The Artificial Intelligence (AI) global regulatory landscape

Policy trends and considerations to build confidence in AI

September 2023

群内每日免费分享5份+最新资料

300T网盘资源+40万份行业报告

为您的创业、职场、商业、投资、亲子、网赚、艺术、健身、心理、个人成长 …… 全面赋能！

关注公众号获取更多资料

添加微信，备
注“入群”
立刻免费领取
200套知识地图+最新研报

致终身学习者社群

行业报告/思维导图/电子书/资讯情报

收钱文案、增长黑客、产品运营、品牌企划、营销战略、办公软件、会计财务、广告设计、摄影修图、视频剪辑、直播带货、电商运营、投资理财、汽车房产、餐饮烹饪、职场经验、演讲口才、风水命理、心理思维、恋爱情趣、美妆护肤、健身瘦身、格斗搏击、漫画手绘、声乐训练、自媒体打造、效率软件工具、游戏影音……

扫码先加好友，以备不时之需

Content

Context 4
Executive summary
Five regulatory trends
Implications for policymakers and companies
Five key regulatory trends
What actions can policymakers and companies take?
Conclusion 14
Authors and acknowledgements
Appendix 16
Endnotes 19

Foreword

The development and use of artificial intelligence (AI) is accelerating across the globe. As a result, policymakers, companies, and other stakeholders are working with increasing urgency to address that AI is integrated in a way that improves its potential to serve important economic and societal objectives, while reducing the risks.

EY teams are focused to help develop the leading-class practices for responsible and trustworthy use of AI through our three-pillar strategy, which we collectively refer to as the Transforming EY, transforming clients and transforming the world. EY teams have recently revised EY AI Principles in 2022 and are advising clients on building their own ethical AI governance frameworks. We draw on our own digital ethicists, IT risk practitioners, data scientists, and subject-matter experts to support clients navigating complex ethical challenges relating to AI.

EY teams recognize, however, that no single organization can tackle this level of change, safely and at speed, without collaboration between the public and private sectors. Most importantly, there is a need for increased dialogue between policymakers and standard setters, the private sector, and civil society to better understand and align interests to close the AI trust gap, prevent policy fragmentation, and realize the full benefits and potential of AI.

This paper is intended to facilitate that process by helping a diverse community of stakeholders better understand and assess the rapidly evolving AI policy landscape in eight key jurisdictions, which include Canada, China, the EU, Japan, Korea, Singapore, the UK, and the US.

Ultimately, if we are all better informed, we can more easily contribute to the development of comparable and interoperable rules across jurisdictions, help to reduce the potential for regulatory arbitrage, and expand the potential for rules that promote the positive use of AI. Companies that are better informed of the dynamic AI policy landscape can also align their AI governance frameworks with the requirements and expectations of regulators in countries where they operate, and in doing so, build trust and confidence in their use of AI. Together, ongoing engagement among government officials, corporate executives, and other stakeholders could help us all strike the right balance between regulation and innovation.

In today’s dynamic economic environment, the global macroeconomic outlook on AI is exceedingly positive. AI is poised to be a key driver of economic growth, innovation, societal change, and competitiveness worldwide. As organizations, governments, and a diverse range of other stakeholders come together on these issues, EY teams will remain focused to serving as a trusted source and providing our perspective around the ever-evolving AI policy landscape.

Carmine Di Sibio EY Global Chairman and CEO

Executive summary

To assess the evolving AI regulatory landscape, EY teams analyzed the regulatory approaches of eight jurisdictions that have a vital role to play in the development of rules for the use of AI. These jurisdictions were selected on the basis of their legislative and regulatory activity around the topic of AI and their broader market reach. They include Canada, China, the European Union (EU), Japan, Korea, Singapore, the United Kingdom (UK) and the United States (US). The rules and policy initiatives were sourced from the Organization for Economic Co-operation and Development (OECD) AI policy observatory1 and are listed in the appendix to this paper. Based on EY teams analysis, we identified five key regulatory trends for policymakers and companies to consider as they work toward enhancing trust in the use of AI.

