The EU and the U.S. Disagree on AI Risk Management Regulations: A Transatlantic Comparison - Part II

In my previous column of our “Direito Privado no Common Law,” we summarized the main ideas from a paper by Alex Engler, published on April 25, 2023,¹ in the context of a report produced by Governance Studies. At that time, based on the premise that the EU and the U.S. are fundamental to the future of global AI governance, we evaluated the two blocs’ approaches to AI risk management.

Based on the premises outlined there, it is possible to draw some comparisons between the U.S. and EU approaches to AI risks. Both governments adopt largely risk-based approaches to AI regulation and have outlined similar principles for how trustworthy AI should function. In fact, upon examining the principles in the most recent U.S. guidance documents (the AIBoR and the NIST AI RMF) and the EU’s AI Act, there is an almost perfect overlap.² All three documents advocate for accuracy and robustness, non-discrimination, safety, transparency and accountability, explainability, interpretability, and data privacy, with only minor variations. Furthermore, both the EU and the U.S. expect standard-setting organizations—whether governmental or international bodies—to play a significant role in defining guardrails for AI.

Despite this broad conceptual alignment, there are far more areas of divergence than convergence in AI risk management. The EU’s approach features a much more centralized and comprehensive regulatory framework than that of the U.S., both in terms of covering a wider range of applications and enacting mandatory rules for each application. Although U.S. agencies are seriously committed to drafting guidelines and considering the creation of rules for AI applications within their jurisdictions, their ability to enforce such rules remains unclear. U.S. agencies may take action to file new lawsuits, often without explicit legal authority to regulate algorithms. In contrast, the EU regulator is able to enforce its regulations on AI applications, with defined investigative powers, and impose significant fines for noncompliance.

The EU’s interventions will also foster greater public transparency and awareness regarding the role of AI in society, such as through a database of high-risk AI systems across its jurisdiction and by granting independent researchers access to data from major online platforms. On the other hand, the U.S. federal government invests significantly more resources in AI research, which may contribute to the development of new technologies that mitigate algorithmic risks.

The EU and the U.S. are adopting distinct regulatory approaches to AI used for high-impact socioeconomic decisions, such as hiring, access to education, and financial services. The EU’s approach has broader coverage of applications and a wider set of rules for these AI applications. The U.S. approach is more limited to adapting the agency’s current regulatory authority to address AI, which is much more restricted. Given that many in the U.S. do not expect comprehensive legislation to emerge anytime soon, some agencies have begun to take this work seriously, putting them—counterintuitively—ahead of many EU agencies. However, agencies in EU member states and a potential EU AI Council are expected to step up their efforts, with stronger authority and funding secured under the new EU law. The fact is that differing regulatory frameworks between the EU and the U.S., as well as a fluctuating timeline for AI regulations, could make regulatory alignment a significant challenge.

The longstanding trade in physical consumer products between the EU and the U.S. could be helpful for AI regulatory alignment in this context. Many U.S. products already comply with the EU’s stricter product safety rules in order to access the European market without requiring a separate production process.³ It seems unlikely that this will change significantly under the new EU rules, which will certainly affect commercial products but are unlikely to lead to major changes in the regulatory process or prevent U.S. companies from meeting EU requirements. It is very likely that the rules for AI embedded in physical products will have a “Brussels Effect,” in which trading partners, including the U.S., seek to influence the standards but ultimately end up adopting the EU’s.

Several topics have been the focus of successful legislative efforts by the EU, but not by the U.S. Congress. Most notably, these include online platforms—such as e-commerce, social media, and search engines—which the EU has addressed through the DSA and the DMA. There is currently no comparable approach in the U.S., nor is the public policy discussion moving toward a clear consensus.

Under the EU’s AI Act, chatbots would face a disclosure requirement, which is currently absent in the United States. In addition, facial recognition technologies will be subject to specific rules prescribed by the EU’s AI Act, although these provisions remain hotly debated.⁴ So far, the U.S. approach has been to provide public information through the NIST Face Recognition Vendor Test program, but not to impose rules.

