brookings Institution (June 1, 2022).
23. Michael Veale and Frederik Zuiderveen Borgesius, "Demystifying the Draft EU Artificial Intelligence Act" Computer Law Review International (November 26, 2021).
24. European Union Aviation Safety Agency. Artificial Intelligence Roadmap: A human-centric approach to AI in aviation (Brussels, 2020); European Union Aviation Safety Agency. EASA Concept Paper: First usable guidance for Level 1 machine learning applications (Brussels, 2021)
25. Andrea Renda and Alex Engler, "Reconciling the AI Value Chain with the EU's Artificial Intelligence Act" The Center for European Policy Studies.
26. The European Commission, Disinformation: Commission welcomes the new stronger and more comprehensive Code of Practice on disinformation. (Brussels, June 2022).