Digital tech regulation

Digital humanism

Digital revolution

EU AI Act

• AI applications that pose an “unacceptable risk” would be banned; high-risk applications in such fields as finance, the justice system, and medicine would be subject to strict oversight. 14 June 2023, passed its draft of this law—an important step, but only a step, in the process. Parliament and Council of the European Union, have been proposing amendments to the Act since its 2021 inception. Three-way negotiations over the amendments will begin in July, with hopes of reaching an agreement on a final text by the end of 2023. If the legislation follows a typical timeline, the law will take effect two years later. In the meantime, European officials have suggested that companies worldwide could sign on to a voluntary AI code of conduct, drafting in July 2023 set of rules outlining the norms, rules, and responsibilities or proper practices of an individual party or an organization. 
• In the US, in October 2022, the White House issued a nonbinding Blueprint for an AI Bill of Rights, which framed AI governance as a civil rights issue, stating that citizens should be protected from algorithmic discrimination, privacy intrusion, and other harms. Blueprint suggests a civil rights approach in hopes of creating flexible rules that could keep up with fast-changing technologies. In April 2023 that he was circulating the draft of a “high level framework” for AI regulations. 
• Chinese regulations have already been put in force, starting with rules for recommendation algorithms that went into effect in March 2022, requiring transparency from the service providers and a way for citizens to opt out. Next, in January 2023, the Chinese government issued early rules governing generative AI, and further draft rules were proposed in April 2023. China’s initial set of rules for generative AI required websites to label AI-generated content, banned the production of fake news, and required companies to register their algorithms and disclose information about training data and performance. The draft rules go even further, requiring that AI companies verify the veracity of all the data used to train their models. 

• Ban on emotion-recognition AI. The European Parliament’s draft text bans the use of AI that attempts to recognize people’s emotions in policing, schools, and workplaces. Makers of emotion-recognition software claim that AI is able to determine when a student is not understanding certain material, or when a driver of a car might be falling asleep. The use of AI to conduct facial detection and analysis has been criticized for inaccuracy and bias, but it has not been banned in the draft text from the other two institutions, suggesting there’s a political fight to come.
• Ban on real-time biometrics and predictive policing in public spaces. This will be a major legislative battle, because the various EU bodies will have to sort out whether, and how, the ban is enforced in law. Policing groups are not in favor of a ban on real-time biometric technologies, which they say are necessary for modern policing. Some countries, like France, are actually planning to increase their use of facial recognition.
• Ban on social scoring. Social scoring by public agencies, or the practice of using data about people's social behavior to make generalizations and profiles, would be outlawed. That said, the outlook on social scoring, commonly associated with China and other authoritarian governments, isn’t really as simple as it may seem. The practice of using social behavior data to evaluate people is common in doling out mortgages and setting insurance rates, as well as in hiring and advertising. 
• New restrictions for gen AI. This draft is the first to propose ways to regulate generative AI, and ban the use of any copyrighted material in the training set of large language models like OpenAI’s GPT-4. OpenAI has already come under the scrutiny of European lawmakers for concerns about data privacy and copyright. The draft bill also requires that AI generated content be labeled as such. That said, the European Parliament now has to sell its policy to the European Commission and individual countries, which are likely to face lobbying pressure from the tech industry.
• New restrictions on recommendation algorithms on social media. The new draft assigns recommender systems to a “high risk” category, which is an escalation from the other proposed bills. This means that if it passes, recommender systems on social media platforms will be subject to much more scrutiny about how they work, and tech companies could be more liable for the impact of user-generated content.

• rules on high-impact general-purpose AI models that can cause systemic risk in the future, as well as on high-risk AI systems
• a revised system of governance with some enforcement powers at EU level
• extension of the list of prohibitions but with the possibility to use remote biometric identification by law enforcement authorities in public spaces, subject to safeguards
• better protection of rights through the obligation for deployers of high-risk AI systems to conduct a fundamental rights impact assessment prior to putting an AI system into use.

• Cognitive behavioural manipulation of people or specific vulnerable groups: for example voice-activated toys that encourage dangerous behaviour in children
• Social scoring: classifying people based on behaviour, socio-economic status or personal characteristics
• Real-time and remote biometric identification systems, such as facial recognition

• Biometric identification and categorisation of natural persons
• Management and operation of critical infrastructure
• Education and vocational training
• Employment, worker management and access to self-employment
• Access to and enjoyment of essential private services and public services and benefits
• Law enforcement
• Migration, asylum and border control management
• Assistance in legal interpretation and application of the law.

