Governments respond and Big Tech reacts

A review of AI legislation, policy and guidelines and the delicate dance between Innovation and Regulation.

Summary Overall the global emphasis is on safety, but this falls short of other priorities for the development of AI where we don’t think there is enough focus. This is Article Two in a series for the Charismatic.ai project. The first article is published here.

AI hasn’t emerged in a vacuum. In the UK, it’s been subject to a variety of legal instruments: general data protection regulation (GDPR), competition laws, product safety laws, consumer regulation, employment laws, financial services regulation and medical devices regulation. In many countries around the world, similar regulations are in place.

However, AI isn’t like other technologies and consists of a unique set of features that when combined, makes it different. AI systems can be automated and they can self-learn. They can be plugged into the open and accessible Internet resulting in outputs that can be scaled with ease. They contain huge data sets (of which the complexity and provenance are not always clear) and are internally governed by complex algorithms. Combined, these features can be directed towards advancing innovations in every industry you can think of; from healthcare and transport to media, government services and banking. However it can also bring about harms to individuals, communities and the environment that aren’t covered by existing laws. This includes (i) data and privacy issues like how personal data may be used in machine learning models and its outputs, (ii) bias and discrimination that could result in some groups of people being unfairly treated, (iii) AI systems that operate like a black box which makes it difficult, if not impossible, to apply standards so that technology owners can be held accountable and the (iv) disruptions to democracy like election tampering through the creation of misinformation and deep fakes and (v) other economic and social disruptions like job displacement, financial scams and fraud, and devastating impacts on mental health.

To minimise the frequency and severity of these harms, governments around the world are reacting using a variety of vehicles available to them. These include, but are not limited to, ethical principles and guidelines, advisory bodies, the development of public-funded AI units, offices or safety centers, commissioning research, supporting national regulators to develop sector specific regulatory responses and the creation of new AI-specific legislation.

The European Union

The European Union, with its 27 member states, has led the world on the creation of new AI-specific legislation with the development of the AI Act. In official communications, the EU say that they have implemented this legislation because their aim is to “ensure that AI is safe and trustworthy.” The first legislation of its kind, it categorises AI systems according to risk: unacceptable risk (e.g. cognitive behavioural manipulation of people, social scoring etc.) and high risk (e.g. AI systems used in products like toys, medical devices, cars etc.). With only a few exceptions, companies that create high-risk systems will have to register the name of the company and their system in an EU database. During the development of the Act, generative AI developers were concerned that their systems would fall into the high risk categories. The final wording in the Act has been drafted to say that while generative AI, like ChatGPT or Stability AI, is not classified as high risk they do have to comply with the EU’s transparency requirements and copyright law. This includes:

• Disclosing that the content was generated by AI

• Designing the model to prevent it from generating illegal content

• Publishing summaries of copyrighted data used for training
  

Alongside the launch of the EU AI Act, the European Commission established the European AI Office. The EU AI Office looks to become the centre of AI expertise across the EU and play an essential role in implementing the AI Act and look to foster international cooperation. This is starting to play out with the announcements of official administrative arrangements like the one that was announced in November 2024 between the EU’s AI Office and Singapore’s AI Safety Institute.

Australia

The AI Act has inspired other governments to begin thinking of AI in a risk-centric way. In June 2023, the Australian Government released a discussion paper and public consultation titled Safe and Responsible AI in Australia. In response to the consultation, the Federal Government committed to a “risk-based” approach to manage AI concerns. Further to this, after nine months of hearings, the Select Committee on Adopting Artificial Intelligence (AI) established by the Parliament of Australia, issued a report in November 2024 containing 13 recommendations. The first recommendation is that the “Australian Government introduce new, whole-of-economy, dedicated legislation to regulate high-risk uses of AI.” Recommendation 4 relates to increasing both financial and non-financial support to develop AI capability in Australia. In the interests of this paper, recommendations 8, 9 and 10 are particularly important to detail in full as they relate specifically to the creative industries and are described in such a way that other Governments haven’t noted to date. They are as follows:

• Recommendation 8: That the Australian Government continue to consult with creative workers, rights holders and their representative organisations through the CAIRG on appropriate solutions to the unprecedented theft of their work by multinational tech companies operating within Australia.

• Recommendation 9: That the Australian Government require the developers of AI products to be transparent about the use of copyrighted works in their training datasets, and that the use of such works is appropriately licenced and paid for.

