AI, data, digital strategy: the European Commission releases three key documents

On 19 February, the European Commission adopted during its College Meeting three documents which will shape Europe's digital policies in the coming years.

The European Commission notably envisages mandatory requirements for high-risk AI applications. Testing and certification would be needed before such AI products or systems are placed on the EU market. 

Please find below the links and briefings of each of these documents.

White Paper on Artificial Intelligence

The European Commission defines recommendations to create both an ecosystem of excellence and an ecosystem of trust.

N.B.: This White Paper does not address the development and use of AI for military purposes.

A) An ecosystem of excellence

Europe should notably expand its positions along the value chain, from certain hardware manufacturing sectors to software and services. The EU will use its funding programmes and investment funds to stimulate private and public investment. The EU plans to attract over 20 billion euros of total investment in the EU per year over the next decade. A new public private partnership in AI, data and robotics will be set up.

The EU will attract more talents and have a network of centres of excellence. It needs a “lighthouse centre of research and innovation to coordinate the efforts”. It will also support the development of adequate skills.

Industry, health, transport, finance, agri-food value chains, energy/environment, forestry, earth observation and space are mentioned as sectors where Europe has the potential to become a leader in AI.

B) An ecosystem of trust

Safety

The European Commission also published a report on the safety and liability implications of Artificial Intelligence, the Internet of Things and robotics.

On the basis of such report, the Commission is looking at EU product safety legislation and considers the following amendments:

-new risk assessment to address risks that arise when an AI product or system is already placed on the market (for instance following a software update)

- explicit obligations for producers in respect of mental safety risks of users when appropriate (ex. collaboration with humanoid robots)

- specific requirements addressing the risks to safety of faulty data at the design stage as well as mechanisms to ensure that quality of data is maintained throughout the use of the AI products and systems

- transparency requirements to avoid opacity of systems based on algorithms

- existing rules may need to be adapted and clarified in the case of a stand-alone software placed as it is on the market or downloaded into a product after its placing on the market, when having an impact on safety

- given the increasing complexity of supply chains as regards new technologies, provisions specifically requesting cooperation between the economic operators in the supply chain and the users could provide legal certainty

The Commission notes that the General EU safety legislation currently applies to products and not to services -therefore in principle not to services based on AI technology either.

Liability

The Commission also considers amending current liability rules in order to protect the victims’ right to compensation, which can be difficult to exercise when it comes to AI -as it might be challenging to prove a defect in the system, and the causal link between the defect and the damage.

The Commission explains that all options should be carefully assessed, including possible amendments to the Product Liability Directive and possible further targeted harmonisation of national liability rules. For example, the Commission is seeking views whether and to what extent it may be needed to adapt the burden of proof required by national liability rules for damage caused by the operation of AI applications.

Mandatory requirements for high-risk AI applications

The Commission envisages mandatory requirements for high-risk applications. AI application are considered high-risk if 1) the sector and 2) the intended use involve significant risks. For instance, this would include surgery robots or autonomous cars. An exhaustive list of the sectors should be drafted and periodically reviewed.

However, the use of AI for certain purposes will always be considered high-risk, irrespective of whether these two criteria are fulfilled. This is the case for recruitment, biometric identification and other intrusive surveillance technologies.

Mandatory requirements for high-risk AI applications will be specified through standards. These requirements would include:

- EU’s values and rules must be respected when it comes to the data used to train AI. The aim is to avoid unsafe (because not sufficiently/adequately trained) or biased AI.

-records must be kept in relation to the programming of the algorithm, the data used to train high-risk AI systems and, in certain cases, the data themselves must be kept. This would allow problematic actions or decisions by AI to be traced back and verified.

-information provision: clear information must be provided on the AI’s systems capabilities and limitations. Moreover, citizens must be informed when they are interacting with an AI system and not a human being (except when it is an obvious situation).

-requirements relating to robustness and accuracy, including requirement ensuring that AI systems are resilient both over attacks and attempts to manipulate data or algorithms.

-high-risk applications must be overseen by humans, the degree of oversight depending on the specific application.

-specific requirements for remote biometric identification: the Commission explains that the gathering and use of biometric data for remote identification purposes, for instance facial recognition in public spaces, carries specific risks for fundamental rights. AI can only be used for remote biometric identification purposes where such use is duly justified, proportionate and subject to adequate safeguards. Regarding facial recognition in public spaces, the Commission will launch a debate on the specific circumstances, if any, which might justify such use, and on common safeguards.

These requirements should be applicable to all relevant economic operators, regardless of whether they are established in the EU or not.

The European Commission believes that it is necessary to test and certify high-risk AI applications before they reach the single market, to ensure that they comply with the above-mentioned requirements. Conformity assessment could include checks of the algorithms and of the data sets. As some AI systems evolve over time, it might be necessary to repeat assessments over the lifetime of such AI systems.

Conformity assessment would be mandatory for all economic operators addressed in the requirements, regardless of their place of establishment. Standards and dedicated online tools could facilitate compliance.

Economic operator established in third countries could make use of designated bodies established in the EU or, subject to mutual recognition agreements with third countries, use third-country bodies designated to carry out such assessments.

Voluntary labelling for no-high risk AI applications

On a voluntary basis, economic operators not covered by the mandatory requirements could still decide to comply with those requirements or a set of similar requirements designed for this voluntary scheme. They would then be granted a quality label.