• Disclosing that the content was generated by AI
• Designing the model to prevent it from generating illegal content
• Publishing summaries of copyrighted data used for training

• Manipulative and deceptive practices.  AI systems that use subliminal techniques to materially distort a person’s decision-making capacity, leading to significant harm, are banned. This includes systems that manipulate behaviour or decisions in a way that the individual would not have otherwise made.
• Exploitation of vulnerabilities.  The Act prohibits AI systems that target individuals or groups based on age, disability, or socio-economic status to distort behaviour in harmful ways.
• Biometric categorisation.  It outlaws AI systems that categorise individuals based on biometric data to infer sensitive information like race, political opinions, or sexual orientation. This prohibition does not cover any labelling or filtering of lawfully acquired biometric datasets, such as images. There are also exceptions for law enforcement.
• Social scoring.  AI systems designed to evaluate individuals or groups over time based on their social behaviour or predicted personal characteristics, leading to detrimental treatment, are banned.
• Real-time biometric identification.  The use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement is heavily restricted, with allowances only under narrowly defined circumstances that require judicial or independent administrative approval.
• Risk assessment in criminal offences.  The Act forbids AI systems that assess the risk of individuals committing criminal offences based solely on profiling, except when supporting human assessment already based on factual evidence.
• Facial recognition databases.  AI systems that create or expand facial recognition databases through untargeted scraping of images are prohibited.
• Emotion inference in workplaces and educational institutions.  The use of AI to infer emotions in sensitive environments like workplaces and schools is banned, barring exceptions for medical or safety reasons.

• Preambula
• Sadržina: I Opšte odredbe; II Zabranjene AI prakse; III AI sistemi visokog rizika; IV Obaveze transparentnosti za provajdere AI sistema; VIIIa AI modeli opšte namene; V Mere u cilju podrške inovacijama; VI Upravljanje; VII Baza podataka EU za visokorizične sisteme AI iz aneksa III; VIII Post-tržišni monitoring, deljenje informacija i nadzor tržišta; IX Kodeks ponašanja; X Poverljivost i kazne; XI Delegiranje ovlašćenja i postupanje organa; XII Završne odredbe
• Aneksi

• inovativni razvoj
• transparentnost i odgovornost
• sistem procene nivoa rizika po društvo i prava pojedinca

• Neprihvatljiv rizik – zabranjene su prakse VI koje se smatraju previše štetnima da bi bile dozvoljene, poput manipulacije ponašanjem ljudi na njihovu štetu (prevarne tehnike za iskrivljavanje ponašanja i ometanje informisanog donošenja odluka) ili poput sistema koji nepravedno kategoriziraju pojedince (social scoring), pa i softvera za prepoznavanje lica u stvarnom vremenu na javnim mestima.
• Visok rizik – deli se na dve podkategorije: sistemi sigurnosnih komponenti (medicinski uređaji) i sistemi za osetljivu upotrebu (biometrija, kritična infrastruktura, obrazovanje, zapošljavanje, osnovne usluge, sprovođenje zakona, migracije, pravosuđe). Kategorija obuhvata sisteme VI koji bi mogli značajno uticati na sigurnost ljudi ili na fundamentalna prava. Neophodna je stroga usklađenost i procena sigurnosti ovih sistema, nadgledanje, upravljanje podacima, čuvanje zapisa, sajber-bezbednost, sistem prijavljivanja ozbiljnijih incidenata...
• Ograničeni rizik – sistemi VI koji direktno komuniciraju s korisnicima, poput chatbota. – Neophodno je da su transparentne u pogledu toga da njima upravlja VI kako bi korisnici bili svesni da ne komuniciraju s ljudima.
• Minimalni rizik – većina aplikacija VI spada u ovu kategoriju, gde se sloboda inovacija održava uz minimalnu regulatornu intervenciju. To su sistemi koji predstavljaju zanemariv rizik za prava ili sigurnost pojedinaca.  Koriste se uz minimalan nadzor.

EU Digital Markets Act (DMA)

• has a strong economic position, significant impact on the internal market and is active in multiple EU countries
• has a strong intermediation position, meaning that it links a large user base to a large number of businesses
• has (or is about to have) an entrenched and durable position in the market, meaning that it is stable over time if the company met the two criteria above in each of the last three financial years

EU Data Governance Act (DGA)

• stavljanje podataka javnog sektora na raspolaganje
• razmena podataka među preduzećima uz naknadu u bilo kojem obliku
• omogućavanje upotrebe ličnih podataka uz pomoć posrednika za razmenu ličnih podataka
• omogućavanje upotrebe podataka na altruističkim temeljima

EU Data Act

• manufacturers of connected products (i.e., physical products capable of collecting or generating data concerning their use or environment, and of communicating product data), 
• suppliers of related services (i.e., digital services, including software, integrated into or associated with a connected product); 
• “data holders” that have the right or obligation to use or make data available;
• providers of data processing services.