• Recommendation 10: That the Australian Government urgently undertake further consultation with the creative industry to consider an appropriate mechanism to ensure fair remuneration is paid to creators for commercial AI-generated outputs based on copyrighted material used to train AI systems.

At the time of writing, this was an ongoing discussion within the Australian government and next steps on whether recommendations would be implemented or how, had yet to be published.

Canada

Canada claims the title of the first country in the world to publish an AI strategy, in 2017. While there is no regulatory framework specific to AI, one is on the way. The Artificial Intelligence and Data Act (AIDA), introduced as part of the Digital Charter Implementation Act (2022), will set out “new requirements for businesses to ensure the safety and fairness of high-impact AI systems” across design, development and deployment.

Definitions of AI and other concepts within AIDA align with those in the EU’s AI Act as well as OECD documents. AIDA proposes a risk-based approach to ensure that AI is developed and deployed responsibly in Canada. While the new Act is not expected to go live till 2025, a voluntary Code of Conduct named The Responsible Development and Management of Advanced Generative AI Systems was announced in September 2023. The Code of Conduct asks developers of these systems to undertake a voluntary commitment to meet particular outcomes relating to the principles of accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness.

United States

In the United States, home to Silicon Valley, a Federal approach to regulating AI doesn’t exist. Rather individual states are tackling context-dependent risks in a targeted way. A key issue is around hiring practices in the labour market.

In California, a proposed bill would make it illegal to use automated-decision-making systems during the hiring process if the systems discriminate based on protected characteristics. In New York City, companies who use AI and machine learning technology in their hiring process are required to notify candidates that these systems are being used. New York City also requires organisations using these advanced technologies in hiring practices and employment decisions to comply with annual audits to check for bias. In the state of Illinois, the Artificial Intelligence Video Interview Act, requires “employers to notify job applicants and obtain consent before using AI to analyze recorded video interview submissions.” In addition, after an amendment was passed to the Illinois Human Rights Act, employers will be prohibited from “using AI that subjects employees to discrimination on the basis of a protected class.” This amendment goes into effect on 1 January 2026. Similar bills and amendments, like these passed in New York City and Illinois, are being debated in Massachusetts, New Jersey, New York, Rhode Island, Virginia, and Washington D.C.

In October 2023, President Biden issued an Executive Order (EO) – Safe, Secure and Trustworthy Development and Use of Artificial Intelligence – that charged executive departments and agencies with adhering to a set of principles to advance “a coordinated, Federal Government-wide approach” that would support the safe and responsible development and use of AI. These principles ask government colleagues to essentially meet a minimum standard when engaging in AI-related activities. These principles relate to: (i) safety and security, (ii) promoting responsible innovation, competition and collaboration, (iv) a commitment to support American workers, (v) advancing equity and civil rights, (vi) respecting and upholding consumer protections, (vii) protecting Americans’ privacy and civil liberties, (viii) increasing the Federal Government’s internal capacity of responsible use of AI and (ix) ensuring effective leadership so that the Federal Government can “lead the way to global societal, economic, and technological progress.” The EO also stated that guidelines and resources also be created including one relating to risk management for generative AI, guidance and benchmarks for evaluating and auditing AI capabilities, and conducting red-teaming tests.

With no comprehensive data privacy legislation existing at the national level, more US states are also expected to adopt data privacy laws which will afford individuals rights applicable to the collection and use of personal data by businesses. 20 states including California, Colorado, Texas and Virginia have implemented comprehensive data privacy legislation that applies to businesses regardless of industry and details data rights like the right to access, delete, correct and opt out. Nevada, Washington, New York, Michigan, Vermont and Maine have introduced consumer privacy bills that aim to protect individuals on a narrower range of data issues. These include giving extra protections to biometric identifiers and health data, or ensuring the activities of data brokers and internet service providers meet certain thresholds and standards.

At the time of writing, Donald Trump had won the US election for the second time. His campaign was supported by tech founders and investors including Elon Musk, Marc Andreessen and Ben Horowitz, Cameron and Tyler Winklevoss – twin brothers who have become bitcoin billionaires. Biden’s administration and Democrats have previously criticised Silicon Valley for “self-preferencing” their own products and services to customers and weakening the visibility of competitors as well as not doing enough to protect children and teens on their platforms. Considering Trump’s own use of social media to connect with and build his base, many assumed that Trump would take the opposite approach to tech regulation. Then in July 2024, The Post had seen a drafted order compiled by allies of Trump that would boost use of technology in the military and reduce AI regulations. This assumes that Trump would repeal Biden’s EO. Trump takes office of the US Presidency on 20 January 2025.

