If you are a founder, product manager, chief officer, or developer of a startup working with AI, this article about the EU AI Act is for you.
The European AI Act (AIA) is one of the most important pieces of regulation for the AI ecosystem and it is expected by many to shape regulation worldwide, the so-called Brussels effects.
While some praise this Act, others have been very critical and vocal against it. We have read so many opposing views, including ones stating that the AI Act will kill EU-produced technology, startups, and research.
So, we sat down with some of the most relevant experts on AI regulation and the AI Act as we want to provide you with firsthand information:
Nicoleta Cherciu is a lawyer focused on technology and business law, startups, and venture capital, and a researcher on the regulation of AI, robotics, and online platforms. She is an expert on AI compliance and the Managing Partner of Cherciu&Co.
Dragos Tudorache is a Member of the European Parliament and the co-rapporteur on the AI Act. He co-led the drafting and negotiations on the AI Act between all EU member states.
Andrea Bertolini is a professor of private law at Scuola Superiore Sant’Anna Pisa, has an LLM from Yale University, and has authored a plethora of expert reports for the European Parliament and European Commission on the regulation of AI, robotics, online platforms, drones, etc. Andrea is a lawyer licensed in Italy and New York.
To find even more opinions from lawyers on the EU AI Act, have a look at this article.
In our discussion, we focused on 3 main questions often debated in public:
- Will the AIA create differences/disadvantages between startups in the EU vs. those US-based?
- Will it disadvantage new entrants vs. existing companies?
- What is the anticipated impact on startups regarding assessment and continuous monitoring? Will it be too onerous? Should the European Commission (EC) or the AI Office provide clear conformity processes and standards?
Impact on the EU vs US startups
Since a political agreement has been made on the AI Act, we’ve seen statements affirming that EU startups ‘will go to the US’. However MEP Dragos Tudorache is not worried: “The EU startup ecosystem is not formed by AI companies only; instead, we have a thriving startup ecosystem providing services and products in many other industries such as space, agriculture, cybersecurity, transport, etc. The preponderant EU startups will not fall under the AI Act’s ambit.”
But, on the other side, AI companies doing business in the EU will. All three experts have pointed out that the AI Act will apply not only to EU-registered companies, but to any company that is placing AI products onto the EU market, whether the company is EU-based or not. This is one of the reasons why the AI Act may shape and inspire AI compliance worldwide.
Is “compliance” the bad guy?
When it comes to the AIA, many worry about how it will impact businesses. One of the aspects brought into the spotlight is the cost of compliance.
However, most industries and manufacturers must undertake these costs.
In the end, says Andrea Bertolini, compliance is a cost that is not different from other research and development costs you need to develop a product. He also adds that regulation, per se, does not entail hampering innovation.
On this topic, Nicoleta Cherciu noted that the AI Act aims to be an addition to any part of the European Union’s current product safety regulation package. For example, toys, medical devices, electronic products, vehicles, computers, etc. are subject to safety requirements and conformity assessments before being placed onto the EU market. Similarly, certain AI or software-related offerings should be subject to ex-ante compliance and safety assessments, as in the end, these are also products, and their manufacturers ought to ensure they are safe for use. Imagine a self-driving vehicle driving on the streets without being priorly subjected to safety tests and verifications.
But whether the AI Act is fit for purpose and if it will achieve its intended results, remains to be seen. “By aiming to regulate the entire AI sector, the AIA has a very broad reach, and in different sectors, it will play out in different ways. Also, time will show if the cost of compliance is useful – as other R&D costs typically are – or just an additional layer and burden,” Bertolini adds. Good regulation could represent a useful cost, in case it allowed companies complying with it to assume and show that they developed a safe, reliable, and trustworthy product.
As Dragos Tudorache pointed out, the Act has been tailored not to hamper innovation, but to enhance safety. To make sure this happens, it provides certain exceptions for the development and dissemination of open-source AI models, as well as a lighter assessment process for SMEs.
However, adds Cherciu, it is to be seen whether these exceptions will be used as loopholes, as some companies may open source their models to benefit from disseminating their products to the open source community (such as by having their product improved) without having to comply with certain safety and assessment requirements.
The EU AI ACT leads to new business opportunities
Dragos Tudorache pointed out that the AIA is a highly technical act and it shall not be deemed similar to the GDPR. The AIA provides an assessment and compliance process that is based on and dependent upon technical standards, and which are yet to be developed by standardization bodies such as CEN CENELEC or ISO.
