Regulating Under Uncertainty: Governance Options for Generative AI

Effective regulation of emerging technologies inevitably presents legislators with a set of difficult choices. If they act aggressively to mitigate all hypothetical risks, they might inhibit the development of the technology. If they act too conservatively at the outset, they might miss the chance to steer the industry toward the safe development of the technology and away from foreseeable harms. These choices must also be made at a time when the knowledge and expertise about the technology resides mostly in the private sector. As a result, governments often do not have the necessary expertise to design and enforce a new regulatory regime.

Proposed and existing government regulation occurs along a continuum, from a laissez faire model, that mostly characterizes the United States, to a more command-and-control model characteristic of traditional forms of regulation, with China at the extreme opposite pole from the U.S. In the middle are different degrees of co-regulation, such as that prevalent in the European Union, in which governments exist in a dialogic relationship with companies to respond incrementally to new developments and discovered harms from the technology. 

Although no consensus has yet emerged as to the transformational potential of the current crop of generative AI, few dispute its widespread economic and social impact. Of course, some of these benefits are also viewed as risks or costs. AI’s transformation of the economy, like all previous technological transformations, will come with massive job displacement. And while AI may help find ways to mitigate climate change and energy shortages, the building of massive data centers and the training of new models promises to significantly increase energy demands in the short term due to the buildout of AI technology.

Disinformation threats from synthetic imagery, an explosion in virtual child pornography, scams using voice mimicking technology to defraud unsuspecting victims, discrimination and bias in AI algorithms, and a host of problems due to vulnerabilities to jailbreaking and inaccurate responses provided by chatbots are just a few of the problems already presented by existing generative AI tools. As these tools are rolled out for use in law enforcement, criminal justice, judicial process, employment, education, healthcare, and any number of other domains, both the malfunctioning of the systems and their abuse by bad actors cautions against overreliance on AI and wholesale replacement of human oversight of these processes.

Those who warn of the societal impacts from AI are alarmed by the potential for catastrophic harms —from novel viruses and new weapons to uncontrollable AI agents and cyberattacks. Early in the immediate aftermath of ChatGPT, leading AI scientists and business leaders called on governments to begin addressing collectively the problems of new existential risks posed by AI. However, experts remain divided on the plausibility of “loss of control” scenarios, where a highly intelligent “rogue AI” could surpass human oversight and potentially spiral out of control. And critics of that concern over future existential risks suggest focus should be placed instead on the immediate and tangible risks posed by generative AI that require government action. 

Government regulation of some kind is inescapable, if only to clarify how existing laws will apply to the newest technologies. The most significant and comprehensive piece of legislation passed thus far with respect to AI is the EU’s AI Act. The AI Act regulates AI systems based on risk levels and use cases, particularly in sensitive sectors. The Act categorizes risks based on the “intended” use of AI systems and classifies them into four risk categories: unacceptable risk, high risk, limited or “transparency” risk, and minimal or no risk. Depending on the risk level involved in the application, different legal requirements will apply. During the negotiation process over the AI Act, provisions were added to regulate general-purpose (i.e., foundation) models, shifting the focus from specific use cases to the technology itself. General-purpose AI models posing systemic risks must comply with additional obligations related to cybersecurity, red teaming, risk mitigation, incident reporting, and model evaluation.

Although the United States may be characterized as having a “hands-off” regulatory approach, either through the courts or through legislation, some regulation will be necessary. For now, most of the action in the US has occurred either in the executive branch or in the states. In addition to securing voluntary commitments from the major AI companies, the Biden administration issued Executive Order 14110, which outlines eight guiding principles and policy priorities for federal agencies and authorities. The absence of a comprehensive legal framework has prompted some individual states to enact their own AI-related legislation, addressing issues such as deepfakes and algorithmic discrimination. Perhaps the most significant proposal, California's pending “Safe and Secure Innovation for Frontier Artificial Intelligence Models Act,” would impose significant compliance obligations on AI developers.

This chapter examines the AI regulatory approaches of other countries. China has implemented a series of laws that place significant restrictions on AI development. Other countries, such as Brazil and Canada, are actively engaged in formulating regulatory frameworks for AI. In contrast, countries like Japan and India initially refrained from enacting specific AI legislation but are now gradually progressing towards its adoption. The United Kingdom, while recognizing the risks and challenges associated with AI, particularly its most advanced models, has thus far chosen not to introduce specific AI legislation, though this stance may be reconsidered in the future.

Several high-level principles and observations emerge from this exploration of the different national and international initiatives related to AI:

* Regulation of the technology or its applications. Sector specific laws allow AI regulation to work incrementally and adapt laws in narrow ways to the changes made by AI. However, due to the uncertain reach and implications of AI technology and the development of general-purpose AI models, regulating the technology itself is particularly important.   

* The importance of transparency and auditing. Because the impacts of generative AI are unknown, transparency in the development of this technology is critical.  To fully understand the implications of foundation models and generative AI applications, both developers and external third parties must rigorously test them prior to deployment.

* The importance of enforcement. Enforcement will prove as important, if not more so, than legislation. This will require governments to hire AI talent and coordinate with companies and civil society to provide continuous guidance on how the rules on the books apply to new and emerging contexts.

* The relative power of the public and private sectors. The need to collect vast amounts of data, the scarcity of chips, and the high costs of computation have concentrated the resources required to develop and train the most powerful models in the hands of a few private companies. To “democratize” the production of AI may require massive public investment to ensure that other actors will be able  produce the most cutting edge AI models.

* The promise and risks of open models. Open-source models might create a competitive environment, quite different from that of social media and search engines, which have been controlled by a few oligopolistic actors.  However, once these models are released, they can be used and fine-tuned by bad actors for all kinds of intended and unintended purposes. Moreover, once they are “out the door,” there is little that the companies or governments can do to control their impact. Government regulation in this space must address the relative risks and benefits posed by open-source models.