A Comparison of the Approaches to Generative AI in the US and EU

Generative AI has become a cornerstone of modern technology, with potential applications ranging from content creation and customer service to scientific research and healthcare. However, as these powerful tools proliferate, they present a diverse set of risks and opportunities that require prudent oversight. Two major players in the global landscape, the United States and the European Union, have adopted different approaches to manage generative AI. This article aims to unpack these strategies, emphasizing the balance between innovation and regulation while weaving in the complex risks and rewards associated with this transformative technology.

The US: A Market-Driven and Sector-Specific Approaches to Generative AI

The US is a global leader in approaches to generative AI research and innovation, with many tech giants such as Meta (formerly Facebook), Google, Microsoft, Amazon, and IBM investing heavily in LLMs and generative AI. It is often perceived as a hub of innovation, driven by a free-market ideology that emphasizes deregulation and entrepreneurship. Consequently, the US approach to generative AI has primarily been focused on rapid development and commercialization, enabled by significant investments from both private sectors and public funding, initiatives, and the Advancing American AI Act, coming into force on Dec. 23, 2023. It is true, the US does not have a comprehensive or unified AI regulation or legislation at the federal level – yet: A Blueprint for an AI Bill of Rights has been published. It would thus be an oversimplification to say that the US is not weary and responsive to the significant concerns raised by generative AI.

For example, the Federal Trade Commission (FTC) has issued guidelines for businesses on how to use and approaches to generative AI in a fair and transparent manner, and how to comply with consumer protection laws. Together with other government agencies, the FTC has also warned against the use of deceptive or unfair practices involving AI and emphasized that the full force of existing laws will be utilized to combat the same. The National Institute of Standards and Technology (NIST) has developed standards and frameworks for trustworthy AI, such as the NIST Privacy Framework and the NIST AI Risk Management Framework. The NIST has also launched a program to evaluate the performance of AI models on various tasks and domains.

Most significantly, the Biden administration has recently issued the Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence. (For our piece on how Private AI can help comply with this order, see here.) As an executive order, it is, for the most part, not enforceable. An exception applies to information obligations imposed on companies building the next “potential dual-use foundation models” which requires them to keep the US government informed of training, performance, production details, and much more. For this obligation, the Order draws on the Defense Production Act according to which the President can make orders influencing the domestic industry in matters of national defence. This is a clear sign as to the importance the US assigns to the risks posed by the unsupervised production and implementation of foundation models. How seriously the Biden administration takes AI regulation can further be gleaned from the sweeping scope of the other provisions of the 111 page long Order: Biden takes a swing at practically every conceivable threat area, ranging from synthetic biology over nuclear weapons to access to jobs and housing. Lastly, to give the Order the maximum effect an executive branch is able to, Biden makes federal funding for AI projects conditional upon adherence to the NIST AI Risk Management Framework.

The Order is of great signaling value regarding the importance of AI regulation and does all it can in terms of giving it teeth. Yet, a government informed about the next large AI productions and conditional funding can only do so much; in the end, Congress needs to get involved to effectively regulate this space. Until then, the US's innovation in generative AI remains led by the private sector, especially large tech companies and research institutes. As we know, the US has developed some of the most advanced and influential generative AI systems and LLMs, such as OpenAI's ChatGPT and DALL-E, Google's BERT, and Meta's LLaMA-2 built in partnership with Microsoft and the ensuing competition to release new advancements faster and faster inevitable leads to neglecting safety considerations.

The EU: A Risk-Based and Human-Centric Approaches to Generative AI

The EU is a major player in AI research and innovation, with many academic institutions, research centers, startups, and companies contributing to the field. But it has also adopted a proactive and ambitious approach to regulate and govern AI, aiming to ensure that AI is trustworthy, ethical, and aligned with human values and rights.

