Something I have a hard time understanding is why does the EU focus on one singular bill for large and complex topics such as privacy and AI? Instead of (pardon the pun) one big beautiful bill, perhaps we should explore many, multi-tier approaches. Perhaps we should focus on finding out some core central metrics, and work with those. Instead of the old separation between private business vs. public business, or small vs big enterprise, we should focus on finding more separation points, and work them into the laws. Say "impact" (hard to define but we should try?), average monthly users, domain of activity, scale, b2c vs. b2b and so on.
A few examples off the top of my head:
- there's a huge difference between the AI Act's interpretation of "AI shall not take automated decisions" when applied to BigBadCorp using AI to filter CVs, vs. SmallGoodStartup using AI to decide when you should move to the next spanish lesson. I know the example is contrived, but under the law both would be treated the same, when they have very different impact potentials, imo.
- there's a huge difference between GDPR's "gathering data for optimising internal processes" between BigBadSearch engine tracking everything they can about a user so they can sell them more ads vs. SmallTechnicalStartup wanting to track usage of their platform so they can improve results on their plant health tracking platform. Again, the impact on data gathering is miles away in this (contrived) example.
yorwba · 16h ago
The AI Act isn't just a one-size-fits all solution, but classifies many different scenarios and the requirements for each one. "Assessing the appropriate level of education for an individual and materially influencing the level of education and training that individuals will receive" is indeed classified as high-risk, but if SmallGoodStartup thinks their clever system for detecting which regional variety of Spanish a student is using is actually low-risk, they can just write up their assessment and don't need to bother with ongoing human oversight or quality management and all that jazz. It would be a bit embarrassing though if they were to miss that students making lots of mistakes get matched to lessons of the "full of mistakes" variety, providing negative educational value.
A few examples off the top of my head:
- there's a huge difference between the AI Act's interpretation of "AI shall not take automated decisions" when applied to BigBadCorp using AI to filter CVs, vs. SmallGoodStartup using AI to decide when you should move to the next spanish lesson. I know the example is contrived, but under the law both would be treated the same, when they have very different impact potentials, imo.
- there's a huge difference between GDPR's "gathering data for optimising internal processes" between BigBadSearch engine tracking everything they can about a user so they can sell them more ads vs. SmallTechnicalStartup wanting to track usage of their platform so they can improve results on their plant health tracking platform. Again, the impact on data gathering is miles away in this (contrived) example.