If the draft Code of Practice for general-purpose AI systems is a reliable teaser for what is to come from the final version, we need to focus on the proportionality principle and risk-based approach as lenses to interpret the Code and AI Act. Otherwise, any development of AI in the EU will stall, or it will only be conducted by very deep-pocketed big corporations, effectively entrenching their monopolies over this tech.
Introduction
The AI Act results from a compromise between various competing interest groups regarding how AI systems should be regulated in the EU. One significant area that added to the regulation’s scope, compared to the initial proposition by the EU Commission, is encompassing so-called general-purpose AI systems into the AI Act’s remit.
The broadening of the AI Act scope by this category was allegedly justified by the meteoric rise in the commercial viability and usage of so-called large language models (LLMs), which are capable of performing an array of tasks mimicking human intelligence and capacity but also do more, such as generating video and images and replicating voice and audio.
This opened up a whole new market vista and a huge boom in the LLMs applications across the whole economy. The EU haven’t lost the opportunity to keep on trying to leverage its Brussels Effect, to aim to push its own regulatory standard not only inside the EU, but beyond. Regardless of the Brussels Effect’s effectiveness in the case of the AI Act and overall probable diminishing efficacy, given the EU’s relative economic demise, the AI Act provides the first comprehensive approach to the regulation of LLMs globally, which are considered a general-purpose AI system under the AI Act.
AI Act is both a very complex and complicated regulatory regime, given:
1) the number and the weight of regulatory obligations,
2) the amount of a documentation needed to be produced to provide for compliance with them,
3) the sheer technological expertise needed to be connected with the legal one to make this compliance work, and then finally
4) the need to engage highly qualified civil servants and judges to enforce it justly and uniformly across the 27 Member States and their separate jurisdictions.
To help the providers of general-purpose AI systems to comply with the AI Act regime, AI Act foresees a Code of Practice for general-purpose AI systems (the Code) as an interim compliance measure on which adherence to AI developers can rely for compliance with the AI Act.
What is inside the Code has already been discussed. Therefore, in this article, I discuss the proportionality principle and risk-based approach in the Code, which are mentioned numerous times and intended to ease the heavy regulatory burden and the sheer incomprehensibility of the Act for the layman (and also for lawyers, who usually are not engineers). The proportionality principle and risk-based approach can actually bring some sanity back into the regulatory Bizantium that the AI Act orchestrates and therefore we need to focus on it.
What is Proportionality Principle and Risk Based Approach?
The proportionality principle is the meta-legal norm encompassing the whole legal system and basically requiring that any legal measure needs to be fit for purpose and proportional to purpose without putting unnecessary burden. It is also a constitutional principle in the Western legal world that, in simple words, demands that any limitation to someone’s right by public power needs to be necessary to achieve the intended effect, which benefits the public interest. To illustrate, the punishment should be proportionate to the crime and damage, and limitation to privacy, such as through police surveillance, should be delineated by what is strictly necessary to investigate the unlawful behaviour.
What the proportionality principle demands from lawmakers, lawyers applying the law, and judges making a final interpretation is viewing each case in its factual context and then applying appropriate legal norms proportionally to this context. This means that reasonableness, justice, and equity are the legal virtues whenever law is applied—opposite to formalism and legalism, which disregards the actual spirit of the law, its moral content, and its purposes, merely caring about appearances (effectively not taking responsibility for the actual outcomes of the legal interpretation). Therefore proportionate lawmaking and legal interpretation is a prerequisite for justice.
A risk-based approach, on the other hand, is a novelty in the lawmaker’s toolkit, popular for a few decades, that goes beyond black-and-white prohibitions and authorizations law used to use and towards context-based assessments of the possible risks at stake. After the assessment, the risk-based approach demands the introduction of appropriate safeguards to mitigate the risks. How these safeguards look depends on the given case, and compliance with the risk-based approach is evaluated based on the factual safeguards in place to mitigate the possible risks. This makes the risk-based approach a flexible legal solution that demands less from smaller players because of their potentially smaller risk, while demanding a lot from big and socially important players (such as banks or huge digital giants) because of an enormous risk related to their potential misbehavior.
Proportionality Principle and Risk Based Approach in the AI Act and the Code – A Light of Sanity at the End of the Tunnel
Both the proportionality principle and risk-based approach are implemented throughout the emerging body of the EU Digital Law. They are also necessarily present in the AI Act. Since general-purpose AI systems are very heavily regulated in the AI Act, the Code needs to translate the primary legal language (of the AI Act) into secondary and actionable language, which is operationalizable directly for lawyers aiding AI developers and the developers themselves.
That is why drafters of the Code mention proportionality and risk-based almost anytime they have doubts about what precisely the AI Act demands and how to make it workable. The authors underscore that smaller players should not be burdened by compliance in the same way as big players, except when their systems pose the same risk.
The draft Code itself is lengthy and fairly detailed, which is an effect of what has been legislated in the AI Act itself. Drafters of the Code deserve a lot of credit because through underscoring proportionality and risk-based approach whenever uncertain and burdensome provisions of the AI Act are interpreted, they are doing their best to ease the burden for smaller and middle-size players. This rationalization and regulatory burden mitigation is necessary if any AI systems are to be developed or deployed in the EU, other than those of digital giants, who can afford whole legal, public affairs, and PR departments whitewashing whatever such giants do.
Legalistic, Administrative, and Bureaucratic Bizantium – Alternative to Proportionality and Risk-Based Approach
If proportionality and a risk-based approach are not treated seriously, which is a significant risk, given the bureaucratic logic and incentives that may drive those who enforce the AI Act (such as a need to justify one’s own existence), then what awaits AI in the EU is a Byzantine process of compliance, which will, if not derail, then significantly diminish and slow down any development and deployment of AI systems in the EU.
