Not a lawyer, not versed in US and EU Law, but ... I read (part) of the regulation.

https://outofthecomfortzone.frantzmiccoli.com/thoughts/2024/... and here is my shameless plug.

My take is that nobody actually practices law in this area at this time. Tons of stuff will again need to go to court before you can be sure if these regulations actually apply to you. Actually tons of the cases that are relevant for smaller enterprises will actually never go to court like with GDPR leaving uncertainty for years. Having said this the good thing about the AI act is that it force injects some principles for evaluation into existing standards.

Disclaimer: i am advising a company that sells AI act related compliance tooling

From the laws text:

For the purposes of this Regulation, the following definitions apply:

(1) ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments; Related: Recital 12

https://artificialintelligenceact.eu/article/3/ https://artificialintelligenceact.eu/recital/12/ So, it seems like yes, software, if it is non-deterministic enough would qualify. My impression is that software that simply takes "if your income is below this threshold, we deny you a credit card." Would be fine, but somewhere along the line when your decision tree grows large enough, it probably changes.

Unfortunately yes, the article is a simplification, in part because the AI act delegates some regulation to existing other acts. So to know the full picture of AI regulation one needs to look at the combination of multiple texts.

The precise language on high risk is here [1], but some enumerations are placed in the annex, which (!!!) can be amended by the commission, if I am not completely mistaken. So this is very much a dynamic regulation.

[1] https://artificialintelligenceact.eu/article/6/

> just software, statistics, old ML techniques

yes, and with the same problems if applied to the same use cases in the same way

in turn they get regulated, too

it would be strange to limited a law to some specific technical implementation, this isn't some let's fight the hype regulation but a serious long term effort to regulate automatized decision making and classification processes which pose a increased or high risk to society

I wouldn't be surprised if it does cover all software. After all, chess solvers are AI.

Have been having a lot of laughs about all the things we call AI nowadays. Now it’s becoming less funny.

To me it’s just generative AI, LLMs, media generation. But I see the CNN folks suddenly getting “AI” attention. Anything deep learning really. It’s pretty weird. Even our old batch processing, SLURM based clusters with GPU nodes are now “AI Factories”.

As somebody told me recently, now AI means any program that does something that people think is AI, even if programs doing that thing have been with us for ten years or more with the same degree of accuracy.

Yes, you are better off reading the actual act, like the linked article 5: https://artificialintelligenceact.eu/article/5/

This is not about data collection (GDPR already takes care of that), but about AI-based categorization and identification.

"AI system" and other terms are defined in article 3: https://artificialintelligenceact.eu/article/3/

Statistics and old ML are AI in the sense of that regulation.

Deliniating "AI" from other software is one of the tricky parts of the act and ultimately left as an excercise to the courts.

Trying to define it for scope was IMHO a mistake.

You can even replace AI by humans. For example, it is not legal for e.g. police officers to engage in racial profiling.

Yes its simplifying. There are more details here: https://news.ycombinator.com/item?id=42916414

I've worked with the bureaucrats in Brussels on tech/privacy topics.

Their deep meaning is "we don't want machines to make decisions". A key point for them has always been "explainability".

GDPR has a provision about "profiling" and "automated decision making" for key aspects of life. E.g. if you ask for a mortgage (pretty important life changing/affecting decision) and the bank rejects it you a) can ask them "why" and they MUST explain, in writing, and b) if the decision was made in a system that was fed your data (demographic & financial) you can request that a Human to repeat the 'calculations'.

Good luck having ChatGTP explaining.

They are trying to avoid having the dystopian nightmare of the (apologies - I don't mean to disrespect the dead, I mean to disrespect the industry) Insurance & Healthcare in the US, where a system gets to decide 'your claim is denied' against humans' (doctors in this case)(sometimes imperfect) consultations because one parameter writes "make X amount of profit above all else" (perhaps not coded with this precise parameter but somehow else).