Similarly, although the European debate on generative AI is new, it is plausible that the EU will include some regulation of these models in the EU AI Act. This could include quality standards, requirements for transferring information to third-party clients, and/or a risk management system for generative AI. At present, there is no strong evidence that the U.S. plans to take similar steps.

The Trade and Technology Council (TTC) stems from an EU-U.S. agreement. It serves as a forum to facilitate ongoing negotiations and enhance cooperation on trade and technology policy. The TTC emerged following a series of diplomatic breakthroughs between the U.S. and the EU, such as working together on a global minimum corporate tax and resolving tariff disputes over steel, aluminum, and aircraft.⁵

Following the first U.S.-EU TTC ministerial meeting in September 2021 in Pittsburgh, the inaugural statement included an important section on AI collaboration in Annex III.⁶ The declaration recognized the risk-based approaches of the EU and the U.S., committing to three projects under the umbrella of advancing trustworthy AI: (1) discuss the measurement and evaluation of trustworthy AI; (2) collaborate on AI technologies designed to protect privacy; and (3) jointly produce an economic study on the impact of AI on the workforce. Since then, all three projects have begun to deliver specific outcomes, resulting in some of the most concrete results of the broader TTC initiative.

a) As part of the first measurement and evaluation project, the TTC Joint Roadmap on Evaluation and Measurement Tools for Trustworthy AI and Risk Management was published on December 1, 2022.⁷ This roadmap includes three substantive commitments. First, the EU and the U.S. will work toward a common terminology for trustworthy AI—a prerequisite for aligning AI risk policies. This will be advanced by building a common knowledge base of metrics and methodologies, including the scientific study of trustworthy AI tools, which may lead to scientific consensus on best practices for AI implementation. The TTC’s collaborative efforts to document tools and methods will likely build on pre-existing efforts, particularly the OECD-NIST Catalog of AI Tools and Metrics, which has made significant progress in this area.⁸ This is a valuable project, as a common understanding of available tools and metrics is essential for operationalizing the shared principles of the U.S. and the EU;

b) In accordance with the second component of the Joint Roadmap, the EU and the U.S. commit to coordinating their efforts with international standard-setting bodies for trustworthy AI. This reflects the U.S. view that EU standardization bodies will play a key role in the EU’s AI Act. Furthermore, the EU acknowledges that it will devote substantial resources to developing the many standards necessary for the implementation of the various legislative acts affecting AI risk management. A recent European Commission report on the AI standards landscape suggests that the EU expects to obtain such standardization from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), international standards bodies that have cooperation agreements with CEN and CENELEC, respectively. In addition, the same European Commission report notes that other AI standards are already being examined, specifically those of the Institute of Electrical and Electronics Engineers (IEEE).⁹

c) Finally, the roadmap calls for the joint tracking and categorization of emerging AI risks—including incidents of proven harm—and efforts toward compatible assessments of AI systems. Overall, these are the first steps toward laying the groundwork for alignment on AI risk, although the EU and the U.S. are not committing to much beyond that.

In the second AI collaboration project, the EU and the U.S. agreed to develop a pilot project on privacy-enhancing technologies (PETs). Rather than merely enhancing privacy, PETs are a category of technologies designed to enable large-scale data analysis while maintaining some degree of privacy over the data. PETs enable the broader use of sensitive data from the private sector and government sources, including medical images, neighborhood mobility, and the effects of social media on democracy, among other examples.¹⁰ Following the third TTC ministerial meeting on December 5, 2022, the EU and the U.S. announced an agreement to jointly lead PETs for applications in health and medicine.¹¹

The third project was also released following the third TTC ministerial meeting: a report on the impact of AI on the workforce, co-authored by the European Commission and the White House Council of Economic Advisers.¹² The report highlights a number of challenges, including that AI could displace high-skilled jobs not previously threatened by automation and that AI systems may be discriminatory, biased, or fraudulent in ways that affect labor markets. The report suggests funding adequate job transition services, adopting AI that benefits labor markets, and investing in regulatory agencies that ensure AI hiring and algorithmic management practices are fair and transparent.

