• The European Commission is at the draft stage and a proper set of rules will be pushed forward in the coming weeks 
• The proposed law is especially down on attempts to use AI to ‘rank’ social behaviour
• The AI Regulation is very much a follow-up to the EU’s GDPR (General Data Protection Regulation) 

The European Commission is at the draft stage of a set of regulations designed to restrict the use of AI for ‘indiscriminate surveillance’ or for what it terms ‘ranking social behaviour’. The Commission is believed to be poised to push forward with the regulation in the coming weeks.

What’s proposed is not a ‘nudge’ exercise with accompanying guidelines and exhortations to observe social responsibility, but an attempt to construct a full-on, teeth-bared set of fairness rules with vigorous enforcement and swingeing penalties (up to 4% of global revenue) for organisations which dare to flout them. 

The essentials of the proposed regulations will ban organisations operating in the EU from using AI to track individuals in physical environments or to aggregate location data from other sources to the same ends. 

Out too, go algorithms that attempt to judge personal trustworthiness based on social behaviour or predicted personality traits. If machines aren’t able to discriminate based on ‘predicted’ personality traits, the supervisor who turned me down for a student holiday job on the basis that I was a Gemini (“Oh no, we’ve already got one of those,” she said, “can’t have two”) should also be in big trouble.

Lots of ‘no-nos’

The draft also proposes banning systems that are deployed to exploit information about groups of people.

Other AI cases coming under the proposed rules include biometric identification systems in public spaces, which will require special authorisation. 

What’s termed ‘high risk’ AI also gets special attention: these include recruitment algorithms, crime-predicting algorithms, systems deployed for evaluating credit worthiness, and those used for establishing priority in the dispatching of emergency services and systems deployed as safety components in essential public infrastructure networks, including roads and the supply of electricity, water, and gas.

Some exemptions are planned, including the use of AI exclusively for military purposes, as well as for safeguarding public security. 

From a privacy point of view, the worry is that these exemptions may also protect the use of AI in mass surveillance by law enforcement agencies.

Who decides the good, bad and ugly?

To set the ground rules and obtain political cover for what’s likely to become a sprawling regulatory minefield, the Commission has plans for a European Artificial Intelligence Board to help it decide - amongst other things - which AI systems might count as 'high-risk'. The Board would feature a representative from each EU member, a representative of the European Commission, and a European Data Protection Supervisor.

The proposed AI Regulation is very much a follow-up to the EU’s GDPR (General Data Protection Regulation) which has now been deemed a success, having appeared to change big company behaviour regarding the collection and storage of personal data in the EU since its imposition, and all this against background noise from corporate libertarians shouting about overreach and the sheer folly of a hidebound European Union thinking it could understand and effectively regulate 21st century technology companies. 

So far the European law has resulted in hundreds of prosecutions and a few high profile finings of the likes of Google, against which many thought the law was specifically aimed. But the guns have also been turned on British Airways (£183 million) and Marriott International (£99 million).

The GDPR was adopted into UK law in 2018 and will continue to operate here despite Brexit. The Commission hopes a new AI law will similarly become an EU success story with its principles being picked up and applied elsewhere in the world.