According to the Code, general-purpose AI systems providers need to, for instance:
1. Prepare and maintain information and technical documentation of the model, including e.g.:basic information about the model, intended tasks and type and nature of AI systems in which it can be integrated, acceptable use policies, the interaction of the model with external hardware or software, architecture and number of parameters, design specification, training and testing process, modalities and results of its evaluation. The information and documents should be ready to be shared upon request with the AI Office and the national competent authorities, and some of them should be provided to downstream providers willing to integrate the general-purpose system into their AI systems.
2. Comply with rules related to Copyright, such as through e.g.: implementing the internal policy governing the respect for the copyright of data and creative works owners, conducting reasonable due diligence before using third party datasets, and taking appropriate measures to avoid the repeated generation of output which can be similar to copyrighted works, complying with rights reservations for text and data mining in the EU Copyright Directive (2019/790), such as through robot.txt standard.
3. Conduct systemic risk assessment and mitigation, checking for whether the model poses risks, such as
– Cyber offence: Risks related to offensive cyber capabilities such as vulnerability discovery or exploitation,
– Chemical, biological, radiological, and nuclear risks: Dual-use science risks enabling chemical, biological, radiological, and nuclear weapons attacks via, among other things, weapons development, design, acquisition, and use
– Loss of Control: Issues related to the inability to control powerful autonomous general-purpose AI modelsAutomated use of models for AI Research and Development: This could greatly increase the pace of AI development, potentially leading to unpredictable developments of general-purpose AI models with systemic risk
– Persuasion and manipulation: The facilitation of large-scale persuasion and manipulation, as well as large-scale disinformation or misinformation with risks to democratic values and human rights, such as election interference, loss of trust in the media, and homogenisation or oversimplification of knowledge
– Large-scale discrimination: Large-scale illegal discrimination of individuals, communities, or societies
4. If general purpose AI system also poses a systemic risk, then they must also adhere to rules for general-purpose AI models with systemic risk, such as by e.g.: introducing safety and security framework, continuous risk identification, continuous risk analysis, collecting evidence, implementing technical and organizational risk mitigation measures, such as e.g.: safety and security mitigations, safety and security reports, establishing the process for deployment decisions, ensuring ownership for risks in the organization, independent assessments and audits, establishing the procedure for serious incidents reporting, implementing whistleblowers protections
The above list is not exhaustive; the binding list of measures will be provided in the final version of the Code.
The AI Act and the Reality of the AI Systems Development
The demand to guardrail general-purpose AI systems with a set of administrative procedures to minimize risk is fundamentally out of touch with how AI is developed. Engaging lawyers in the development of general-purpose AI systems will drag the process of AI systems to the extent that it is doubtful that such systems can be developed at all.
AI Act, as applied to general-purpose AI systems, envisions an ideal world where engineers and legal experts are perfectly aligned as to their objectives, use the same terminology, and understand each other flawlessly, and therefore lawyers can be directly engaged in the development process.
The reality is that the legal language lawyers use, and the technical language is so much apart, that engaging of lawyers in the AI development process can effectively paralyze it. That is because lawyers would not understand the technical terms and real-world impact of general-purpose AI systems (beyond buzzwords), and engineers will misinterpret what lawyers say on the side of caution.
The idea that lawyers will take part in the design of AI systems and that they will be looped into the whole process is impossible in such a fast-moving market. If treated seriously, these demands can eviscerate smaller players that could challenge big players by their capacity to move fast and be agile. The perverse effect would be that there would not be much of AI risks in the EU, because there would be not much AI itself.
The Path Forward: Pragmatic Focus on Proportionality and Risk-Based Interpretation of AI Act to Salvage EU Competitiveness
The uncertainty caused by the AI Act can already be seen and felt. Sora, the OpenAI movie-making model, has not been released in the EU. Meta’s newest Llama model has also been significantly delayed. It is a new trend among tech companies that gains traction, that for the sake of avoiding bad publicity and potential fines, they simply start to avoid the EU. This means that the productivity gains enabled by the AI systems will not be harnessed in the EU, pushing it further into gradual economic irrelevancy, compared to US.
We, therefore, much need a pragmatic approach to the AI Act, especially for general-purpose AI systems, if we want to have any technological edge in the EU and thus develop our economy in any meaningful way. Of course, fundamental rights should not be sacrificed, but overall risks of AI are so far overstated, while benefits are clear and immediate. Moreover, only with economic power stemming from economic development is it possible to have an actual capacity to defend rights. Some sacrifice of the rights’ scope is needed to gain the power to defend what is essential about rights— which is often what we really do not like about the US-provided tech platforms, such as e.g. commercial surveillance, nudging and manipulating.
What all of this means from a very pragmatic perspective is that the compliance of the general purpose AI systems with the AI Act (and Code of Practice) will be dependent on a few key factors:
1.The lawyers’ professionalism and expertise helping develop the general-purpose AI providers.
2.Ownership for decisions and lawyers pragmatically applying the AI Act with proportionality and risk-based approach in their minds.
3.Leniency, understanding, and EU pro-competitive approach of the officials supervising compliance with the AI Act.
4.High AI literacy of judges interpreting the AI Act and the Code.
5.When defining what should not be done with AI and what general-purpose AI systems should not be developed, focus on the most important and potentially harmful risks.
Jan Czarnocki
Digital Law & Ethics Expert. Doctoral Researcher - KU Leuven Centre for IT & IP Law. Managing Partner & Co-Founder - White Bison