Building transatlantic—and, even more so, global—alignment on AI risk management will be an ongoing endeavor that spans a range of digital policy issues. Although there are many potential obstacles to transatlantic consensus, a comparison of the EU and U.S. approaches to AI highlights several emerging challenges as particularly critical.

As a first immediate challenge, the emerging rules governing high-impact socioeconomic decisions are already leading to significant misalignment. The most obvious reason is that the EU’s AI Act provides broad regulatory authority over many types of AI systems, reinforcing the EU’s own principles. In contrast, U.S. federal agencies are taking a restrictive approach by adapting existing U.S. legislation to AI systems. Although some U.S. agencies have the authority to act broadly—such as the FTC, CFPB, and EEOC—they cover only a subset of the algorithmic principles adopted in the AIBoR and applied in the EU AI Act. For example, the U.S. Securities and Exchange Commission is able to impose a fiduciary duty on financial recommendation algorithms, requiring them to act in the best interests of investors.¹³ Although this is potentially a valuable safeguard, the resulting policy is unlikely to perfectly align with the requirements of the EU AI Act, even if applied more specifically to financial services (a category of high-risk AI applications under the EU AI Act).

It remains unclear whether the promised EU-U.S. collaboration on developing standards will significantly reduce this misalignment. The EU AI Act requires a wide variety of standards to be produced in a short period of time, leading to a series of decisions, before U.S. regulators have time to become substantially involved in the development of these standards. Furthermore, some U.S. regulators responsible for socioeconomic decisions (e.g., the CFPB, SEC, and EEOC, among others) may not have worked closely with standards bodies such as NIST or with international standards bodies such as ISO/IEC and IEEE.

Therefore, the potential for misalignment in regulatory requirements for socioeconomic decisions is quite high. Of course, to compete in the EU, U.S. companies can still comply with EU standards, even where domestic requirements are lacking. However, if they intend to follow EU rules outside their jurisdiction, this will depend significantly on whether the cost of complying with EU rules is lower than the cost of differentiation—that is, creating different AI development processes for different geographic regions.¹⁴ Currently, many AI models for socioeconomic decision-making are relatively tailored to specific geographic regions and languages, thereby mitigating the potential harm from conflicting international regulations.

Online platforms present a second significant challenge. The EU has adopted and is beginning to implement the DSA and the DMA. These acts have significant implications for AI in social media, e-commerce, and online platforms in general. Meanwhile, the U.S. does not yet appear prepared to legislate on these issues. This is particularly concerning, as digital systems are increasingly integrated into platforms, meaning they are more likely to connect many users across international borders. Although social media and e-commerce are the most familiar examples, the latest iterations include online education sites, job search and hiring platforms, stock exchanges, and workplace monitoring software deployed in multinational companies.¹⁵

These newer platforms may utilize AI that falls under the high-risk socioeconomic decisions covered by the EU’s AI Act and is also governed by U.S. federal regulatory agencies. However, the platforms themselves may also rely on AI to function, in the form of network algorithms or recommendation systems. Most platforms require some form of algorithm, as displaying the entirety of a platform to all users is typically impossible; therefore, algorithms are necessary to determine which summaries, abstracts, or rankings to display. This creates a significant possibility that the AI systems of a large online platform could be subject to regulations governing socioeconomic decision-making (e.g., the EU AI Act and U.S. regulators) as well as to the requirements of the online platform itself (e.g., the DSA). It is generally more difficult for platforms to operate under several distinct regulatory regimes. This complex environment increases the potential for EU-U.S. misalignment, as the EU continues to implement comprehensive platform governance while U.S. policy developments remain stalled.