Now, understanding the (personal) data collection and send to companies in the US (or other countries) that don't fall under the Adequacy Decisions [0] and combining that with the aforementioned (decision-making) risks, using LLMs in Production is 'very risky'.

Using Copilot for writing code is very much different because there the control of "converting the code to binaries, and moving said binaries to Prod env." (they used to call them Librarians back in the day...), so Human Intervention is required to do code review, code test, etc (just in case SkyNet wrote code to export the data 'back home' to OpenAI, xAI, or any other AI company it came from).

I haven't read the regulation lately/in its final text (I contributed and commented some when it was still being drafted), and/but I remember the discussions on the matter.

[0]: https://commission.europa.eu/law/law-topic/data-protection/i...

EDIT: ultimately we want humans to have the final word, not machines.

The EU and other organizations will be using these to ban data collection and anything to do with protection of the EU.

They will interpret "predict" as merely "report" or "act on".

This is terrible.

This quote is inaccurate. The actual wording is: "the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;" and it links to https://artificialintelligenceact.eu/recital/44/ for rationale.

So, this targets the use case of a third party using AI to detect the emotional state of a person.

The EU generally (so far) has passed reasonable legislation about these things. I'd be surprised if it was taken more broadly than the point where a reasonable person would feel comfortable with it.

A difficulty I have with customer service folk is that usually I'm just trying to report a bug. I'm not upset. Please stop trying to give me coupons. I'm not trying to cancel my account I just want to help your engineers fix this bug (and later on, I want to see that it has actually gone away).

If I must intact with an AI for this, I'd prefer that it infer my emotions correctly.

I would imagine that such a tool to infer emotional states would be most useful for autistic people who are as I can attest, somewhat handicapped upon that front. Maybe that will get challenged as disability discrimination by some Autistic group. Which would be interesting. As with most things, there are rules, and exceptions to those rules - no shoe fits everyone, though forcing people to wear the wrong shoe size, can do more harm than good.

    Article 5:
    
    1. The following AI practices shall be prohibited: 
    [...]
    (f) the placing on the market, the putting into service for this specific purpose, or the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons;

> Seems like a mostly reasonable list of things to not let AI do without better safety evals.

Yes. This is how you know that all the people screaming about the EU overregulating and how the EU will miss all that AI innovation haven't even bothered to Google or ask their preferred LLM about the legislation. It's mostly just common sense to avoid EU citizens having their rights or lives decided by blackbox algorithms nobody can explain, be it in a Post Office (UK) scandal style, or US healthcare style.

Me and my euro mates are not interested in this kid of "innovation".

The "business investors" and "innovators" can take this kind of business elsewhere.

This kind of talk where regulators are assaulted by free marketeers and freedom fighters is unacceptable here.

Let us not misinterpret business people as "innovators", if what they do is not net positive for the society, they do not belong here.

A heck of a lot of what passes for "innovation" these days is stuff I absolutely want to stifle.

There is no law that isn't open to interpretation. There is a reason for the judicial branch of government.

People said that about GDPR. Laws that don't leave any room for interpretation are bound to have loopholes that pose unacceptable risk to the population.

surely EU courts will not unfairly penalize US-developed models...

Yes sometimes stuff like this happens. Still, I'd like to think the EU is a prime example for how "reasonable" legislation has benefits over extremely specific legislation. Reasonable wins almost every time with how it fares under changing circumstances and how it's pretty much loop hole proof by design.

Is there somewhere I can read more about this?

the actual text in the ~act~ guidance states:

> Exploitation of vulnerabilities of persons, manipulation and use of subliminal techniques

techcrunch simplified it.

from my reading, it counts if you are intentionally setting out to build a system to manipulate or deceive people.

edit — here’s the actual text from the act, which makes more clear it’s about whether the deception is purposefully intended for malicious reasons

> the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm

Exactly what i thought too.

