Der EU AI Act: Motor oder Bremse für Forschung und Innovation?

Meiner Meinung ist der EU AI Act eine von Angst getriebene Regulierung, die die Chancen dieser Technologie beiseite lässt. Das Regelwerk geht sehr weit und umfasst auch Aspekte, die aus wissenschaftlicher Sicht gar nicht unter AI fallen – hier wird quasi versucht, die Computerwelt zu regulieren.  

Dabei gibt es gar keine große Regulierungslücke für KI-Systeme. KI-Anwendungen in Autos oder Flugzeugen, die echte Gefahren für Leib und Leben bergen, sind aus gutem Grund längst reguliert.  

Die Kontrolle einer Technologie für eine einzelne, bestimmte Anwendung nennt man vertikale Regulierung. Der EU AI Act dagegen will die gesamte KI-Technologie quer für alle denkbaren Anwendungen regulieren, also horizontal. Das wird zwangsläufig zu zusätzlichen und konfliktbehafteten Regulierungen führen. Im Vergleich zu China und den USA hat die EU, wenn es um den Transfers von KI-Technologie in die Wirtschaft geht, eine Lücke. Diese schließen wir nicht durch mehr Regulierung, sondern durch gesteigerte Innovation. 

Die Universitäten sind vom EU AI Act nicht direkt betroffen. Die Forschung ist vom Gesetz erst einmal ausgenommen. Die Hochschulen sind jedoch davon betroffen, wenn sie KI in der Lehre oder in ihrer Wertschöpfungskette einsetzen. Und wenn Unternehmen weniger Drittmittelprojekte finanzieren, weil das EU-Gesetz die Kommerzialisierung von Forschungsergebnissen erschwert, werden die Firmen Forschung gar nicht mehr oder außerhalb der EU finanzieren – etwa in Großbritannien. Das kann dann auch die Universitäten in Europa bremsen.  

Ich beobachte schon jetzt eine zunehmende Unsicherheit in Mittelstand und Großkonzernen hinsichtlich der Konsequenzen des Gesetzes. Ähnlich wie zuvor bei der Datenschutzverordnung sind auch im AI Act viele Definitionen unklar und schaffen viel Interpretationsspielraum. Ich hätte mir ein kürzeres, präziseres Gesetz gewünscht. Ein 140-Seiten-Werk helfen weder der Wissenschaft noch der Wettbewerbsfähigkeit. 

Mein Wunsch wäre, dass die EU in der nächsten Legislaturperiode vor allem Innovation massiv fördert. Dabei geht es nicht nur um deutlich höhere Fördersummen, sondern auch um die Verteilungsprozeduren. Für Wissenschaftler muss es einfacher werden, Fördergelder zu beantragen. Die Bewilligung muss ebenfalls schneller erfolgen. Man wartet mitunter heute Jahre auf Fördermittel für ein Projekt – da müsste die EU ganz neu denken. Rechenzeit ist sehr teuer; die öffentliche Finanzierung von mehr Rechenzentren finanzieren sowie Investitionen in Open Source-Entwicklung wären ebenfalls willkommen, damit alle die Technologien nutzen können.  

Das Potential von KI ist in Europa enorm, ob in Maschinenbau und produzierendem Gewerbe. AI könnte auch den Fachkräftemangel lindern, den wir in Europa besonders spüren, zum Beispiel im Gesundheitsbereich. KI kann Ärzte bei Diagnosen und Therapieentscheidungen unterstützen, indem sie Millionen Fälle miteinander vergleicht, so dass den Medizinern mehr Zeit für die Kommunikation mit Patienten bleibt. 

As a researcher in ethical AI, what I like most is the attempt to put some order in the rather complex world of AI. By focusing on the intended use of an AI application (art. 5) or on the domain in which the AI application is applied (art. 6), the act somewhat clarifies when AI can have a negative impact on the lives of European citizens.  

This is far from a perfect classification, as the many opinions by stakeholders have shown. But it is an important first step and the Act contains mechanisms for regularly reviewing and updating the applications falling under the above articles. 

It is important especially when considering the alternative, which is to allow the market to regulate itself with the help of guidelines and recommendations. The European AI ethical guidelines have tried to create a voluntarily based approach and some companies have employed ethical officers to supervise the ethical aspects of AI. Nevertheless, when ethical constraints have contradicted economic targets, the latter ones usually won. 

With the Act, providers of certain AI applications now must prove, via assessments, monitoring and reporting, that the systems minimize negative effects to the rights of European citizens. 

In my opinion, the Act is still falling short of regulating AI. It tries to balance innovation and fundamental rights by focusing on certain application domains or intentions only. In a way, it tries to highlight greater violations of rights but ignores smaller ones. For example, online advertising does not seem to fall within the higher risk domains (unless it falls under art 5(1)(a) and may cause physical or psychological harm). But, the use of AI can change human economic behavior, which seems to violate the right to freedom of thought. 

