Regulating future AI systems - enabling future AI innovation through an increased level of legal certainty in technology neutral regulation

Academy of Finland project 09/2022-08/2026, grant number: 347221

In the AI-REG project we study ambiguity that arises from the European Artificial Intelligence Act proposal (AI Act) that has been proposed by the European Commission in April 2021. The AI Act will regulate the development and use of AI systems in Europe. Political agreement between the European Council and the European Parliament has been reached in December 2023, the AI Act was voted on by the 27 EU member states on 2.2.2024 and received full support, and the wording of the AI Act will be finalized in spring 2024. After the expected adoption of the AI Act in late spring 2024, it will enter into force in different stages starting from end of 2024.

The underlying goal of the AI Act is to ensure that Europeans could trust  AI systems. The AI Act distinguishes 4 risk classes of AI systems: unacceptable-, high-, limited-, and minimal risk. AI systems which would be judged to have unacceptable risk would be outright forbidden, and high-risk AI systems would have to conform to requirements both during development of the system and in the use of such a system. In addition, in the later stages of negotiations about the AI Act, also general purpose AI models were taken into the scope of the AI Act. The AI Act is thus expected to heavily affect the development and use especially of high-risk AI systems. However, the AI Act is also ambiguous/unclear on many parts, beginnig with the definition of what will be classified as an AI system, or how a specific system would be classified as high-risk vs. low-risk system. Ambiguity means that something can be interpreted in several different ways, and ambiguity in legal regulation - although being an integral part or feature of law - is potentially problematic as it reduces legal certainty.

The AI Act is a horizontal and broad regulation proposal. In the AI-REG project we have two focus areas: 1) High risk AI-system use in public sector organizations, and 2) Development of (high-risk) AI-based healthcare technology.

In the AI-REG project, we study

  • What kind of ambiguities arise from the AI Act
  • What challenges and critiques are seen in the context of the AI Act
  • What legal formulations and requirements cause the ambiguity
  • What characteristics of AI systems make an AI system subject to ambiguity
  • How does regulation affect development of AI-based healthcare technology and AI-system use in public sector organizations
  • How to organizatios prepare for the upcoming AI Act, and how do they deal with ambiguity arising from the Act?

In the AI-REG project, we have a qualitative research approach

  • Identification of ambiguity/unclarity that different stakeholders identify in the AI Act
  • Interviews in mostly in Finland, but also Sweden and Norway, with 1) public sector organizations that use AI systems, and 2) organizations that develop AI-based healthcare technology, 3) ministries, and 4) other stakeholders of interest.
  • Study how focus organizations interpret the AI Act and deal with the uncertainty that arises from the AI Act regarding requirements of compliance
  • Study whether it is possible to develop a taxonomy of AI systems in the light of the AI Act that would help determine whether an AI system is in or out of the AI Act's scope and which risk category it falls into.

The People

Karin Väyrynen, Ph.D. (Principal Investigator) Arto Lanamäki, Ph.D Fanny Vainionpää, Ph.D.

                         .                     

Heidi Hietala, MSc

doctoral researcher          

Erkki Tervo, MSc

doctoral researcher    

News

19.04.2024: We shared some of our findings on the AI Act and how Finnish public Sector organizations approached the AI Act in a workshop organized for Norwegian public sector organizations by Skatteforsk (Centre for Tax Research) and the AI4Users projects.

18.04.2024: Karin and Arto had the pleasure to give a guest lecture in Lauri Tuovinen's course "AI Ethics, Privacy and Legislation" (https://opas.peppi.oulu.fi/en/course/521256S/16805?period=2023-2024), where we talked about the AI Act and what it means for organizations, discussed ambiguity stemming from the AI Act at this stage and what kind of mechanisms can be expected to arise around the AI Act that help organizations move forward amidst that ambiguity, and what the overlap between legal regulation and ethics is.

16.04.2024:We are happy to have two papers accepted at the European Conference on Information Systems (ECIS)! One paper addresses challenges related to the AI Act conceptualization of AI systems as having a specific intended purpose, which was challenged through the arrival of chatGPT and heavily influenced the policy process of the AI Act (Lanamäki et al., 2024).. The other paper addresses different practices that Finnish public sector organizations engaged in when anticiating the future AI Act, and we found that organizations operate both under regulatory shifts and uncertainty related to what the AI Act will look like in the end and uncertainty about how it then will be interpreted (over time), but also under uncertainty related to future technological development in the context of AI. They form expectations about the AI Act, map responsibilities, consider governance and stragizing, but also pro-actively seek to influence the future.  (Vainionpää et al., 2024).

