CDT Europe’s AI Bulletin: October 2024

A Roadmap for the AI Act’s Scientific Panel of Independent Experts

This month, the Commission formally opened a consultation on a draft implementing act that will create rules for establishing and operating the scientific panel of independent experts. The panel  — a key component of the AI Act’s enforcement ecosystem — will assist the AI Office and national market surveillance authorities with implementing and enforcing the AI Act. As we highlighted in a prior analysis, the panel and the AI Board are the only two oversight entities that the Act empowers to act on their own initiative. Namely, the panel will be able to formally request that the Commission require documentation from a general-purpose AI model provider, and to alert the Commission to risks posed by general-purpose AI models.

The draft implementing act limits the panel to 60 individual experts, who will be selected to two-year terms following an open call for expressions of interest, with a reserve list in place. Experts must be independent from any AI systems or GPAI model provider; and expertise in applied sectors such as fundamental rights and equality will be considered. 

The panel will be supported by a Secretariat made up of the AI Office and the Joint Research Centre. To carry out any of the tasks foreseen by the AI Act, the Secretariat will appoint specific rapporteurs or contributors from the panel’s membership. Members will only be remunerated if exercising a rapporteur or contributor function at the request of the AI Office. 

Building on the AI Act’s provisions, which enable the scientific panel to issue qualified alerts to the Commission on general purpose AI (GPAI) models, the draft implementing act requires that those alerts only be issued once endorsed by a qualified majority of panel members. Similarly, the draft implementing act requires that requests to the Commission to access documentation held by a GPAI model must be supported by one-third of the membership of the panel.

The call to respond to the consultation closes on 15 November 2024.

In other AI Act milestones:

• The deadline for Member States to nominate fundamental rights authorities with powers under the Act is fast approaching. By 2 November, states must identify the public authorities or bodies with a fundamental rights mandate — including non-discrimination — which will have powers under the AI Act to request and access any documentation created pursuant to the AI Act, through national market surveillance authorities
• On 23 October, the AI Office held the first workshop exclusively for GPAI model providers under the Code of Practice process. While the workshop was closed to other participants to the Code of Practice process, the AI Office has committed to share high-level minutes to plenary participants. You can read a top-level overview of the Code of Practice process on our website.
• The EU’s Joint Research Centre outlined the role and scope of harmonised standards in facilitating compliance with the AI Act’s obligations on high-risk AI systems. Preparation of these standards – covering risk management and data governance, among other topics — is currently underway by the European Standardisation Organisations following an official request by the European Commission issued in May 2023. After being assessed and published in the Official Journal of the EU, standards will confer providers of high-risk AI systems with presumption of conformity with the relevant legal obligations. Standards must be in place by August 2026, when obligations are set to apply to high-risk AI system providers.

A Clear Pro-Innovation Focus for the Commissioner-Designate Leading on Tech

Ahead of the hearings organised by the European Parliament to confirm the designated European Commissioners, nominees have shared their written responses. Commissioner-designate Henna Virkkunen, slated to be the European Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy, took a decidedly industry-friendly approach. She endorsed a “paradigm shift” towards bolstering EU competitiveness, and shared her vision for the EU to become “the AI continent”, calling for “lowering the threshold” for European businesses to adopt AI and “decreasing [their] compliance burden”. Virkkunen did leave room, though, for “innovation-friendly” legislation to be proposed when “necessary”.  She outlined the Cloud and AI Development Act, for instance, as an instrument for attracting investment in computing infrastructure and data storage, centering cloud computing and infrastructure as a key element. The Commissioner-designate also hinted at potential copyright law reform, noting that she would “consider” the need to improve the existing EU copyright framework in light of AI-generated content.

Virkkunen’s answers notably spoke to questions left open by the mission letter she received from Commission President von der Leyen, underscoring the AI Act’s timely and predictable implementation as a key priority, and committing to uphold fundamental rights to the highest standards in enforcing legislation. This commitment stands somewhat in tension with the position the Commissioner-designate expressed on data protection — a recognised right in the EU — in the same document, where she calls for the data protection framework to remain “in line with the digital transformation” and responsive to commercial and law enforcement needs, while maintaining the same high standards of data protection.

Michael McGrath, Commissioner-designate for Democracy, Justice and Rule of Law, similarly tackles AI in his answers, noting several actions are needed for “the full application of the AI Act in the justice area”. Those include targeted guidance on how different tools fall within the AI Act’s risk categories, and targeted funding to support the effective use of AI tools by judicial authorities. McGrath also commits to revisiting the AI Liability Directive, analysing the current divergences of opinion between the co-legislators.

In Other ‘AI & EU’ News 

• A recent statement by the Roundtable of G7 Data Protection and Privacy Authorities — which brings together the authorities of seven countries including Italy, France, the UK, and US — underscored the role of Data Protection Authorities (DPAs) as key figures in the AI governance landscape. It noted their expertise in examining AI issues through the lens of data protection, and called for them to be included by design in the governance of AI technologies. The statement is likely to have particular impact in the EU, as Member States are due to designate market surveillance authorities under the AI Act by August 2025, with many DPAs having put themselves forward as the right authorities to do this.
• Following an open call for expressions of interest, the European Data Protection Board (EDBP) will be holding a closed stakeholder event on AI models on 5 November to gather input as it prepares to respond to an opinion requested by the Irish DPA on the broad issue of artificial intelligence. 
• Earlier this month, the Court of Justice of the European Union (CJEU) ruled that commercial interests can serve as legitimate interests under the General Data Protection Regulation (GDPR). “Legitimate interests” are one of the six legal bases for lawfully processing personal data, and the most commonly used legal basis to justify the processing of personal data for the purposes of AI training. The ruling, well-received by industry, nonetheless recalls that entities must be able to show that the processing is necessary, and carry out a balancing exercise prior to processing to ensure legitimate interests are not overridden by the interests, fundamental rights and freedoms of the data subject. Following the ruling, the EDPB released guidelines on the processing of personal data based on legitimate interests, which are up for public consultation until 20 November.

Content of the Month 📚📺🎧

CDT Europe presents our freshly curated recommended reads for this summer. For more on AI, take a look at CDT’s work. 

• European Trade Union Institute, Policy Brief on Exposing Generative AI
• Mozilla Foundation, External Researcher Access to Closed Foundation Models
• AI Now Institute, Redirecting Europe’s AI Industrial Policy