Navigating Responsible Governance in Generative AI

Navigating Responsible Governance in Generative AI Presented By: Siddhant Chatterjee Date: 2024 Session Flow - Terminologies and Definitions - Risks associated with Generative Al Models - Regulatory Overview - Q&A Getting the Basics Right - Generative Al • Al systems specifically intended to generate, with varying levels of autonomy, content such as complex text, images, audio, or video (EU AI Act, Article 28 b (4)). - Foundation Models • An Al system model that is trained on broad data at scale, is designed for generality of output, and can be adapted to a wide range of distinctive tasks. (EU AI Act, Recital 60e). Subset of Generative Al systems. - Large Language Models (LLMs) • Foundation Models that have been explicitly trained on large amounts of text data for Natural Language Processing (NLP) tasks, to understand, summarize, generate and predict new text-based content. Risks of Generative AlΙ Adapted from Koshiyama et al. (2021) and Weidinger et al. (2022) - Bias and Discrimination - Robustness - Privacy - Misinformation Hazards - Malicious Use - Human-Computer Interaction (HCI) Harms - Automation and Environmental Harms - Efficacy The EU AI Act - Initial versions did not explicitly seek to govern foundation models, partly due to lack of public awareness and relative novelty of the technology - Multipurpose and dynamic nature of these models did not fit with the EU AI Act's 'UseCase Approach', signaling the need for adaptive iteration - Interest in these models skyrocketed after the implosion of ChatGPT, Bard, Midjourney applications (December 2022), prompting regulatory movement - On 14 June 2023, the European Parliament passed the latest iteration of the EU AI Act, introducing a new section -- Article 28 b, to specifically govern foundation models and generative AI Article 28 b - In line with 2019 OECD Principle: "Al should be robust, secure and safe throughout its lifecycle so that it functions appropriately and does not pose unreasonable safety risks" - Nine ex-ante obligations on providers • Risk Identification • Data Governance • Maintenance of Performance, Safety, Cybersecurity • Monitoring and mitigating environmental impact • Cooperation with downstream providers • Quality Management System • Technical Documentation for 10 years • Obligations for providers of Generative Al systems - Providers need to ensure compliance through: • Risk Identification  Identification, reduction and mitigation of reasonably foreseeable risks through appropriate design, testing and analysis • Data Governance  Incorporation of only those datasets that are subject to appropriate data governance measures to ensure mitigation of bias • Baseline Conformance  Ensure appropriate levels of performance, predictability, interpretability, corrigibility, safety and cybersecurity through model evaluation mechanisms • ESG  Develop foundation models, making use of relevant standards on reducing energy use, resource use and waste, as well as to increase energy efficiency, and the overall efficiency of the system - Support Downstream Compliance: Enable ease of compliance for downstream providers through extensive technical documentation and intelligible instructions for use - Establish a Quality Management System (QMS) to ensure and document compliance - Register foundation models in the EU database (Article 60) - Documentation: Maintain and keep technical documentation at the disposal of national competent authorities for a minimum period of 10 years since placing the product in the EU market - - Additional obligations for Generative Al providers: • Ensure compliance with transparency obligations in A 52(1), • Develop safeguards to ensure content generated does not violate EU Law, and • Publish a summary on the use of training data under copyright law Exemption to Article 28 b: Pre-trained models designed for "narrower, less general, more limited set of applications" should not be considered foundation models due to their greater interpretability and predictability (Recital 60 g) - Greater onus on providers: (Recital 60 f) • If access to downstream operators is provided through an API, providers of foundation models must support and cooperate with their regulatory compliance throughout a system's lifecycle • However, if API access is restricted, or if the training model with datasets has been completely transferred - onus of compliance is solely on the downstream operator - Inherently iterative: Acknowledging complexities in the foundation model ecosystem, the Commission and proposed Al Office are responsible for periodically monitoring and assessing the legislative and governance framework, considering roles, expertise, and audit mechanisms. The UK's Approach - Light-touch, Pro-Innovation approach - Al Regulation Whitepaper, Department of Science, Innovation and Technology - • Integration of Al Assurance tools • Central Risk Function Sectoral Regulatory Initiatives • Ofcom: What Generative Al means for the communications sector • Information Commissioner's Office: Eight questions that developers and users need to ask • Competition and Markets Authority: Al Foundation Models: Initial Report • Financial Conduct Authority: Our Emerging Regulatory Approach to Big Tech and Artificial Intelligence - Safety, security, and robustness - Contestability and redress - Transparency and explainability - Accountability and governance - Fairness - Frontier Al Taskforce - Al Safety Summit - Department of Education Call for Evidence on Generative Al - House of Lords Call for Evidence on Large Language Models (LLMs) United States – Federal Initiatives - Relatively decentralized and industry-driven approach - Blueprint for an Al Bill of Rights - Al Disclosure Act, 2023 • Single requirement, where any output generated by artificial intelligence should be accompanied with a disclaimer stating "this output has been generated by artificial intelligence". - National Telecommunications and Information Administration (NTIA) Public Comments on 'Earned Trust' in Generative Al Systems - Action by Regulators State-level Regulatory Initiatives - Massachusetts Senate Bill No. 31 • Drafted using ChatGPT, seeks to protect the "public's safety, privacy and intellectual property rights" against risks posed by GenAl. • Six Operating Standards for Operators of large- scale GenAl systems: Preventing Discrimination, Watermarking, Data Security, Informed Consent and Purpose Limitation of Data usage, and Risk Assessments • Operators will also register their models with the Attorney General within 90 days of Act enforcement. - California Executive Order N-12-23 on Artificial Intelligence • Examination of Use-Cases: State Agencies and Departments required • to report most significant potentially beneficial use-cases for GenAl implementation within 60 days of order issuance. • Risk Analysis: Agencies expected to complete risk analysis on potential threats and vulnerabilities of California's critical infrastructures related to GenAl by March 2024. • Requirements for State Agencies:  Submit an inventory of high-risk Al use-cases Establish sandboxes to bolster innovation  Develop guidelines on conducting impact assessments associated with GenAl use for government workforce, vulnerable communities, etc. Costa Rica - Like Massachusetts SB-31, Bill No. 23771 (The Law of Regulation of Artificial Intelligence in Costa Rica), was also drafted using ChatGPT - Seeks to establish a dedicated independent authority for Al systems used in Costa Rica, guided by principles such as accountability, explainability, bias and protection of human rights - Provisions to be detailed through extensive public consultation and parliamentary revisions China Administrative Measures for Generative Artificial Intelligence Services, 2023 - Prescribes measures for developers on Data Governance Training Data Quality, Bias and Transparency - Directs entities to ensure that generated synthetic content is in line with "Chinese Societal Values", free of misleading information and copyright infringements - Mandates Ex-ante Independent/Third-Party Security Assessment in line with the Cyberspace Administration of China's Assessment Provisions - Mandates providers to take measures to prevent discrimination in training data, proactively filter and remove inappropriate content, label synthetic media in accordance with China's Deep Synthesis Provisions on Deepfakes. Looking Ahead - Distinct regulatory ecosystems reflect varying priorities - Regulatory Divergence is important - There is no 'right' regulatory strategy - Importance of global alignment and consensus on taxonomy, policy tools and assessment criteria