A third emerging challenge is the evolving nature of AI deployment. New trends include the development of multi-organizational AI, as well as the proliferation of techniques such as “federated machine learning,” a machine learning technique that trains an algorithm through multiple independent sessions, each using its own dataset. This approach contrasts with traditional centralized machine learning techniques, as it allows AI models to be developed on thousands or millions of devices (e.g., smartphones, smartwatches, and AR/VR glasses), while still being tailored to each user and without the transfer of personal data. As these AI systems begin to enter more heavily regulated sectors, such as healthcare, there is significant potential for international regulatory conflicts.¹⁶

The process by which AI systems are developed—sometimes referred to as the AI value chain—is becoming more complex. A notable development is the emergence of large AI models—most commonly large language models and large image models—being made available through commercial application programming interfaces (APIs) and public cloud services. The fact that state-of-the-art models are available only via remote access may raise new concerns about how they are integrated—including through fine-tuning—into other software and web applications. Consider a European AI developer who starts with a large language model available via the API of a different company headquartered in the U.S. and then fine-tunes that model to analyze job applicants’ cover letters. This application would be high-risk under the EU AI Act, and the European developer would have to ensure that it meets the relevant regulatory standards. However, certain required qualities of the AI system—such as robustness or explainability—may be much more difficult to ensure through remote access to a third-party model, especially if it was developed in a different country under a different regulatory regime.¹⁷

Public Policy Recommendations

For EU and U.S. authorities, a variety of domestic and international policy options would support current and future cooperation and alignment in AI risk management.

The U.S. should prioritize its domestic AI risk management agenda. This includes revisiting the requirements of EO 13859 and requiring federal agencies to comply with the mandate to develop AI regulatory plans in a much more comprehensive manner regarding AI risk management. Federal agency regulatory plans can also inform what changes are needed to ensure that existing law applies to new AI applications. This requires legislative expansions of regulatory authority to uphold the AI principles adopted in the AIBoR, especially for AI used in high-impact socioeconomic decisions.

Similarly, the EU has several opportunities to facilitate future cooperation without undermining its domestic regulatory objectives. A key step is to allow for greater flexibility in the sector-specific implementation of the EU AI Act, better tailoring the Act’s requirements to specific types of high-risk AI applications, which is likely to enhance the law’s effectiveness. AI rules that can be flexibly adapted to specific applications will better facilitate future cooperation between the U.S. and the EU. To this end, the EU will need to carefully manage harmonization so that regulators in member states do not implement the high-risk requirements differently. Consequently, a mechanism for making coverage decisions (i.e., which specific AI applications are covered) and for adapting the details of the high-risk requirements could include regulators from member states and the European Commission.¹⁸

When considering online platforms, the absence of a U.S. legal framework for platform governance makes it difficult to formulate public policy recommendations. The U.S. should work toward establishing a meaningful legal framework for the oversight of online platforms. Furthermore, this framework should consider alignment with EU laws, particularly the DSA and the DMA, as misalignment will negatively impact markets and the information ecosystem. Meanwhile, the EU and the U.S. should include recommendation systems and network algorithms—key components of online platforms—when implementing the TTC Joint Roadmap on Evaluation and Measurement Tools for Trustworthy AI and Risk Management.

Although these high-risk online platforms and AI systems require more attention, the EU should carefully consider the extraterritorial impact of other aspects of its digital governance, especially those affecting websites and platforms, such as chatbots and new considerations regarding general-purpose AI.¹⁹ If the EU introduces new rules regarding the function of general-purpose AI, it must be careful to avoid overly broad requirements (such as a general standard for accuracy or robustness) that make little sense for these models and could cause unnecessary fragmentation in emerging markets.

