Art. 5 of the EU Artificial Intelligence Act lists and describes explicitly prohibited practices involving the use of AI. This article sets fundamental legal boundaries for the use of AI applications, reflecting essential ethical standards as well. In this series of posts, we will examine these prohibitions one by one, starting with the prohibition in comma 1, point (a) of the article. This clause states that it is forbidden to sell, deploy, or use an AI system that employs subliminal, manipulative, or deceptive techniques to distort a person’s or group’s behaviour, in such a way that their ability to make informed decisions is significantly impaired, leading them to make choices they wouldn’t normally make, which causes or is likely to cause significant harm to that person, another person, or a group of persons. The four following points, in my opinion, capture the essence of the clause.

Intentionality of Design: the clause implies – as a critical aspect for determining liability or compliance – that the subliminal, manipulative, or deceptive techniques must be intentionally integrated into the AI system.

Objective: the aforementioned techniques must be specifically used to distort a person’s or group’s behaviour, by significantly impairing their ability to make informed decisions. Undermining decision-making capacities, then, is the mechanism through which these forbidden AI systems operate.

Consequences: these manipulative techniques must lead individuals to make decisions they wouldn’t ordinarily make if such AI systems were not used. This aspect underscores the cause-effect relationship between the use of the AI system and the altered decision-making process.

Requirement of Harm: the decisions influenced by these techniques must cause or be likely to cause significant harm to the user or others. This requirement connects the considerations above to tangible outcomes, emphasizing the potential for real-world impact.

The intentions of this clause is to prevent the deployment of AI systems designed to become dangerous social actors but the devil, as always, lies in the details. For instance, terms like “subliminal”, “manipulative”, “deceptive”, and “significant harm” are somewhat subjective and open to interpretation. This vagueness can lead to challenges in enforcement and might require extensive legal proceedings to clarify. Even more importantly, demonstrating whether a decision would not have been made in the absence of the use of an AI system, even a malicious one, may prove to be challenging. Indeed, establishing a clear causal link between the use of an AI system and a specific decision is complex. Decisions are influenced by a multitude of factors—personal, social, economic, and psychological. Disentangling the impact of AI from these factors is not straightforward. What is more, collecting evidence to prove that a decision was influenced by AI can be technically and logistically difficult. It may require, for example, access to protected or even classified data logs and information about the way an AI system was actually used within a decision-making process.

As a final thought consider this version of the clause: is forbidden to sell, deploy, or use an AI system that employs subliminal, manipulative, or deceptive techniques to distort a person’s or group’s behaviour, in such a way that their ability to make informed decisions is significantly impaired, leading them to make choices they wouldn’t normally make, which causes or is likely to cause significant good to that person, another person, or a group of persons. Would you include it as well in the EU AI Act?  (My answer is yes: in my view, the ability to make informed decisions prevails over any good intention).

In questo e in futuri post (presumibilmente molti) ci concentreremo sul regolamento europeo sull’intelligenza artificiale (AI Act), approvato dal Parlamento Europeo nel marzo 2024 e riassunto qui. Il testo completo può essere esplorato qui, mentre questo strumento permette di determinare quali parti del testo siano più rilevanti per un dato soggetto. Il pilastro fondamentale del regolamento, come si può leggere nel riassunto, è la classificazione dei sistemi IA in base al rischio.

Sistemi che presentano rischi considerati inaccettabili sono proibiti. Due esempi sono i modelli di punteggio sociale, usati per valutare o classificare individui o gruppi in base a comportamenti sociali o tratti personali, e che possono danneggiare o sfavorire le persone, e i sistemi che impiegano tecniche subliminali, manipolative o ingannevoli per condizionare i comportamenti e compromettere la capacità di prendere decisioni informate, causando danni significativi.

I sistemi classificati come ad alto rischio sono regolamentati. Un esempio sono i modelli utilizzabili dalle autorità pubbliche per valutare l’idoneità a benefici e servizi, inclusa la loro assegnazione, riduzione, revoca o recupero.

I sistemi di intelligenza artificiale a rischio limitato sono soggetti a obblighi meno severi. Sviluppatori e distributori devono assicurarsi che gli utenti finali siano consapevoli di interagire con un’intelligenza artificiale (come chatbot e deepfake).

I sistemi che pongono un rischio minimo (come videogiochi basati sull’IA e filtri antispam) non sono regolamentati (almeno per il momento, perché l’IA generativa, ad esempio, potrebbe cambiare il panorama).