United Kingdom

In the UK, the Government has opted to take an adaptive approach to AI regulation. This was laid out in the published whitepaper, A pro-innovation approach to AI regulation. The approach aims to balance innovation and speed of change while ensuring that context-appropriate measures are put in place to address safety and risk concerns. The approach empowers regulators to create bespoke measures to the various risks and needs that may arise when AI intersects with different sectors. The Government does outline five principles that UK regulators must interpret and apply when creating their bespoke measures. These principles are:

1. Safety, security and robustness

2. Appropriate transparency and explainability

3. Fairness

4. Accountability and governance

5. Contestability and redress

In response to the outlined approach to regulation, the Centre for Data Ethics and Innovation was renamed and is now known as the Responsible Technology Adoption Unit (RTA). A directorate within the Department for Science, Innovation and Technology, the RTA “leads the Government’s work to enable trustworthy innovation using data and artificial intelligence (AI)”. They have since published AI assurance guidance and a toolkit, a searchable database so that the public can find algorithmic transparency records from UK public sector organisations with information on algorithmic tools used in decision making, a model for responsible innovation as well as other guidance. The final important development in the UK landscape worth highlighting is the creation of the AI Safety Institute. This took place following the hosting of the AI Safety Summit in November 2023. The Institute conducts research and builds infrastructure to test the safety of advanced AI, measure the impacts on society, work with researchers, developers and governments to affect how AI is developed, and shape global policymaking on AI and its impacts.

China

Perhaps not surprisingly, the approach being carried out in China is quite different to those being pursued in the West. Instead of relying on regulators or taking a risk-based approach to AI, China is rolling out a technology-specific governance strategy. However, the governing and assurance measures are not radically different to that in the West. Data privacy laws are in place, so too are fines for non-compliance. Ethical principles that feature upholding some similar values and rights are documented, and there are call-outs specifically to children, the elderly, the sick and those employees who work shift work and whose schedules are calculated and assigned by an automated system. Similarly as in the EU, algorithms need to be filed and registered, and providers need to complete a security self-assessment.

In China, a blueprint charting the country’s approach to developing and implementing AI was published early. In 2017, China’s State Council published the New Generation AI Development Plan in which three strategic objectives relating to national capability are documented. The paper states that by 2025, China aims to achieve major breakthroughs in basic theories for AI, that some technologies and applications become world-leading and that AI will become the main driving force for the country’s next transformation. According to a June 2024 Economist article, Tsinghua University (Beijing) is the number one science and technology university in the world. China now contributes to around 40% of the world’s research papers on AI, compared with around 10% for America and 15% for the EU and Britain combined and the country has a significant lead in the areas of computer vision and robotics. By 2030, China’s ambitions are to be the world’s primary AI innovation center.

Since publishing their 2017 AI Development Plan, various committees and departments have published a number of regulatory and legal instruments. Some of these include ethical norms and principles which lists six ethical requirements: (1) advancement of human welfare, (2) promotion of fairness and justice, (3) protection of privacy and security, (4) assurance of controllability and trustworthiness, (5) strengthening of accountability, and (6) improvements to the cultivation of ethics. In addition, 18 specific ethical requirements are put forward too. These 18 requirements relate to (a) Management, (b) R&D, (c) Supply and (d) Use norms.

Provisions on the Administration of Deep Synthesis Internet Information Services outlines the rules regarding deep synthesis or deep fake technology. The rules include that users of deep synthesis services must have their identity verified before using the platform and where they are looking to mimic the biometrics of a living person, they are expected to gain consent of the individual in question. The Interim Measures for the Management of Generative Artificial Intelligence Services covers similar ground to the provisions on deep fake technology but is directed toward public-facing generative AI services. Content created by generative and deep fake systems must not subvert state power, incite secession, harm national unity or disturb the economic or social order. In addition, socialist values must be upheld and fostered. Should users create illegal content, services are required to issue warnings, suspend or terminate use. Services are required to 'guide' adult users to use the service rationally to try to curb addiction (in 2021, video games were branded “spiritual opium” by a state media article) and implement methods to prevent addiction and overreliance amongst minors. When content doesn't comply, the Government suggests measures like filtering and optimisation training within three months of things going awry, issuing warnings, suspending or terminating rebellious individuals from using the service.

