Baldur Bjarnason
Because it’s going to confuse a lot of people:
- When they say that the EU AI Act “enters into force” what they mean is it becomes a law and the work to build its regulatory infrastructure begins.
- It won’t actually start being enforced for another six, twelve, and 24/36 months, for prohibited, general purpose, and high risk respectively.
(Edited to correct the timeline, mixed up prohibited and high risk in the timeline.)
Baldur Bjarnason
If none of this sounds that onerous—after all, demonstrating that a system that’s fundamentally incapable of preemptive action isn’t capable of preemptive action is stupendously easy, and documentation plus basic security is what they should be doing anyway—remember that US tech is 50% true believers who are trying to prove that their personal best buddy Clippy is on the verge of personhood, and 50% grifters who are promising legal slavery of thinking individuals in their core marketing
Baldur Bjarnason
Many of them are also whiny, self-centred narcissists prone to flying into rage whenever anybody tries to set even the softest and manageable of boundaries. If you’ve ever had an alcoholic or addict relative or a toxic narcissist partner: that’s pretty much every exec in tech and most execs in US today
The EU in this scenario is a criminally abused relative who, on the advice of their friends, is trying to set the softest of boundaries. Like “don’t beat me up on Saturdays before I’m going out”
Baldur Bjarnason
General Purpose “AI”, basically LLMs at the moment, have 12 months to have decent docs, a published policy that describes how they’re following the EU Copyright Directive, and have a “sufficiently” detailed summary of the media used for training. (What “sufficient” means is 🤷🏻♂️.)
You might think, based on the panicked whinging coming from US tech cos that these requirements are onerous but they basically get twelve months to write documentation and pinky-swear that they’ll respect copyright law
Baldur Bjarnason
General Purpose (GP) systems that pose “systemic” risks have additional requirements
WTF are “systemic” risks? Well, it sounds like it’s mostly “Self-Aware AI Doomsday” bullshit but the long and short of it is that most of the bigger GP models will need to do more nonsense “will this glorified excel spreadsheet somehow escape from the data centre and walk around like that hot chick from Ex Machina” testing and have the computer security measures every big vendor should have in the first place.
Baldur Bjarnason
If you’re making “AI” for biometrics, core infrastructure, admissions or assessment for education, job recruitment, job evaluation, life or health insurance, border control, and a few other cases that involve using ML to profile or assess people, then your product is high risk
You have 24 (or 36 for a subset) months to get your ass in gear, improve your documentation/record-keeping, support human oversight and generally have the sort of quality control you’d expect from a high risk product
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.