Is it time to consider AI legislation?
Debate around the potential uses and risks of Artificial Intelligence (AI) in the public sector has been ongoing for several years. While no regulation currently exists around AI in the UK, it could be timely for local authorities to look at upcoming regulation in other parts of the world and carry out an AI audit to consider what the future impacts could be.
AI is increasingly being used in the UK public sector to automate routine processes. Chatbots, for example, are now widely used to answer common questions. While there are currently no rules around the use of AI in the UK, we are starting to see other countries legislate. The Netherlands, for example, now requires public authorities to audit algorithms’ impact on human rights. The EU AI Act is expected by the end of June 2024.
One of the concerns commentators have raised is the possibility of AI introducing bias and discrimination into decision making processes. The Information Commissioners Office (ICO) recently carried out an inquiry into the use of AI in decision making around tasks such as benefit entitlement. It concluded that it found no evidence of discrimination or unlawful use of data but published some advice the public sector can take when using AI. Being aware of the potential risks and actions that can be taken to minimise these can be no bad thing whether there are legal repercussions or otherwise.
Although the detail is not yet set in stone, the EU’s AI Act is arguably the most detailed, developed, and wide-ranging proposal currently in existence. The UK government’s approach, as set out in a March 2023 white paper, is markedly different, demonstrating its desire to consolidate its role as the leading European AI hub with a US-aligned, regulation-light environment to boost productivity and attract innovative businesses to the UK. However, looking over the garden fence and paying attention to what our neighbours are doing can sometimes pay dividends.
Watching the development of the expected EU AI Act could provide local authorities and other organisations feeling unsure about the use of AI and its potential impact with some useful guidelines. Additionally, history has set a precedent of EU rules being adopted by other countries. The 2016 EU privacy legislation, the General Data Protection Regulation (GDPR), for example, has gone on to play a significant role in global privacy regulation. It is possible the EU AI Act may become the template by default simply because of the amount of time, expertise, effort, and resources which will have been channelled to bring it to fruition.
Local authorities deal with a multitude of personal data and AI is creeping into more parts of their operations, whether this is intentional or not and known or not. The law asides, the time may have arrived for greater vigilance around AI from an ethical standpoint. Responsible local authorities might want to start considering how they are already using AI and carrying out risk assessments of its use and impacts.
Although AI is tool which undoubtably offers a multitude of potential benefits for automating work within cash-strapped authorities, being aware of how this data informs decisions and ensuing the data is reliable, unbiased and being processed in compliance with GDPR – and perhaps other regulations coming down the road – is important to consider.
Sandip Patel KC is a Barrister with a specialty in cyber security law. He is also Director of the cyber security consultancy Quantum Resilience International and Chief Legal Advisor at OSP Cyber Academy. Sandip also sits on the board of the Cyber Centre of Excellence.
