Publications

The EU AI Act seeks to balance the need for societal protection against the potential risks of AI systems, with the goal of fostering innovation. However, the Act’s ex-ante risk-based approach might lead to regulatory obsolescence (already materialised in 2021 with the spread of LLMs and the consequent reopening of the regulatory process), as well as to over or under-inclusion of AI applications in risks’ categories. The paper deals with the latter outcome by exploring how AI uses in law and rulemaking hide risks not covered by the EU AI Act. It is then analysed as to how the Act lacks flexibility on amending its provisions, and the way forward. The latter is tackled without utopian and not really feasible proposals for a new act and risk-based approach, but focusing on codes of conduct and national interventions on AI uses by public authorities.

The EU AI Act seeks to balance the need for societal protection against the potential risks of AI systems, with the goal of fostering innovation. However, the Act’s ex-ante risk-based approach might lead to regulatory obsolescence (already materialised in 2021 with the spread of LLMs and the consequent reopening of the regulatory process), as well as to over or under-inclusion of AI applications in risks’ categories. The paper deals with the latter outcome by exploring how AI uses in law and rulemaking hide risks not covered by the EU AI Act. It is then analysed as to how the Act lacks flexibility on amending its provisions, and the way forward. The latter is tackled without utopian and not really feasible proposals for a new act and risk-based approach, but focusing on codes of conduct and national interventions on AI uses by public authorities.

[ITA] I recenti provvedimenti del Garante privacy nei confronti di ChatGPT, un sistema di intelligenza artificiale generativa di proprietà di OpenAI, sollevano riflessioni sul ruolo e la capacità delle autorità pubbliche di supportare l’innovazione tutelando al contempo i cittadini. Gli interventi del Garante mettono in luce l’impatto sull’attuazione amministrativa di una regolazione obsoleta - il Regolamento europeo generale sulla protezione dei dati - che contribuisce all’ineffettività dei provvedimenti rispetto agli obiettivi perseguiti. Neppure è risolutiva l’impostazione molto poco flessibile della proposta di Regolamento europeo sull’IA, laddove è invece auspicabile un mutamento del paradigma regolatorio alla base dell’intervento pubblico.
-- [ENG]
The recent actions taken by the Italian Data Protection Authority against ChatGPT, a generative artificial intelligence system owned by OpenAI, prompt reflections on the role and ability of public authorities to support innovation while simultaneously protecting citizens. The interven- tions by the Privacy Authority shed light on the impact of an outdated regulatory framework, the European General Data Protection Regulation, on the regulatory delivery, thereby impeding the effectiveness of these measures in achieving their intended goals. Furthermore, the proposed European Regulation on Artificial Intelligence, with its rigid approach, fails to provide a definitive solution, as there is a need for ashift in the regulatory paradigm underlying public intervention.

Recensione - Rassegna trimestrale dell’Osservatorio AIR, n. XIII-2, Aprile 2022

Rassegna trimestrale dell’Osservatorio AIR, n. XIII-3, Luglio 2022

Rassegna trimestrale dell’Osservatorio AIR, n. XII-1, Gennaio 2021

in Studi Parlamentari e di Politica Costituzionale, anno 54, n. 209, 1 semestre 2021, pp. 137 – 156

Rassegna trimestrale dell’Osservatorio AIR, n. XII-4, Ottobre 2021