Next steps:

The Commission invites for comments on the proposals set out in the White Paper through an open public consultation available at https://ec.europa.eu/info/consultations_en.The consultation is open for comments until 19 May 2020.

European strategy for data

This communication is a complementary piece to this AI strategy. It sets the framework for businesses and public services to be able to use data generated by the public and private sector. The European Commission wants to create a European Data Space with different data pools, both sectoral and cross-sectoral.

The European Commission underlines that the widespread use of data-fuelled products and services requires the highest cybersecurity standards. Therefore, the Cybersecurity Act, notably certification, and ENISA are expected to play an important role.

The European Commission will:

-create a framework for the governance of common European data spaces. These governance structures should support decisions on what data can be used in which situations, facilitate cross-border use and prioritise interoperability requirements and standards.

-invest in a High-Impact Project on European data spaces and federated cloud infrastructures, which will establish EU-wide common interoperable data spaces in strategic sectors. The project will fund infrastructures, data-sharing tools, architectures and governance mechanisms. The project will be funded by the EU (different spending programmes), Member States and industry. Total funding would be 4-6 billion euros, of which the EU would finance 2 billion euros.

-making more high-quality public sector data available for re-use, in particular for SMEs, via an implementing act pursuant to the Open Data Directive.

-consider adopting a Data Act to foster horizontal data sharing across sectors, including business-to-government and business-to-business data sharing.

-ensure that companies which sell goods or services related to the data-agile economy in the EU respect EU legislation. This should not be compromised by jurisdictional claims from outside the EU (the strategy mentions the US CLOUD Act).

-create a coherent self-regulatory framework for cloud service providers operating on the EU market (the cloud rulebook) which will gather existing cloud codes of conduct and certification.

-facilitate the development of common European standards and requirements for the public procurement of data processing services.

-facilitate the setup of a cloud services marketplace for EU users from the private and public sector. Service providers will have to use transparent and fair contract conditions to take part in this marketplace.

-potentially support the creation of “personal data spaces” (enable citizens to control their data), through Digital Europe.

-create a European analytical framework for measuring data flows.

Common European data spaces in strategic sectors and domains of public interest

The Commission will support the establishment of the following nine common European data spaces:

· A Common European industrial (manufacturing) data space,

· A Common European Green Deal data space.

· A Common European mobility data space,

· A Common European health data space,

· A Common European financial data space,

· A Common European energy data space,

· A Common European agriculture data space,

· A Common European data spaces for public administration,

· A Common European skills data space.

The Commission may consider launching additional common European data spaces in other sectors.

Next steps:

Q3 2020: Memoranda of Understanding with Member States, starting with those having existing cloud federation and data-sharing initiatives

Q4 2020: legislative framework for the governance of common European data spaces

Q4 2020: analysis of the importance of data in the digital economy, and review of the existing policy framework in the context of the Digital Services Act package

Q1 2021: Implementing act on high-value data sets under the Open Data Directive

Q4 2021: creation of a European analytical framework for measuring data flows

2021: potential Data Act

Q2 2022: cloud rulebook

Q4 2022: setup of a cloud services marketplace

Shaping Europe’s digital future (digital strategy)

The European Commission states that “European technological sovereignty starts from ensuring the integrity and resilience of our data infrastructure, networks and communications”.  Europe must also develop and deploy its own key capacities, hence reducing dependency on third countries for critical technologies. The Commission underlines that Europe will remain open but foreign players need to abide to European rules and standards.

Moreover, the Commission highlights that Europe must lead in the standardisation process of the new generation of technology: blockchain, supercomputing, quantum technologies, algorithms and tools to allow data sharing and data usage. The European Commission will deliver a strategy for standardisation in Q3 2020.

The European Commission defines three objectives:

-Technology that works for people: Europe needs to pool investments in research and innovation and needs to invest more in strategic capacities, such as 5G networks and deep tech (quantum, supercomputing, blockchain, secure cloud). EU funding (Digital Europe, Connecting Europe Facility, Horizon Europe), Invest EU and the Capital Markets Union will be used to achieve these goals.

The European Commission underlines that consistent rules on cybersecurity are needed, as well as stronger mechanisms for proactive information-sharing. As part of its key actions, it lists the review of the NIS Directive and a push to the single market for cybersecurity.

-A fair and competitive economy, where market power cannot be used to block competition and profits are taxed where they are made. The Commission is currently checking whether the Commission’ 2014 Important Projects of Common European Interest (IPCEI) Communication needs to be updated to clarify under which conditions Member State-led projects in strategic sectors can proceed.

-An open, democratic and sustainable society where platforms are accountable for their content and technologies serve the green transition. The European Commission also mentions the issue of trust in the online world, stating that people should be able to control their online identity when authentication is needed. “A universally accepted public electronic identity (eID) is necessary for consumers to have access to their data and securely use the products and services they want without having to use unrelated platforms to do so and unnecessarily sharing personal data with them.” Among its key actions, the European Commission lists the revision of the eIDAS Regulation to improve its effectiveness and extend its benefits to the private sector.

Finally, the ICT sector needs to become greener: data centres and telecommunications will need to become more energy efficient, reuse waste energy, and use more renewable energy sources. They should become climate neutral by 2030.  ICT equipment needs to be energy-efficient and fully circular.

For any questions on this issue, do not hesitate to contact Camille Dornier: camille.dornier@eurosmart.com