The EU’s upcoming efforts will yield significant new insights into the functioning of key AI systems, as well as the effectiveness of its new AI governance initiatives, and the EU should proactively share these insights with the U.S. and other partners. This includes opening its AI standards development process to international stakeholders and the public, as well as ensuring that the resulting standards are available free of charge (which is not currently the case).²⁰

By working together, the U.S. and the EU can deepen their policy collaboration on AI risk management. Policy exchanges at the regulator-to-regulator level, specific to each sector, will strengthen the capacity of both governments while paving the way for cooperation. By expanding collaborative experimentation with PETs, the EU and the U.S. can also consider joint investments in responsible AI research and open-source tools that enable the implementation of responsible AI. Finally, the EU and the U.S. should consider jointly developing a plan to foster a transatlantic AI assurance ecosystem, drawing inspiration from the UK’s strategy.²¹

The EU is calling on companies to participate in an international effort to self-regulate generative artificial intelligence (AI) products. Since ChatGPT was launched last year, U.S. companies Google and Microsoft have launched their own generative AI services, ushering in a new era of digital innovation.

Although governments, companies, and civil society recognize the economic potential of the rapid advancement of generative AI tools, they also fear that the new technology could pose serious risks to democratic society if it is used to spread misinformation or if it is allowed to make decisions in our daily lives.

Transatlantic Cooperation on Generative Artificial Intelligence

Given that legislation to regulate AI lags far behind advances in the technology’s capabilities, the European Commission wants to lead a joint initiative with the U.S. to establish a code of conduct that companies would voluntarily sign. After all, mitigating the risk of AI-induced extinction must be a global priority alongside other risks on a societal scale, such as pandemics and nuclear war. Even if negotiations move forward, legislation will not take effect for another two or three years, and it is certain that no one really knows what an AI system is capable of until it is deployed to millions of people. Hence the need for an alternative arrangement to fill the legislative void—a voluntary AI code of conduct—covering not only the EU and the U.S., but also companies from G7 countries and partners such as India and Indonesia, which account for about one-third of the world’s population.²²

This will be an important step toward identifying standards and tools for trustworthy AI, as well as establishing a taxonomy and terminology for AI and monitoring the emerging risks it poses.

In summary:

The U.S. should implement the federal agency’s AI regulatory plans and use them to design strategic AI governance with a view toward EU-U.S. alignment.

The EU should allow for greater flexibility in the sector-specific implementation of its AI Act, enabling greater cooperation with the U.S.

The U.S. needs to implement a legal framework for the governance of online platforms; in the meantime, the EU and the U.S. should work on shared documentation of recommendation systems and network algorithms, as well as conduct collaborative research on online platforms.

The U.S. and the EU should deepen knowledge sharing at various levels, including in the development of standards; AI sandboxes; large-scale public AI research projects and open-source tools; exchanges between regulators; and the development of an AI assurance ecosystem.

The EU and the U.S. are implementing key AI risk management policies—deepening collaboration between these governments will help ensure that these policies become synergistic pillars of global AI governance.

Update

On June 14, the European Parliament approved a proposal for the Artificial Intelligence Regulation, in anticipation of discussions with EU Member States on the final form of the law. The rules will ensure that AI developed and used in Europe fully respects EU rights and values, including human oversight, safety, privacy, transparency, non-discrimination, and social and environmental well-being. The rules follow a risk-based approach and establish obligations for both providers and users of AI systems, depending on the level of risk the AI may pose. Consequently, AI systems posing an unacceptable level of risk to people’s safety will be banned, such as those used to classify people based on their social behavior or personal characteristics. MEPs ensured that the classification of high-risk applications will now include AI systems that significantly harm people’s health, safety, and fundamental rights, or the environment. Providers of foundation models (a new and rapidly evolving development in the field of AI) will have to assess and mitigate any risks to health, the environment, safety, fundamental rights, democracy, and the rule of law, and register their models in the Union’s database before placing them on the EU market. Generative AI systems based on such models, such as ChatGPT, will have to comply with transparency requirements (disclosing that content was generated by AI, which will help distinguish image manipulation techniques—also known as deepfakes —from real images) and ensure safeguards against the production of illegal content. Detailed summaries of the copyrighted data used for their training must also be made available to the public.²³