Right now, for 10 years at least, with targeted advertising, it has been completely normalised and typical to use machine learning to intentionally subliminally manipulate people. I was taught less than 10 years at a top university that machine learning was classified as AI.

It raises many questions. Is it covered by this legislation? Other comments make it sound like they created an exception, so it is not. But then I have to ask, why make such an exception? What is the spirit and intention of the law? How does it make sense to create such an exception? Isn't the truth that the current behaviour of the advertising industry is unacceptable but it's too inconvenient to try to deal with that problem?

Placing the line between acceptable tech and "AI" is going to be completely arbitrary and industry will intentionally make their tech tread on that line.

> What I don't see here is how the EU is actually defining what is and is not considered AI.

Because instead of reading the source, you're reading a sensationalist article.

> That can be a hugely broad category that covers any algorithmic feed or advertising platform.

Again, read the EU AI Act. It's not like it's hidden, or hasn't been available for several years already.

----

We're going to get a repeat of GDPR aren't we? Where 8 years in people arguing about it have never read anything beyond twitter hot takes and sensationalist articles?

If you read the list of unacceptable things they're actually super reasonable and kinda crazy to think american companies will be allowed to (and probably will) participate in

I think in the medium-term future we will have our own real-life Butlerian Jihad against thinking machines. Maybe they won’t be outright banned, but there needs to be some conservative force that pushes back against progress for the sake of “because we can”. Is this legislation premature? Maybe. But I don’t think it will be the last or the the most comprehensive within our lifetimes.

Yeah let's wait until more "AI that tries to infer people’s emotions at work or school." or "AI that manipulates a person’s decisions subliminally or deceptively." are deployed and start spamming crap before making any regulation ...

The "high risk" list is where the breadth comes in

Except government systems for the same. In the Netherlands we had the benefits affaire. A system that attempted to predict people committing benefits crime. Destroying the lives of more than 25,000 people before anyone kicked in.

Do you think they are going to fine their own initiatives out of existence? I don't think so.

However, they also have a completely extrajudicial approach to fighting organised crime. Guaranteed to be using AI approaches on the banned list. But you won't have get any freedom of information request granted investigating anything like that.

For example, any kind of investigation would often involve knowing which person filled a particular role. They won't grant such requests, claiming it involves a person, so it's personally. They won't tell you.

Let's have a few more new laws to provide the citizens please, not government slapp handles.

Why?

Instead of relying on Techcrunch and speculating, you could read sections (33), (42), and (59) of the EU AI Act yourself.

Not a lawyer.

When I attended a conference about this I remember the distinction between "Provider" and "Deployer" being discussed. Providers are manufacturers developing a tool, deployers are professional users making a service available using the tool. A deployer may deploy a provided AI tool/model in a way that falls within the definition of unacceptable risk, and it is (also) the deployer's responsibility to ensure compliance.

The example given was of a university using AI for grading. The university is a deployer, and it is their responsibility to conduct a rights impact assessment before deploying the tool to its internal users.

This was compared to normal EU-style product safety regulation, which is directed at the manufacturer (what would be the provider here): if you make a stuffed toy, don’t put in such and such chemicals, etc. Here, the _application_ of the tool is under scrutiny as well vs just the tool itself. Note that this is based on very hasty notes[0] from the talk - I'm not sure to what extent the provider vs deployer responsibility divide is actually codified in the act.

[0] https://liza.io/ai-act-conference-2024-keynote-notes-navigat...

I fail to see where you stand based on your line by line commentary. Are we not supposed to be against these obvious negatives? Regulation against undesired outcomes needs to start somewhere. Do you believe we should not regulate, simply because we already do some of the things that seem to fall under these individual buckets?

That take doesn't at all engage with the main point of the article: Unacceptable risk.

You could say this about anything.

I know you are trying to reference this quote with regard to guns but I think you are actually disproving the point you are trying to make.

https://vpc.org/press/states-with-strong-gun-laws-and-lower-...