In the Guiding Opinions on Strengthening Overall Governance of Internet Information Service Algorithms (September 2021), the document lays out general guidance for the regulation of online algorithms. Recommendations include adhering to the "guiding ideology" of the Chinese state and "basic principles" which include upholding rule of law, risk prevention and control, protection of rights, technological innovation and protect algorithm intellectual property rights. Within the Provisions on the Management of Algorithmic Recommendations in Internet Information Services, the first major binding regulation on algorithms published in December 2021, it’s clear the guidance has informed the actions of the State. In chapter 4 on Oversight and Management states that within 10 days of service, algorithms need to be filed and registered, and providers need to complete a security self-assessment. Chapter 5 outlines the legal responsibility of providers and states punishments through fines, sanctions and criminal proceedings if wrongdoing is reported or found. Earlier in the same document, it states that algorithmic service providers have a responsibility to protect the privacy of users and to operate in a transparent and fair way.

A final interesting point to make is that the days of Chinese companies indiscriminately using personal data has come to an end. Private sector companies have to acquire the consent of individuals and will be held responsible if they are found to have handled personal data in a negligent way.

Can China control AI and bend it to its will? It has yet to be seen how the law will be wielded on future AI developments but Xi Jinping and his party are definitely giving it their best shot.

The best AI is safe AI

Overwhelmingly, the most often repeated value that nation states say they desire from AI is ‘safety.’ Safe AI isn’t ever clearly defined in policy documents but rather ‘safety’ is presented as an essential value that is often made distinct from security or robustness. While not defined, safe AI is often presented as being the outcome that will emerge if other values and principles like security, transparency and fairness are carried out.

In response to government activity, private sector tech firms have been busy creating their own governance models, principles and ethics frameworks too. When placed side-by-side with national policy and legislation, a clear mirroring effect emerges and the value of safety appears again and again and again. One also sees the repeated phrase of “responsible AI” because, it's an easy leap to make, you can trust a responsible person not to be reckless. You can leave big tasks and challenges to responsible people because they are a safe pair of hands. This seems to be the reputation that technology firms are attempting to build for themselves.

Open AI says the approach they’re taking is one that prioritises “safety at every step” and that they are “leading the way in Safety.” On the “issues that matter most” they report working with “industry leaders” and “policymakers”. These include child safety, protecting private information, deep fakes and “improving transparency in AI content”, avoiding reinforcing bias or stereotypes, and “combating misinformation” that could interfere with elections. Microsoft’s six “Responsible AI Principles” are to be used to “to create responsible and trustworthy AI” and in part demonstrates that “Microsoft commits to empowering responsible AI practices.” The principles include fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability. Meta believes that “AI should benefit everyone.” To ensure this, they document five pillars of “responsible AI” that inform their work. These include privacy and security, fairness and inclusion, transparency and control, accountability and governance and the final pillar, robustness and safety. Meta also notes that they make “safety tools accessible to everyone” and by doing so they enable developers, advance safety and build an open ecosystem. Anthropic go so far as to use safety as a value to describe not only what they do, but who they are. They say, ​​"Anthropic is an AI safety and research company. We build reliable, interpretable, and steerable AI systems" and they do this through "AI research and products that put safety at the frontier."

Google has seven AI principles that they say describes their “commitment to developing technology responsibly and work to establish specific application areas we will not pursue." These principles are:

1. Be socially beneficial

2. Avoid creating or reinforcing unfair bias

3. Be built and tested for safety

4. Be accountable to people

5. Incorporate privacy design principles

6. Uphold high standards of scientific excellence

7. Be made available for uses that accord with these principles

Stability has an entire page on their website dedicated to safety. Titled, Stable Safety, Stability states that they are “advancing safe and transparent AI with open models” and that they take an “open-first and safety by design approach with all their models.” Not only do they have principles, but they have branded them “Our Safety Principles”. These are:

1. Safety-first open source

2. Banning AI misuse

3. Expert collaboration

4. Ensuring data integrity

5. Transparent AI content

6. Encouraging responsible use

Adobe is the only major player in this space to break with the pack and focus on three principles, being accountability, transparency and responsibility. Documented within their ethical approach to AI they write, “Adobe is committed to developing generative AI responsibly, with creators at the centre.”