__________

---

1. Regarded as an independent and leading voice in the realm of domestic policymaking, the Brookings Governance Studies program is dedicated to analyzing policy issues, political institutions and processes, and contemporary governance challenges, identifying areas in need of reform and proposing specific solutions to improve governance worldwide, with a particular emphasis on the United States.
2. National Institute of Standards and Technology and the European Commission, Crosswalk: An illustration of how NIST AI RMF trustworthiness characteristics relate to the OECD Recommendation on AI, Proposed EU AI Act, Executive Order 13960, and Blueprint for an AI Bill of Rights. (Washington D.C., 2023).
3. Anu Bradford, The Brussels Effect: How the European Union Rules the World, Oxford Academic, 19 December 19, 2019.
4. Luca Bertuzzi, "AI Act: EU Parliament's discussions heat up over facial recognition, scope" Euractiv, October 6, 2022.
5. Dan Hamilton, "Getting to Yes: Making the U.S.-EU Trade and Technology Council Effective," Johns Hopkins University Transatlantic Leadership Network.
6. The White House, U.S.-EU Trade and Technology Council Inaugural Joint Statement (Washington D.C., 2022).
7. National Institute of Standards and Technology and the European Commission, TTC Joint Roadmap on Evaluation and Measurement Tools for Trustworthy AI and Risk Management. (Washington D.C., 2022).
8. The Organization for Economic Cooperation and Development. OECD-NIST Catalogue of AI Tools & Metrics (Paris, 2023).
9. European Commission. AI Standardisation Landscape Update (Brussels, 2023).
10. Solomon Messing, Christina DeGregorio, Bennett Hillenbrand, Gary King, Saurav Mahanti, Zagreb Mukerjee, Chaya Nayak; Nate Persily, Bogdan State, and Arjun Wilkins, "Facebook Privacy-Protected Full URLs Data Set" Harvard Dataverse (2020).
11. The White House, FACT SHEET: U.S.-EU Trade and Technology Council Advances Concrete Action on Transatlantic Cooperation (Washington D.C., 2022).
12. European Commission and the White House Council of Economic Advisors, The Impact of Artificial Intelligence on the Future of Workforces in the European Union and the United States of America (Washington D.C., 2023).
13. Lee Reiners, "Regulation of Robo-advisory Services" FinTech Law and Regulation (September 2, 2019).
14. Charlotte Siegmann and Markus Anderljung, "The Brussels Effect and Artificial Intelligence" (August 16, 2022).
15. Productivity Score," New York Times, August 14, 2022.
16. Matthias Paulik, Matt Seigel, Henry Mason, Dominic Telaar, Joris Kluivers, Rogier van Dalen, Chi Wai Lau, Luke Carlson, Filip Granqvist, Chris Vandevelde, Sudeep Agarwal, Julien Freudiger, Andrew Byde, Abhishek Bhowmick, Gaurav Kapoor, Si Beaumont, Áine Cahill, Dominic Hughes, Omid Javidbakht, Fei Dong, Rehan Rishi and Stanley Hung, "Federated Evaluation and Tuning for On-Device Personalization: System Design & Applications," Apple, February 2022.
17. Charlotte Stanton, Vivien Lung, Nancy Zhang, Minori Ito, Steve Weber, and Katherine Charlet, "What the Machine Learning Value Chain Means for Geopolitics," Carnegie Endowment for International Peace, August 5th, 2019.
18. Andrea Renda and Alex Engler, "What's in a Name: Getting the definition of Artificial Intelligence right in the EU's AI Act" Center for European Policy Studies, February 2023.
19. Maximilian Gahntz and Claire Pershan, 'How the EU Can Take on "general-purpose AI" in the AI Act,' Mozilla, November 9, 2022.
20. CENELEC, The General Court of the EU affirms copyright of harmonized standards. (Brussels, 2021).
21. Centre for Data Ethics and Innovation, "The roadmap to an effective AI assurance ecosystem." (London, December 8, 2021).
22. ZUBASCU, Florin. EU and US hatch transatlantic plan to rein in ChatGPT.
23. Extraído em 15 de junho de 2023. Disponível aqui.