Publications

Regulatory experimentation tools are used to test new economic, institutional and technological approaches, and legal provisions, outside of existing regulatory structures. This report focuses on regulatory sandboxes, where authorities engage firms to test innovative products or services that challenge existing legal frameworks. Participating firms obtain a waiver from specific legal provisions or compliance processes to innovate. This report presents lessons learnt from fintech regulatory sandboxes and their positive impacts, such as fostering venture capital investment in fintech start-ups. It covers challenges and risks involved in implementing regulatory sandboxes and their testing processes. This report presents policy considerations for AI regulatory sandboxes, including institutional interdisciplinary cooperation and the need to build up AI expertise within regulatory authorities. Findings underline the need for regulatory interoperability and the role that trade policy can play. Finally, it discusses the need for comprehensive criteria to determine sandbox eligibility and assess trials, and the potential impact of sandboxes on innovation and competition.

The European Union (“EU”) Artificial Intelligence Act (the AI Act) is a legal medley. Under the banner of risk-based regulation, the AI Act combines two repertoires of European Union (EU) law, namely product safety and fundamental rights protection. Like a medley, the AI Act attempts to combine the best features of both repertoires. But like a medley, the AI Act risks delivering insufficient levels of both product safety or fundamental rights protection. This article describes these issues by reference to three classical issues of law and technology. Some adjustments to the text and spirit of the AI Act are suggested.

[ITA] I recenti provvedimenti del Garante privacy nei confronti di ChatGPT, un sistema di intelligenza artificiale generativa di proprietà di OpenAI, sollevano riflessioni sul ruolo e la capacità delle autorità pubbliche di supportare l’innovazione tutelando al contempo i cittadini. Gli interventi del Garante mettono in luce l’impatto sull’attuazione amministrativa di una regolazione obsoleta - il Regolamento europeo generale sulla protezione dei dati - che contribuisce all’ineffettività dei provvedimenti rispetto agli obiettivi perseguiti. Neppure è risolutiva l’impostazione molto poco flessibile della proposta di Regolamento europeo sull’IA, laddove è invece auspicabile un mutamento del paradigma regolatorio alla base dell’intervento pubblico. -- [ENG] The recent actions taken by the Italian Data Protection Authority against ChatGPT, a generative artificial intelligence system owned by OpenAI, prompt reflections on the role and ability of public authorities to support innovation while simultaneously protecting citizens. The interven- tions by the Privacy Authority shed light on the impact of an outdated regulatory framework, the European General Data Protection Regulation, on the regulatory delivery, thereby impeding the effectiveness of these measures in achieving their intended goals. Furthermore, the proposed European Regulation on Artificial Intelligence, with its rigid approach, fails to provide a definitive solution, as there is a need for ashift in the regulatory paradigm underlying public intervention.