Il regolamento pone la maggior parte degli obblighi in capo ai fornitori (sviluppatori) di sistemi di intelligenza artificiale ad alto rischio. Va sottolineato che per fornitori o sviluppatori si intendono coloro che vogliono immettere sul mercato o mettere in servizio nella UE questi sistemi, indipendentemente dal fatto che si trovino nel territorio dell’Unione o in un paese terzo. Ciò include i fornitori di paesi terzi che adoperano sistemi IA ad alto rischio i cui risultati sono utilizzati nella UE. Il regolamento chiarisce che per utenti si devono intendere persone fisiche o giuridiche che impiegano sistemi di intelligenza artificiale in un contesto professionale, e non agli utenti finali che subiscono gli effetti di un sistema senza necessariamente gestirlo o implementarlo. Coloro che usano sistemi di IA ad alto rischio hanno certi obblighi, anche se inferiori a quelli dei fornitori (sviluppatori). Di nuovo, questo si applica sia a utenti situati nel territorio dell’Unione, sia a utenti in paesi terzi, ma che impiegano sistemi IA i cui risultati vengono utilizzati nella UE.

Il regolamento contiene anche disposizioni che riguardano i sistemi IA cosiddetti “General Purpose” (GPAI) capaci di eseguire una vasta gamma di compiti indipendentemente dal modo in cui vengono immessi sul mercato, e che possono essere integrati in una varietà di sistemi o applicazioni. Specifiche norme riguardano i modelli GPAI che pongono rischi sistemici, definiti come quei modelli che durante l’addestramento hanno richiesto una quantità complessiva di calcolo maggiore di 10²⁵ operazioni in virgola mobile (FLOP). ChatGPT 4, ad esempio, appare rientrare in questa categoria.

In conclusione, l’AI Act introduce un quadro normativo completo per la regolamentazione dei sistemi di IA nella UE, centrato sulla trasparenza, sulla responsabilità, sulla gestione dei rischi e sul bilanciamento tra innovazione e utilizzo responsabile. Ulteriori approfondimenti sulle sue implicazioni saranno oggetto di prossimi post.

This and (presumably many) future posts will focus on the recently approved EU Artificial Intelligence Act, passed by the European Parliament in March 2024. Here you can find a high-level summary of the act. To explore the full text, you can use this explorer tool, while this compliance checker tool allows you to determine which parts of the text are most relevant to you. As one can read in the summary, a classification of AI-based systems according to risk lies at the core of the AI Act.

Systems that pose unacceptable risks are prohibited. Two examples of such systems are social scoring models, aimed at evaluating or classifying individuals or groups based on social behaviour or personal traits, causing detrimental or unfavorable treatment of those people, and systems that deploy subliminal, manipulative, or deceptive techniques to distort behaviour and impair informed decision-making, causing significant harm.

High risk systems are regulated. One instance of such systems are models used by public authorities for assessing eligibility to benefits and services, including their allocation, reduction, revocation, or recovery.

Limited risk AI systems are subject to lighter transparency obligations. Developers and deployers must ensure that end-users are aware they are interacting with AI (such as chatbots and deepfakes).

Systems which pose minimal risk (e.g. AI-enabled video games and spam filters) are unregulated at least for the time being, as generative AI, for instance, might change the panorama.

The AI Act places the majority of obligations on providers (developers) of high-risk AI systems. Importantly, it specifies that providers or developers are those who intend to place high-risk AI systems on the market or put them into service in the EU, regardless of whether they are based in the EU or a third country. This includes third-country providers whose high-risk AI system outputs are used in the EU. Furthermore, the AI Act clarifies that users are natural or legal persons who deploy an AI system in a professional capacity, rather than affected end-users. Users (deployers) of high-risk AI systems have certain obligations, albeit fewer than providers (developers). This applies to users located in the EU as well as third-country users whose AI system outputs are used in the EU.

Finally, specific provisions of the AI Act— to be discussed in later posts— concern General Purpose AI (GPAI) models. These are systems that display significant generality and are capable of competently performing a wide range of distinct tasks, regardless of the way the model is placed on the market, and can be integrated into a variety of downstream systems or applications. The AI Act reserves particular provisions for GPAI models that pose systemic risks, which are those models that, during training, required a cumulative amount of compute greater than 10²⁵ floating-point operations (FLOPs). ChatGPT 4, for instance, should fall into this category.

In conclusion, the AI Act introduces a comprehensive framework for regulating AI systems in the EU, with a focus on ensuring transparency, accountability, and risk mitigation. From the obligations placed on providers and users of high-risk AI systems to the specific provisions for General Purpose AI models, the Act aims to balance innovation with responsible deployment. More on the exploration of its implications in upcoming posts.