The "Brussels Effect" refers to the tendency for regulation, agreed upon in Brussels, the headquarters of the European Union, to be regarded as the gold standard and imitated worldwide. The United States often provides a competing model by exempting certain activities from existing regulations and deliberately not regulating certain issues to encourage market activity, capital investment, and profit driven innovation.
In March 2024, the European Union adopted the Artificial Intelligence Act, European Union wide legislation. Some commentators suggest that the Act could serve as an appropriate model for African countries concerned about the risks associated with AI. However, the act is not yet well understood, even in Europe, suggesting that such forecasts are premature.
A poor fit for Africa?
From what we do know about the Act there are reasons to question both whether it is a suitable model for African countries and whether it is likely to be adopted by African countries, suitable or not.
The complexity of the Act coupled with the need for multiple expert bodies within governments to enforce it, suggest a poor fit for African states with limited resources and multiple more pressing crises. The act contains 180 recitals, 113 articles and 13 annexes with complex inter-relationships between them. The act requires notifying and notified bodies, conformity assessment bodies, an AI Board, an AI Office, national competent authorities, and market surveillance authorities —all of which demand expertise in AI technology and regulation. Such expertise is likely not immediately available in most African countries, where AI technology skills may be better allocated to developing AI systems.
The Act exempts AI systems used for military, defence and national security purposes regardless of the type of entity using them. Consequently the Act provides no solutions for an extremely pressing issue for Africa's democratic governments: how to control weaponisation of AI both by national defence forces with dubious loyalty to democracy, and by private security contractors.
The AI Act instantiates three categories of AI systems: prohibited, high risk and requiring transparency. But even the prohibitions are complicated; real time biometric identification systems are banned except for certain uses which are permitted but then only subject to further constraints. If a system is high risk then its operators must assess the risks and take steps to deal with them. Within a given framework, AI providers must define risk, define the appropriate responses to risk, and then record their own determinations.
The Act effectively gives the power to the industry to determine which harm should be guarded against, the appropriate response to those harms, and the appropriate documentation of those assessments. The primary obligation is to document processes.
Systems that trigger transparency requirements must warn users that they are dealing with AI. Such provisions could be useful in African contexts but only if national markets are sufficiently competitive to give people alternatives to the AI system.
The level of abstraction, and multiple exceptions and conditions for each provision promise to provide highly remunerated work for lawyers. But important as it is to provide well paying work for lawyers, African countries may well have other policy objectives.
The EU's General Data Protection Regulation and the Brussels Effect
The most famous example of the Brussels Effect is the General Data Protection Regulation (GDPR). Many African countries have imitated the GDPR. Although both the GDPR and the AI Act are complex and require enforcement by state agencies, they differ significantly in other ways. The GDPR grants individuals rights over their data, while the AI Act offers far fewer rights to individuals. The AI Act does create a right to an explanation for automated decision-making, but only for a limited category of cases. Even then the right to explanation can be trumped by a claim of trade secret protection.
By contrast, under the GDPR, individuals can make demands directly from data controllers, such as to have their data corrected. Only if a data controller refuses a data subject's demands is there need to have recourse to the data protection authority.
The GDPR created strong incentives for African countries that wished to attract or retain data processing work from Europe. They could facilitate these economic activities by passing GDPR-aligned legislation and obtaining adequacy decisions from the EU. However, there are no similar incentives for African countries to imitate the AI Act. There is also no evidence that African countries have the capacity to provide AI services or products to the European Union. This lack of capacity is not surprising, given the current scarcity of the necessary compute and electrical power demanded to develop AI systems.
There is another reason that the GDPR has been widely imitated. The GDPR is itself just one iteration in a long history of data protection that began with the Council of Europe's Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data in 1981. This led to the EU Data Protection Directive, which was later superseded by the GDPR, based on decades of regulatory experience.
The AI Act is based on concerns about a future that has not quite emerged. Rather than dealing with proven present issues such as pornographic and political deepfakes, manipulative chatbots and biased outcomes, it attempts to forestall risks that have not yet emerged, resulting in extremely abstract provisions and circular reasoning.
There may still be valuable lessons to be learned from the European experience with the AI Act. However, claims that the act should be imitated by African countries would be more credible if they exhibited a more nuanced approach to the Act, including its complexities and shortcomings.
Comments
Post a Comment