• ensure fairness in the allocation of value from data among actors in the digital environment
• stimulate a competitive data market
• open opportunities for data-driven innovation, and
• make data more accessible to all

EU Health Data Space

• create new patient rights over their electronic health data, and sets out rules regarding use of electronic health data for primary care;
• establishes a pre-market conformity assessment requirement for electronic health record systems (“EHR systems”);
• sets out rules that apply to digital health services and wellness apps; and
• introduces a harmonized scheme for providing access to electronic health data for secondary use.

EU Directive Network and information security (NIS2)

• Lični podaci su svi oni podaci koji se odnose na osobu, a na osnovu kojih se ona može identifikovati (direktno ili indirektno) i ugroziti njena privatnost.
• Privatnost nije pravo na tajnost, niti na kontrolu, već pravo na odgovarajući protok ličnih podataka. Svaka osoba raspolaže mogućnosti da, u zavisnosti od situacije i konteksta, lično proceni štai sa kim deli u digitalnom okruženju . Ili, drugačije rečeno, raspolaže pravom da zna kako i u koje svrhe se koriste njeni podaci, ko ih čuva i koliko dugo, ko sve njima raspolaže, kao i da može da zatraži brisanje ličnih podataka ili ispravku netačnih podataka.

• informacije o zdravlju (lični podaci koji se odnose na fizičko i mentalno zdravlje pojedinca, uključujući i pružanje zdravstvenih usluga)
• biometrijski podaci (lični podaci dobijeni posebnom tehničkom obradom, u vezi sa fizičkim, fiziološkim ili karakteristikama ponašanja osobe koji omogućuju ili potvrđuju jedinstvenu identifikaciju te osobe, npr. slike lica ili otisci prstiju)
• genetski podaci (lični podaci koji se odnose na nasleđene ili stečene genetske karakteristike osobe koji daju jedinstvene informacije o fiziologiji ili zdravlju osobe a dobijeni su analizom njenog biološkog uzorka)

EU-USA DATA PRIVACY FRAMEWORK

EU Directive on payment services in the internal market

• EAD Pillars of Conceptual Framework fall broadly into three areas, reflecting anthropological, political, and technical aspects.: universal human values, political self-determination and data agency, and technical dependability. 
• EAD General Principles have emerged through the continuous work of dedicated, open communities in a multi-year, creative, consensus-building process. They articulate high-level principles that should apply to all types of autonomous and intelligent systems (A/IS). Created to guide behavior and inform standards and policy making, the General Principles define imperatives for the ethical design, development, deployment, adoption, and decommissioning of autonomous and intelligent systems. The Principles consider the role of A/IS creators, i.e., those who design and manufacture, of operators, i.e., those with expertise specific to use of A/IS, other users, and any other stakeholders or affected parties.

• Human rights.  A/IS shall be created and operated to respect, promote, and protect internationally recognized human rights.
• Well-being.  A/IS creators shall adopt increased human well-being as a primary success criterion for development.
• Data agency.  A/IS creators shall empower individuals with the ability to access and securely share their data, to maintain people’s capacity to have control over their identity.
• Effectiveness.  A/IS creators and operators shall provide evidence of the effectiveness and fitness for purpose of A/IS.
• Transparency.  The basis of a particular A/IS decision should always be discoverable.
• Accountability.  A/IS shall be created and operated to provide an unambiguous rationale for all decisions made.
• Awareness of misuse.  A/IS creators shall guard against all potential misuses and risks of A/IS in operation.
• Competence.  A/IS creators shall specify and operators shall adhere to the knowledge and skill required for safe and effective operation. 

• maintaining human autonomy
• implications of cultural migration in A/IS
• applying goal-directed behavior (Virtue Ethics) to A/IS
• eequirement for rule-based ethics in practical programming

GPAI standards

• provision of technical documentation to the AI Office and National Competent Authorities
• provision of relevant information to downstream providers that seek to integrate their model into their AI or GPAI system (eg. capabilities and limitations)
• summaries of training data used
• policies for complying with existing Union copyright law

• state of the art model evaluations
• risk assessment and mitigation
• serious incident reporting, including corrective measures
• adequate cybersecurity protection