I'll gladly live in a country with no AI at all. Give me Dune post-Butlerian jihad levels of AI outlawing and I'll move there. I strongly believe that myself and all the people living there will be much happier.

> Anything that this regulation doesn't allow is by definition "unacceptable",

That's not true. The regulation first defines high-risk products with a narrow scope (see article 5 and annex III). It then requires risk management to be implemented. It does explicitly state what risks are acceptable, it only requires the "adoption of appropriate and targeted risk management measures" that are effective to the point that the "overall residual risk" of the is "judged to be acceptable".

IANAL, the whole story is a bit more complex. But not by much.

Training that function is not banned. Concentrating information is not banned. I have no idea where you're taking that from.

Only making use (i.e. putting into service a product containing it or placing that product on the market) of that function in a manner that is listed in article 5 (which is quite terse and reasonable) is prohibited unless covered by an exception.

Making use of that function in a manner that may be high-risk (see article 6 and annex III, also quite terse and reasonable) leads to the requirement of either documenting why it isn't high-risk or employing measures to ensure that the risk is acceptable (see article 9, item 5).

IANAL

With thinking like that it's not a far bridge to, "not leaking all your private keys will soon be an unacceptable risk."

Use and development.

I know how to make chemical weapons in two distinct ways using only items found in a perfectly normal domestic kitchen, that doesn't change the fact that chemical weapons are in fact banned.

"""The legal framework will apply to both public and private actors inside and outside the EU as long as the AI system is placed on the Union market, or its use has an impact on people located in the EU.

The obligations can affect both providers (e.g. a developer of a CV-screening tool) and deployers of AI systems (e.g. a bank buying this screening tool). There are certain exemptions to the regulation. Research, development and prototyping activities that take place before an AI system is released on the market are not subject to these regulations. Additionally, AI systems that are exclusively designed for military, defense or national security purposes, are also exempt, regardless of the type of entity carrying out those activities.""" - https://ec.europa.eu/commission/presscorner/detail/en/qanda_...

The law specifically refers to putting a product in to service or placing a product on the market if they are on the prohibited (article 5) or high-risk (article 6, annex III) list and don't have an applicable exception. IANAL, but it's pretty obvious that a set of weights alone clearly is not such a product.

Also note that the law has explicit exceptions for research, development, open source and personal use.

That is explicitly addressed by the regulation. If an AI product is used in a way you describe it, there need to be measures put in place to reduce the risk to an acceptable level. If these measures are missing, it cannot even be put into service. This places the responsibility for the use of AI clearly with either the entity that places the product on the market (i.e. if you sell something in the EU) or that puts it into service (if a EU company uses an AI product across borders remotely). With the required employee AI training, this is further shifted onto the users if done correctly or stays with the employer if not.

> For example, the Act permits law enforcement to use certain systems that collect biometrics in public places if those systems help perform a “targeted search” for, say, an abduction victim, or to help prevent a “specific, substantial, and imminent” threat to life. This exemption requires authorization from the appropriate governing body, and the Act stresses that law enforcement can’t make a decision that “produces an adverse legal effect” on a person solely based on these systems’ outputs.

yes

The actual wording is: "based solely on the profiling of a natural person or on assessing their personality traits and characteristics".

The Techcrunch article oversimplifies and is borderline misleading.

There was a joke:

- Could you tell from an image if a man is gay?

- Depending on what he is doing.

It will be hard to gauge this too if it's all just vectors?

> I'd rather they just didn't use it for any kind of criminal application at all if I have a say in it!

Instead of relying on Techcrunch and speculating, you could read sections (33), (42), and (59) of the EU AI Act yourself.

They don't, Brussels will just produce some 600k undecipherable pages on this topic, waste honest workers money to keep it's bureaucrat caste afloat.

With time this is worsening, the caste is ever bigger, and the system will not change until a WW2 type situation.