While the AI Act mentions fines and other remedies in case of violations, the compliance itself is mostly expected to be done by the AI providers. This is similar to the obligations in the GDPR. On the one hand, data protection has greatly improved since the introduction of the GDPR in 2018. But violations are still common. Many of the violations are a result of a lack of knowledge or resources and it does not seem that compliance with the AI Act will be any different. 

On the other hand, the GDPR gives citizens specific rights, such as the right to be informed or the right of access. Within these rights, there are mechanisms for citizens to protect their data. The rights in the AI Act, on the other hand, are less of a personal nature. For example, the right for transparency to know when a user interacts with AI and the right to human oversight, which demands in some situations the involvement of humans in decision processes, do not directly help a specific person to avoid possible harm. A personal right, such as the right to ask a provider to not be subjected to the application of specific AI algorithms, does not seem to be included in the AI Act. 

Among the AI properties deemed most controversial are possible inaccuracy and lack of explain ability. If a user could trust decisions by AI applications to be fully accurate, and in addition, to know exactly what affected those decisions, the risk of the application having negative effects is greatly reduced. 

Nevertheless, AI applications can be made fully accurate and highly explainable. The technology is there and is proven. In my opinion, it is only a matter of cost. 

This balance between risk and cost seems to drive the focus on specific intentions and application domains. If the cost would decrease, more AI applications might fall under greater regulation, thus increasing the benefit of the general public. 

Still, most research and technological advancements keep focusing on increasing accuracy and explain ability instead of guaranteeing them. The reason for that, besides cost, is that there is a misconception among the public, and even among some researchers, about what AI really is. A common error is to synonym AI with Machine Learning, which is based on statistical inference and can therefore always make mistakes and is hard to explain by nature.  

Another form of AI - Machine Reasoning - has been used for decades in high-risk domains such as train scheduling. The reasons for its use in such domains are that it is more accurate than humans and more explainable, thus increasing the safety of such systems. 

Since AI is here to stay, I believe that an important thing right now is to acknowledge that AI can be used with low risk to the rights of European citizens, even in domains deemed currently of high risk. This acknowledgement can lead to investing resources in developing efficient ethical AI solutions that can compete with less ethical, but more economically viable ones. 

I like the fact that the EU AI Act is expected to include provisions exempting AI systems developed or used exclusively for research and development purposes from some of the more stringent requirements. This will allow researchers to experiment and test AI technologies without the full burden of compliance associated with high-risk applications, provided that appropriate safeguards are in place to manage the risks.  

I also like the fact that the Act may encourage the use of regulatory sandboxes, which are controlled environments where innovative technologies can be tested under regulatory oversight. This is a relatively new approach that will allow researchers to develop and test AI systems with more flexibility in terms of regulatory compliance. Yet it still ensures oversight and safety and allows regulators to adapt the existing regulatory framework to let new innovative technologies emerge. The latter will be an important element of the AI regulation debate for years to come.  

This is very much in the nature of LIST, a public research and technology organization with a strong track record of working with different regulators to develop technologies to assess the compliance and risks associated with new regulatory frameworks. 

While it is important for Europe to be a "regulatory superpower", it should also show the ambition to become a "knowledge and technology superpower". Today, Europe (and Luxembourg) are lagging behind the US and China in AI RDI. President Macron famously said that while the US has GAFA (Google, Apple, Facebook and Amazon) and China has BATX (Baidu, Alibaba, Tencent and Xiaomi), Europe has the GDPR (General Data Protection Regulation). A similar joke could be made about the AI Act. That's why I believe our government should push for "moonshot initiatives" to promote AI excellence.  

This should be done both at the national level, starting with the recognition of AI as a national research priority, and at the European level, where Luxembourg should join forces with other EU countries to reach the critical mass needed to compete globally. The example of the Chips Act is instructive: this is not a law to regulate chip production, but a political initiative to stimulate European RDI in the semiconductor sector with a public investment of more than 43 billion euros, thus reducing our strategic dependence on other countries. As AI has clearly become a strategic technology, the same should be done for it. 

First, we need to democratize access to AI. On the technological side, LIST is contributing with its BESSER project, supported by the FNR. This project creates an open-source low-code and no-code platform that allows people with little or no programming skills to build software that embeds AI solutions more quickly. On the education side, we need to work along two dimensions: In schools, where AI needs to be used to improve learning, for example through personalized tutoring, and where students need to be taught how to use new tools like ChatGPT responsibly. And in continuing education, where we need to up-skill and re-skill workers and citizens to use AI. 

Second, we need to address the public's fears and concerns about AI. I believe that civil society will have an important role to play in this, and that a public centre full of technical talent like the LIST should be part of a civil society movement to monitor the use of AI. In fact, we are already working in this direction and have developed the first prototype of an AI sandbox that will allow large language models, such as Open AI's GPT-4 or Mistral AI’s Mistral 7B, to be tested against a range of ethical concerns (race, age, gender bias, etc.), thus allowing the public to understand the limits of these technologies.