Five regulatory trends

The eight jurisdictions studied have taken some distinctly different approaches to AI policy, reflecting diverse cultural approaches to regulation generally and AI regulation, in particular. However, where a cohesive objective exists, they follow the same general theme: to reduce the potential harms of AI while simultaneously facilitating its use for the social and economic benefit of their citizens. From that common objective, our review identified five common trends in how these jurisdictions approach AI oversight:

The AI regulation and guidance under consideration is consistent with the core principles for AI as defined by the OECD and endorsed by the G202. These include respect for human rights, sustainability, transparency, and strong risk management.
These jurisdictions are taking a risk-based approach to AI regulation. What that means is that they are tailoring their AI regulations to the perceived risks of AI to core values like privacy, non-discrimination, transparency, and security.
Because of the varying use cases of AI, some jurisdictions are focusing on the need for sector-specific rules, in addition to sector agnostic regulation.
Jurisdictions are undertaking AI-related rulemaking within the context of other digital policy priorities such as cybersecurity, data privacy and intellectual property protection – with the EU taking the most comprehensive approach.
Many of these jurisdictions are using regulatory sandboxes as a tool for the private sector to collaborate with policymakers to develop rules that meet the core objective of promoting safe and ethical AI as well as to consider the implications of higher-risk innovation associated with AI where closer oversight may be appropriate.

Implications for policymakers and companies

Policymakers

The five trends identified in this report can provide useful insights for policymakers as they develop rules for the development and use of AI. EY teams believe these trends represent sound approaches for balancing regulations that improve trust in the use of AI while encouraging responsible innovation.

Besides the identified trends, other factors to consider in AI policy development include:

Whether they have sufficient knowledge to develop policy, regulators have resources to monitor and enforce policy and regulated entities have sufficient knowledge to implement these policies
Whether the intent of rulemaking is to regulate risks arising from the technology itself (e.g., properties such as natural language processing or facial recognition) or from how the AI technology is used (e.g., the application of AI in hiring processes) or both
Whether to extend risk management policies and procedures as well as the responsibility for compliance to third-party vendors that supply AI-related products and services

In addition, policymakers should, to the extent possible, engage in multi-lateral processes to make AI rules among jurisdictions interoperable and comparable in order to minimize the risks associated with regulatory arbitrage – which are particularly significant when considering rules governing the use of a transnational technology like AI.

Companies

For companies, understanding the core principles underlying AI rules, even if those rules may not presently apply to them, can serve to instill trust by customers and regulators in their use of AI and thereby potentially provide a competitive advantage in the marketplace. It can also help companies anticipate the governance needs and compliance requirements that may apply to their development and use of AI, making them more agile.

Based on the identified trends, there are several actions businesses can take now to remain a step ahead of the rapidly evolving AI regulatory landscape. First, they can understand AI regulations that are in effect within the markets in which they operate. They can align their internal AI policies with those regulations and any associated supervisory standards. Second, companies can establish robust and clear governance and risk management structures and protocols, and to the extent where appropriate, accountability mechanisms to enhance how they manage AI technologies. And third, companies can engage in dialogue with public sector officials and others to better understand the evolving regulatory landscape, as well as to provide information and insights that might be useful to policymakers.

Five key regulatory trends

The following section provides deeper insights into the key trends identified in EY teams review of AI approaches taken in the eight jurisdictions reviewed.

Trend 1: The OECD principles for AI serve as a global benchmark for AI guiding policymakers

The AI principles, adopted by the OECD and Group of 20 (G20) in 2019, serve as a global benchmark for helping governments and organizations shape a human-centric approach to trustworthy AI.3 The OECD principles were developed following a heightened period of public discourse starting in 2016 on the core ethical principles that should govern the use of AI. All eight reviewed jurisdictions have committed to the OECD principles, which cover aspects such as ensuring the benefits of AI are widely spread throughout the society, AI does not break societal safeguards such as protection of human rights and that organizations that use AI have in place appropriate governance and accountability.

Figure 1: Summary of OECD AI principles and recommendations to governments

OECD Al principles	OECD recommendations to governments
Al should benefit people and the planet by driving inclusive growth,sustainabledevelopment,and well-being.	Facilitate public and private investment in research anddevelopment to spur innovation in trustworthy Al.
Al systems should be designed in a way that respects the rule of law, humanrights,democratic values,and diversity,and they should include appropriatesafeguards- for example,enabling human intervention where necessary - toensure a fair and just society.	Foster accessible Al ecosystems with digital infrastructure andtechnologies,and mechanisms to share data and knowledge.
There should be transparency and responsible disclosure around Al systemsto ensure that people understand when they are engaging with them and canchallenge outcomes.	Create a policy environment that will open the way to deploymentof trustworthy Al systems.
Al systems must function in a robust,secure,and safe way throughout theirlifetimes,and potential risks should be continually assessed and managed.	Equip people with the skils for Al and support workers to ensure afair transition.
Organizations and individuals developing,deploying or operating Al systemsshould be held accountable for their proper functioning in line with the aboveprinciples.	Co-operate across borders and sectors to share informatin,develop standards and work toward responsible stewardship of Al.