One of the key aspects of the EU's proposed regulatory approach to AI is the distinction between high-risk and low-risk applications, based on the potential impact and harm that AI can cause to individuals and society. High-risk applications are those that involve safety-critical domains, such as health, transport, or justice, or that affect fundamental rights, such as privacy, dignity, or non-discrimination. Low-risk applications are those that pose minimal or no risk to human well-being or public interest.

The EU proposes that approaches to generative AI applications should be subject to strict requirements and oversight, such as transparency, accountability, accuracy, security, and human oversight. These requirements aim to ensure that high-risk AI is reliable, robust, and fair, and that it respects the principles of human autonomy and dignity. Low-risk AI applications, on the other hand, should be subject to voluntary codes of conduct and best practices, encouraging innovation and experimentation while fostering trust and responsibility.

About approaches to generative AI in particular, the EU was quick to react to the widely popular ChatGPT and amended its draft AI Act to add provisions that account for the risks that became quickly visible upon broad adoption of the tool. Previously, generative AI would have fallen under the low-risk AI models, left mostly unscrutinised by regulatory authorities. The EU AI Act would come with significant enforcement mechanisms, such as €10 million or for businesses 2% of total worldwide annual turnover, whichever is higher, as well as orders and warnings that can be imposed either instead of or in addition to monetary fines. These may include requiring businesses to cease using the AI system, or training it again from scratch but in a safe manner.

It is no surprise, then, that European companies have come out with tools to render approaches to Generative AI safe, for example Saidot, a generative AI governance tool, Nyonic, an OpenAI competitor focusing on compliance with Europe’s ethical and legal frameworks, ravel, developing homomorphic encryption at scale, Flock, permitting training of ML models with a federated learning approach, and many more.

Conclusion

In contrast to the EU's cautious, regulation-centric approach to AI, the US has adopted a more laissez-faire and market-driven approach, with less emphasis on regulation and more on innovation. The US has not proposed any comprehensive or binding legislation on AI at the federal level, leaving most of the responsibility to the states or the private sector. The US has also focused more on promoting the competitiveness and leadership of its AI industry than on addressing the ethical and social implications of AI, with the important exception of the recent Executive Order that has immense signaling value but less impressive enforceability mechanisms. Concerned about China taking the lead, the US is trying to navigate the difficult balance between accelerating innovation in generative AI and implementing sufficient regulatory safeguards to address ethical and societal risks.

Being mindful of the effect of global markets, there is hope that, in the absence of national regulations, US-based companies will adapt to EU regulations as they may wish to participate in the European market. In the end, we are all in the same boat since national security threats anticipated very clearly by both the US and the EU become global threats very quickly. AI regulation that makes irresponsible development and implementation of AI too expensive by punishing non-compliance in a way that makes a real difference to a company’s bottom line is absolutely required to reign in the frantic competition of shipping the next big AI system whose capabilities we can’t understand and consistently underestimate.

Until we get that, the private industry is called upon to voluntarily implement safety measures. This will not protect us from bad actors doing bad stuff but it will make the good guys even better. One important lever to pull is controlling the training data that is used to develop AI models. Rendering this training data safe – as in free of personally identifiable information (PII) that could be spewed in production and free of identifiers that can lead to biased outputs – has the formidable advantage of carrying through its benefits throughout the entire lifecycle of the AI system. Getting this step right saves you so much trouble down the road. To mention only one example, if you train your model on PII of real individuals who subsequently exercise their right to be forgotten because your model started leaking this information in production, you are facing the basically insurmountable challenge of extracting individual data points from your model. Worst case scenario, you have to retrain your model without that data being included.

Where your use case allows for it, better filter out all the PII and have peace of mind from the start. Private AI’s PII redaction technology uses the latest advancements in machine learning, helping you to minimize the time to identify and redact your data to facilitate privacy protection as well as to avoid biased outputs. Private AI can identify over 50 different entities of PII, PCI, and PHI in over 52 languages. To see the tech in action, try our web demo, or request an API key to try it yourself on your own data.