More free then America, unless you are billionaire. I mean, American billionaires are trying to export their form of anti-democraric policies, Russia is trying ro export their own fascism etc.

It is not like it was safe democracy. But, it is still one and one that cares more about own citizens then the rest. Maybe except Canada.

That’s what nearly all UE regulation is. Most of these regulators are on the payroll of 200 year old companies who maintain their control of the economy by preventing any real challengers from rising.

> Here is what happened in most corporations when GDPR came out

Do you have a source on that, or is this what you feel like may have happened? The move to the cloud was in full swing way before GDPR came out in 2016 and got enacted in 2018. Same for outsourcing.

Since GDPR came out I’ve been able to download all data that the big companies have on me, and delete it too. I’m happy for it.

It is not true. If you outsource, GDPR applies all the same. And companies had to literally implement changes into their software and literally did.

GDPR applies to data in cloud too.

The usage covering "unacceptable risk" is stuff that's either illegal or heavily regulated already in human operation too.

> Also, this kind of laws would make Europeans to stay at the loser side of the AI competition as China and mostly every US corporation doesn't care about that.

Not sure that's a game I want to win.

European politicians dont understand anything. We are led by utter morons. And redditors here complain about trump, I'd much rather have him than these mouthbreathers we have.

> There is no way a law like that can be enforced except by large companies.

Other fields have very similar laws in the EU and there's lots of tiny companies able to comply with those. The risk control required by this law is the same that's required by so many other EU laws. Most companies that make high-risk products have no problem at all implementing that.

> It's so naive to think that Meta/Google(Youtube) doesn't have power to manipulate people's opinion

We have that here too, except in our case it’s the government using the good old fashioned medium of television.

Actually thinking what advanced AI could do with say Meta. It could be used to rewrite the content for each user. And not even tell that they are doing it. AI proponents see nothing wrong with it. Why not allow Meta for instance change negative experiences with restaurants to positive ones. Or modify political statements made by some sides...

Actually that could be an interesting case... except if Twitter can show that its algorithm is "deterministic"

Are they using AI for that? algorithmic doesn't necessarily mean AI

> unacceptable risk applications — the focus of this month’s compliance requirements — will be prohibited entirely. Some of the unacceptable activities include:

…

what follows is a list of some pretty nasty and insidious use cases.

it’s not “AI is completely banned”, it’s “consider the use cases you are working on responsibly”. only for those specific use cases, mind you.

for all other use cases not in the list, which is a significantly larger subset of development, just ensure you do the required safety/regulatory sign off work.

just like when we get our SaaS webapps evaluated for compliance to security standards, its just a box ticking exercise for the most part.

I actually like it, moving to EU is currently my back-up plan when “great advances in AI” renders the rest of the world to make people loose jobs, give up privacy and overall make dystopian future a present. I’ll be happily coding my boilerplate code by hand, enjoying my boring life without AI.

That doesn't seem obvious to me. Would you mind elaborating?

[flagged]

That's petty much what's going to happen in the US isn't it ? We'll be able to compare very soon

as a german, yea pretty much.

[flagged]

It's great Americans criticize the EU. I just wish they did more than (paraphrasing) "EU sucks, lol." Wouldn't hurt being a bit more constructive.

Can you elaborate specifically what you think makes this law so detrimental? And to who?

You might be looking in the mirror

ah yes countries doing their job of trying to protect their are a dystopia, sure

Ah yes, the worst of all the dystopias: The one where companies can't fuck people over as much as they'd like to. Truly a horror scenario for any tech billionaire.

It's really sad what happened to EU after von der Leyen took over. Someone must stop here and the EU commission or we will fall even more into irrelevance.

From the act:

> to assess or predict the risk of a natural person committing a criminal offence, based solely on the profiling of a natural person or on assessing their personality traits and characteristics;

more details in recital 42: https://artificialintelligenceact.eu/recital/42/