4 ms·
The critical element that's missing from the article--but which likely motivated the article--is that the EU's new AI regulation proposal mandates compliance al
by AlanYx 5y ago
The critical element that's missing from the article--but which likely motivated the article--is that the EU's new AI regulation proposal mandates compliance all along the supply chain (for regulated applications of AI).
In practice, this will likely mean that using open source for these AI applications will become a lot more difficult in a legal sense, perhaps impossible, because there's no single entity that can speak to compliance of open source components (vetting each commit, etc.). Perhaps some orgs will emerge who are willing to monitor and oversee open source software and certify that it meets the requirements of the legislation, but it's unclear how that would work.
I'm not endorsing this model, just explaining the concern. I don't think the tech community really fully appreciates how misguided a lot of the current approaches to AI regulation among policymakers are right now. (Not just this, but initiatives like the current CAHAI work towards a binding international law instrument on AI.)
And yes, like the GDPR, the proposed EU AI regulation has an extraterritorial effect. Under the proposed AI regulation, if you're selling into the EU or to any EU customers but don't have an establishment in the EU, you have to actually appoint a representative to comply with these requirements.
- adolph 5y agoSecuring supply chain is an important effort even outside of regulation. Here is a podcast about some recent open source efforts: Kubernetes Podcast 155: Software Supply Chain Security, with Priya Wadhwa https://kubernetespodcast.com/episode/155-software-supply-chain-security/ https://kubernetespodcast.com/episode/155-software-supply-ch...
- riedel 5y agoThe AI act is really a strange effort to regulate technology horizontally without even being able to define it's scope. Many who have read it believe it ends up regulating all computer logic in critical infrastructure (while making this definition wide as well) . I have tried to comment on this through various channels (local government/associations), because it seems a really strange "horizontal" regulation that could have huge side effects. I hope more people will point out the problems of the current proposal. I am really a proponent of both the GDPR and AI ethics for most parts but this one is really going too far .
- xg15 5y agoWell, for me it's enough if it starts to regulate whether I'm approved for this credit or not, or whether I should be considered suspect for a crime. I'm honestly worried that the greatest innovation in computing of the last decade seems to be inventing programs where literally no one understands how they work.
- hectormalot 5y agoCurrent drafts have a much too wide definition of AI (basically any predictive function) but a fairly narrow scope of what high risk applications are (listed in an annex). For those applications in scope, the birder seems extraordinarily high. E.g. that data sets should be “free of errors” I think things will improve before the final act. I have contributed to some of the commentary towards the regulator on this, and a lot of the flaws mentioned are now well recognized. Disclaimer: opinions above are my own.