26.02.2024: Today, we gave a talk at the ICT Research Breakfast at the Faculty for Information Technology and Electrical Engineering, University of Oulu, on the AI Act. We had more than 50 participantes on-site and on-line, and some really inspiring discussion.

"Have you heard about the EU AI Act? It's a forthcoming EU regulation on artificial intelligence that all 27 member states approved this month. This regulation aims to prevent AI risks by supporting the development and deployment of trustworthy AI Made-In-Europe. Our presentation will briefly introduce the AI Act and discuss the main compliance concerns for organizations working with AI. We'll also cover the challenges of regulating rapidly evolving AI technologies, focusing on general-purpose AI systems that significantly influenced the AI Act process. Additionally, we'll discuss how legal compliance should be understood under the open texture of law. We are currently studying the AI Act and related ambiguity and uncertainty in our ongoing Academy-project (AI-REG, 2022-2026)."

21.10.2023: We were happy to welcome Prof. Mika Viljanen, Professor of private law at the University of Turku, who gave a 2-day Infotech-seminar called "AI regulation for non-lawyers". Thank you, Mika, for sharing your expertise with us and a very interdisciplinary group of participants! :)

10.10.2023: Karin participated in a 2-day visit to the European Parliament, arranged by MEP Miapetra Kumpula-Natri. 2 days full of expert talks by those who have been and are involved in negotiating the AI Act, new insights into the process and the latest status updates, and so so many interesting discussions with all the other expert participants. I am very grateful to have been invited to this! <3  Some pictures can be found here

03.10.2023: Good news from ICIS - our literature review on challenges and critique about the AI Act, with propositions for new research avenues for IS, has been accepted at the International Conference on Information Systems, which will be held in December in India. 

14.10.2023: The reserach visit to Sydney has been fantastic!! Some impressions can be found here

01.10. 2023: Karin and Arto landed in Sydney to start their 2 week research visit with Prof. Lyria Bennet Moses (University of New South Wales, Department of Law and Justice). They are looking forward to exciting discussions with legal scholars, and will also visit the University of Sydney School of Business (Prof. Dirk Hovorka) and look forward to discussions with IS scholars as well.     

05.-12.05.2023: Arto has visited Legal Tech Lab (hosted by Prof. Riikka Koulu and Prof. Suvi Sankari), and has had numerous discussions with legal scholars which was an eye-opening experience and has a big influence on the direction the project will go.                                                                

Articles

  • Lanamäki, A., Väyrynen, K., and Vainionpää, F. (2024). The European Union's Regulatory Challenge: Conceptualizing Purpose in Artificial Intelligence. European Converence on Information Systems (ECIS), forthcoming
  • Vainoinpää, F., Väyrynen, K., Lanamäki, A., and Parmiggiani, E. (2024). Practices of Anticipation: How Public Sector Organizations Anticipate Artificial Intelligence and Its Regulation. European Converence on Information Systems (ECIS), forthcoming
  • Vainionpää, F., Väyrynen, K., Lanamäki, A., and Bhandari, A. (2023). A Review of Challenges and Criticisms of the European Artificial Intelligence Act. Proceedings of the International Conference on Information Systems (ICIS). https://urn.fi/URN:NBN:fi:oulu-202402061598
  • Väyrynen, K.,  Lanamäki, A., Laari-Salmela, S., Iivari, N., Kinnula, M. (2022) Policy Ambiguity: a Problem, a Tool, or an Inherent Part of Policymaking? Proceedings of the International Conference on Informaiton Systems (ICIS), Copenhagen, Denmark.   AIS Electronic Library (AISeL) - ICIS 2022 Proceedings: Policy Ambiguity: a Problem, a Tool, or an Inherent Part of Policymaking? (aisnet.org)
  • Konttila, J., Väyrynen, K. (2022). Challenges of current regulation of AI-based healthcare technology (AIHT) and potential consequences of the European AI Act proposal. Proceedings of the 13th Scandinavian Conference on Information Systems (SCIS), Denmark. jultika.oulu.fi/Record/nbnfi-fe2022092059659

Master's Theses

Upcoming and Past Seminars

  • "How to publish in top-IS journals" by Prof. Mikko Siponen (The University of Alabama, USA): 16.-17.5.2024, University of Oulu, Infotech seminar
  • "AI Regulation for Non-Lawyers" by Prof. Mika Viljanen (University of Turku, Finland): 20.-21.11.2023, University of Oulu, Infotech seminar
  • "AI-Enabled Futures" by Prof. Dirk Hovorka (University of Sydney, Australia): 19.+20.6.2023, University of Oulu. Infotech seminar