AFFs weak regulatory framework spurs AI innovation – only the CPs complete ban avoids it.

In order to extend this analysis, it is useful to compare the draft EU AI regulation to the GDPR [22]. The GDPR is not supported by standards, however it does allow for third-party GDPR certifications to be awarded. These certification schemes do not provide presumption of conformity with GDPR [1]. Such certification schemes have also been slow to manifest, and there is only one that is endorsed by the European Data Privacy Board [20].

The complaint-based and enforcement-led approach of GDPR means that levels of compliance are determined by each organisation’s judgement of the risk and impact of fines and reputational damage, and limited by the number of resources available to data protection authorities. Additionally, there is growing evidence that GDPR has resulted in less competition in some areas, and favoured large online platforms [23]. One of the reasons for this is that companies are less willing to trust smaller companies with data, as it may impact their own compliance [24]. Consequently, the decision to use regulations without standards has had a substantial impact on innovation in the uncertain data sector. It should be acknowledged, however, that this impact has not only been negative. The emergence of privacy-enhancing technologies is linked to the GDPR, and represents a positive impact of the regulation on innovation.

Many innovative developments come from small enterprises, who have some advantages over larger companies [35] [8] [21]. However, one disadvantage that startups usually have is a lack of financial resources. As Forbes magazine pointed out [32], the legislation is deliberately vague — much like the EU’s proposed AI act it is vague in order to remain future-proof. The result of this is that many large firms are spending as much of 40% of their GDPR compliance budget on legal advice in order to interpret the meaning of many of the requirements. Clearly, smaller firms are less able to rely on legal advice, and less able to pay fines if the legal advice is not supported by decisions by the regulators.

In contrast, the proposed AI Act is based on conformity assessment processes prior to placing a product on the market. Conformity assessments require clear and unambiguous technical standards. Such standards are obtainable by businesses for a negligible fee. Conformity assessments come at a cost, but not a significant cost compared with the cost of actually complying with the requirements [19], or obtaining expensive legal advice.4

Innovative businesses that remain unclear about compliance can participate in regulatory sandboxes, expected within each member state, that allow a “safe space” to work with regulators on innovation. Since the UK Financial Conduct Authority launched its sandbox in 2016, it has supported more than 700 firms and increased their average speed to market by 40% compared with the regulator’s standard authorisation time [33]. However, sandboxes are limited by a number of factors. Firstly, the willingness of companies to subject themselves to regulatory scrutiny before they need to. Secondly, the ability of companies to share data with regulators. While the proposed EU AI Act modifies the GDPR to allow companies to process data in order to comply with aspects of the regulation, the sandboxes are expected to be in operation long before the proposed AI Act.

Also, as previously noted, regulation in some areas has sparked innovation. It is likely similar innovations will result from AI regulation, this may be in technical compliance and post-market monitoring, and may be in the creation of new kinds of roles and professions to help govern AI systems. Early work by standardisation bodies to define the criteria for competent persons to assess AI systems indicates that no single person is likely to have all the skills required - as this encompasses a diverse set of socio-legal-technical competencies. Technical resources are unaccustomed with considering legal and ethical requirements, legal experts rarely have data science skills, and AI ethicists are more focused on the broad and long-term impacts of AI systems on individuals and society. Therefore, a comprehensive assessment of AI systems requires a team of experts from different disciplines, including technologists, legal and ethical experts. The development of this multi-disciplinary expertise and the establishment of new processes to combine and integrate them within organisations might be one of the major innovations brought about by the regulation of AI.