Reading the various approaches to AI development by the ‘big tech’ players, it seems clear that they’re prioritising the concerns of government stakeholders above all others. The issues presented, language used to describe the issues and principles most prized are clearly trying to satisfy an audience of law- and policymakers. Adobe is the only company to call out a particular community – “creators everywhere” – in their ethics documentation. Other tech firms talk about affected stakeholders and communities as a homogenous collective using language such as “humanity”, “people”, “everyone” and “society” but there is no evidence of whether they know or understand what this collective, or indeed the communities contained within the collective, wants, needs or is concerned about when it comes to developing AI or the values embedded within it. This doesn’t seem to put them at a disadvantage. Discussing “humanity” as a homogenous group seems to benefit tech communities when making their case to national governments as the sentiment is essentially, we are responsible technology providers who develop AI products that are safe for everyone. However we know that the effects of AI technologies do not impact all groups or all individuals equally but rather, certain effects have a disproportionate impact on some communities over others. The impact that generative AI tools have on storytellers and content producers being able to earn a living, and thrive, from these professions is a good case in point.

While safety should of course be a priority when developing AI, many headlines and concerns represent a different kind of safety and security. Loss of income, job displacement and job losses are all fears – and ethical issues – facing individuals across many industries but generative AI is making job security an urgent issue for those in the content and storytelling industries. Concerns about technology taking jobs isn’t new and can be traced back to the 19th century luddites, but this is cold comfort to anyone whose job is on the line. While a swathe of new laws help to protect societies from some new and urgent risks brought about by AI, the new reforms currently do little to help answer the question, Is my job safe from AI?

With AI hitting the headlines so often, it doesn’t feel surprising that self-reported awareness and understanding of AI is now very high in the UK and that it increased notably in just a single year from 2023 to 2024. The UK Government’s Public Attitudes to Data and AI Tracker Survey (wave 3) found that negative and neutral associations with AI are far more prevalent than positive associations. It seems that the more aware the public has become of AI and the more they understand it, the more likely they are to perceive it negatively. When individuals were asked to provide one word that best represented how they felt about AI, the most common word was ‘scary’. The words ‘worry’ and ‘unsure’ were also frequently mentioned. When questioned about the perceived impact that AI will have on society, these words were given additional context – suddenly what was scary, what they worried about and what they were unsure of came to light.

43% of respondents, that’s more than 2 in 5 people, said that AI will negatively influence job opportunities for people like them. Non-graduates (48%) were more likely than graduates (41%) to view job displacement as one of the greatest risks of AI.

When asked about the risks that AI poses to society, two of the most frequently selected risks are to do with jobs and skills. 45% said job displacement due to AI and 35% said the potential loss of human creativity and problem-solving skills. Additional risks include humans losing control over AI (34%), AI being used for cyber-crime and terrorism (23%), AI making decisions that humans can’t understand or explain (23%), and AI being biased and leading to unfair outcomes (14%). Based on this research, the public appears to believe that efforts should be directed towards developing safe, explainable and fair AI but that human economic empowerment and the valuing of human skills should be protected too.

And this is where there is a peculiar twist in the story.

With governments so tremendously focused on safety, you would be forgiven for thinking that nothing else mattered. But there are other values that are mentioned along with safety that could help to counter the risks of job displacement and loss of human creativity and problem-solving skills; and those are innovation and productivity. The EU says that they want the measures they are taking to “strengthen uptake, investment and innovation in AI across the EU.” The Coalition members who wrote the report Safe and Responsible AI in Australia state the AI policy framework must offer safeguards “without infringing on the potential opportunities that AI presents in relation to job creation and productivity growth.” In the Executive Order issued by the Biden administration it states, “Artificial intelligence (AI) holds extraordinary potential for both promise and peril. Responsible AI use has the potential to help solve urgent challenges while making our world more prosperous, productive, innovative, and secure.” Finding instances of this kind of language and expressed intention is not difficult.

So what are governments doing to support growth in productivity and allow innovation to flourish? As we’ll discuss in the next article, not enough.

This post first appeared on Charismatic's Substack.