As a consequence, it is estimated that the AIA will create a new market soon to reach millions of dollars in value. New companies specialized in testing, curating, and assessing models and data, by automated means or otherwise, will be created. The question is, Dragos Tudorache says, who will be the ones taking advantage of this business opportunity, EU entrepreneurs or USA ones?
In this regard, Bertolini is concerned that if non-EU players will dominate the AI compliance market by developing certifying procedures, applications, and approaches they may dictate the new approach and the new de-facto benchmark in complying with the AIA.
Nicoleta Cherciu shares the same view, mentioning that the USA and the UK, for example, have focused on the development of standards and guidelines, even before having any legislation in place. See, for example, the 2020 AI Risk Management Framework issued by the National Institute of Standards and Technology (NIST), Stanford’s Foundation Model Transparency Index. The UK also aims to be a forefront standard producer and it has just published through the British Standards Institution the BS ISO/IEC 42001 Information Technology — Artificial Intelligence — Management System. This is a result of these two systems’ voluntary compliance or soft law preferred approach. However, it is clear by now that big tech will not self-regulate.
It may be the case that US companies will be the ones to reap the benefits of this new AI Act-created market. This is often the case, even in other sectors, given that “US-based companies benefit from substantially larger investments which they then use to scale at an accelerated pace,” adds Tudorache.
Will EU startups move to the US?
Nicoleta Cherciu thinks that the most relevant gap between the EU and USA startups comes from funds’ availability. EU companies will not leave the EU because of the AI Act, but to get the necessary investment to scale. USA investment funds have more capital, and generally, one of their requirements for investing in a company is for that company to be headquartered in the USA. Besides the fact that capital in the USA is raised faster, their commercial and investment laws and procedures are friendlier.
She also adds it is rather more likely that the startups’ exodus to the USA will be increased by the bottlenecks created by investment procedures and rules applicable in the EU, such as Regulation 452/2019 on the Screening of Foreign Direct Investments into the Union’, imposing in some cases, pre-investment and pre-round screenings and approvals with the national competent authorities. Such a process may add months to the investment process, whereas in the USA the entire investment round can be completed in weeks.
New vs old AI startups
The experts converged that the AIA in itself will not create such a difference, because it will apply to AI products available in the EU market, regardless of when they have been developed.
Dragos Tudorache adds that “it is inevitable that current unicorn companies and the big tech ones that are financing them, will have a substantial commercial advantage. But this is the outcome of immense financial and data resources, some of them being almost too big to fail. Nevertheless, this accumulation of market power in the hands of the few cannot be solved by a lack of regulation. On the contrary, this calls for more scrutiny of the field of competition regulation.”
Indeed, agrees Nicoleta Cherciu, it is interesting to see how the few big tech companies are lead investors in the most prominent GPAI companies, including EU ones. It is important, thus, to prevent the formation of monopolies and oligopolies. To this end, there are several EU initiatives ongoing, including the EC’s recently launched consultation on competition in virtual worlds and generative AI.
Furthermore, adds Nicoleta, unfair differences may stem from a company’s ability to bypass enforcement or to simply cover the costs of infringement of extant laws, such as the GDPR or copyright law, instead of undertaking the costs of compliance.
How AIA compliance will work in practice
As mentioned by Dragos Tudorache, “SMEs benefit from a tailored assessment process. Furthermore, the AIA imposes the creation of regulatory sandboxes, at national and/or regional levels. These are national frameworks and environments that offer regulatory supervision to new entrants producing innovative AI systems. Regulatory sandboxes will be a free resource for these companies and will provide regulatory guidance.”
The regulatory sandbox approach is being used by the EU regulator in other sectors as well, such as blockchain, says Nicoleta Cherciu.
She adds that, with respect to AI, Spain has already adopted and implemented an AI regulatory sandbox framework. These sandboxes are to be useful only if they will use a flexible and less bureaucratic process, including, concerning the application, assessment, and exit processes. Furthermore, to be functional, these sandboxes should not be overcrowded and should be able to provide expert advice and assistance in many fields, including technology and regulatory ones.
Prototypes of these regulatory sandboxes and assessment procedures have been implemented in other projects as well, Nicoleta Cherciu and Andrea Bertolini being part of some, such as CONBOTS.
“Together with a consortium, we applied the EC’s ethical guidelines for trustworthy AI to different AI-related projects as of the research and prototyping stages, ensuring compliance by design. This may well have been one of the first self-assessments similar to the one imposed by the AI Act and it has been carried out starting with 2020. The results showed that the process did not slow down nor impair the platform’s development, on the contrary, it created a flow of information and ideas between the legal and technical teams, “ explains Nicoleta.