Policymaking initiatives that have already been undertaken by jurisdictions are consistent with these principles. Pending legislation in the EU and Canada, for example, would establish mandatory requirements on risk and data management of high-risk applications of AI such as the use of AI for critical infrastructure or hiring decisions. These requirements are consistent with the OECD principles of accountability and robust, secure, and safe use of AI. The EU is also going beyond the OECD principles by specifying “red lines” for applications of AI that are outright prohibited. For example, EU policymakers are proposing to prohibit the use of AI in areas like facial recognition in public spaces. Other jurisdictions such as the UK, Japan and Singapore are focused on providing guidance to industry that builds on the OECD principles, instead of adopting specific regulations. While China is not an OECD country, the OECD principles provide the basis for the G20 AI Principles that were endorsed by G20 leaders, including China in June 2019.4

In the US, the federal government is taking deliberate but measured steps. For example, key federal officials have stated that existing laws and regulations already provide significant authority to address bias, fraud, anti-competitive behavior, and other potential risks caused by AI. At the same time, the federal policy is considering additional measures where existing authorities may be insufficient to address AI’s potential risks. For example:

• The current administration has set forth a Blueprint for an AI Bill of Rights that reflects many core OECD principles.

• The US National Telecommunications Information Administration has issued a public “request for comment” on how to use audit and assurance to promote trust in AI.

The White House Office of Science and Technology Policy (OSTP) has issued a similar request on updating US national priorities and future actions related to AI and is coordinating much of the federal government’s efforts through the National Artificial Intelligence Initiative Office established by the US Congress in 2020.

Further, the OSTP has announced that it will release a “National AI Research and Development Strategic Plan” aimed at encouraging AI development that “promotes responsible American innovation, serves the public good, protects people’s rights and safety and upholds democratic values.”

While some in the US Congress advocate legislation to establish a separate agency to regulate AI, among other measures, the prospects for Congress passing any significant new laws remain fairly uncertain at this time. Various states governments within the US are also enacting new laws around AI. Dozens of bills have been considered during 2023 state legislative sessions, with some bills being enacted into the law.5

Trend 2: Policymakers are adopting a risk-based approach to AI

Each jurisdiction reviewed is focused on translating AI principles into practice. While their approaches may range from voluntary guidance to mandatory rules, each jurisdiction is pursuing a risk-based approach to AI. In April 2023, The Group of Seven (G7) Digital and Technology Ministers expressed a unified view on artificial intelligence, calling for AI policies and regulations to be “risk-based”. This approach entails tailoring or modulating regulations to the risks posed by specific AI-related activities to strike a sound balance between mitigating risks while encouraging responsible development and use of AI. This approach also allows policymakers to be more responsive to fastmoving AI innovations, enabling them to maintain this critical balance between risks and rewards.

Risk-based approaches assign compliance obligations according to the intended use of the AI system, along with its risk profile. The key benefit of this risk-based approach is that it enables early regulatory intervention while keeping compliance demands and costs proportional to the potential negative impacts.

Some leading examples of risk-based approaches identified in our review include the EU’s AI Act6 and Canada’s AI and Data Act.7 Both proposed Acts use risk and impact assessments to assign AI systems into distinct categories of compliance obligations. The most exhaustive compliance requirements are applied to those systems that are categorized as high-risk, whereas AI systems that are categorized as not posting any significant risk do not need to comply with obligations under these Acts. Countries like the US are also supporting risk-based approaches to AI governance through the development of a voluntary AI risk management framework standard to help organizations incorporate trustworthiness considerations into their AI.8

The following graphic highlights the relative positioning of these countries on taking a regulatory vs. guidelines approach to AI governance:

Figure 2: Approaches to AI rulemaking

EY 2021 report, A Survey of Artificial Intelligence Risk Assessment Methodologies – the Global State of Play and Leading Practices Identified, provides an in-depth assessment of AI risk assessment methodologies and their role in AI regulation.9 Leading practices across jurisdictions and organizations include the categorization of risks (i.e., high, medium, or low) based on the application for which the AI is used rather than the AI technology features alone. Common risks include ethical, governance, communication, and security risks. These risks are also assessed across multiple criteria, such as whether the use of AI impacts the fundamental rights of persons (e.g., risk to health and safety), the number of affected persons and the availability of human alternatives. An existing example of a jurisdictional framework that brings this approach together is the Artificial Intelligence Risk Management Framework (AI RMF 1.0) of the US National Institute of Standards and Technology (NIST). This framework is applicable as a voluntary guide to both policymakers developing risk-based AI regulations as well as to companies as they consider how to organize their internal AI governance.

Figure 3: Overview of US’ NIST AI risk management framework

Trend 3: Policymakers are considering sector-specific considerations in AI oversight

Across the jurisdictions reviewed, there is a recognition that sector-specific considerations need to be factored into AI policymaking because the use of this technology can pose unique or greater risks in certain sectors. For example, additional sector-specific guidance or rules may be warranted for autonomous vehicles deployed on public streets due to higher safety risks. Or, banking regulators may want to consider specific rules related to banks’ use of AI, minimize potential risks that AI may pose to consumer lending (e.g., biased underwriting) or for banks’ safety.

In our review, we found that jurisdictions are already taking a dual approach – that is, both cross-sectoral and sectorspecific. The first, cross-sectoral approach provides for a baseline framework of fundamental safeguards, regardless of the sector in which AI is being developed or used. The second, sector-specific approach establishes additional guidelines or obligations for the use of AI to address risks and vulnerabilities within specific sectors. Singapore’s Model AI Governance Framework, for example, released by the Personal Data Protection Commission, provides sector-agnostic guidance to private organizations to align with Singapore’s guiding principles on the ethical use of AI. In addition to this framework, the Monetary Authority of Singapore (MAS) issued sector-specific guidance for the financial sector on Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of AI and Data Analytics, which was further supplemented by the MAS Veritas initiative to enable financial institutions to evaluate their AI solutions against the FEAT principles.

The following table provides examples of how some reviewed jurisdictions approach both sector-agnostic and sectorspecific policies on AI:

Figure 4: Examples of sector-agnostic and sector-specific policies

Jurisdiction	Sector-agnostic policy	Sector-specific policy
Canada	Artificial Inteligence and Data Act (part of Bill C-27)	Public sector (e.g.,directive on automated decision-making)10
China	Ethical norms for new generationAl11Administrative measures for generative artificialintelligence services (draft)12	Internet information services (e.g., internet information servicealgorithmic recommendation management provisions)13
EU	AI Act	Industrial machinery (e.g.,revision of EU Machinery Directive)14
Japan	Governance guidelines for implementation of Alprinciples15	Industrial plant safety (e.g.,Guidelines on assessment of Al Reliabilityin the Field of Plant Safety)16
Korea	Implementation strategy for trustworthy Al17	City infrastructure improvements (e.g.,Smart City Act)18
Singapore	Model Al Governance Framework19	Financial sector (e.g., MAS FEAT principles)20
UK	Roadmap to an effective Al assurance ecosystem21	Human resources (e.g.,employment practices: monitoring at work draftguidance)22
Us	Blueprint for an AI Billof Rights23	Medical devices (e.g., FDA AI/ML action plan)24

Trend 4: Regulators are increasingly considering how AI impacts other policy areas (e.g., data, cybersecurity and digital content flows)

Our review finds that AI rulemaking is also prompting new policies or new interpretations of existing policies in other areas like data ownership, digital identity, cybersecurity, and digital content flows. The EU has taken the most comprehensive approach with new and anticipated legislation in each of these areas. For example, the EU’s Data Act25 sets rules for fair access and use of the data necessary for AI across all sectors. The EU’s General Data Protection Regulation26 includes rules that address challenges arising from the use of personal data in automated decision making by AI, the EU’s Digital Services Act27 includes provisions on the use of AI for online content access and distribution, and the Cyber Resilience Act28 introduces new safeguards to protect consumers and businesses against increasingly sophisticated AI powered cyber threats.

Beyond the EU, Korea’s Digital New Deal includes a proposed framework for how start-ups can access and share public and private sector data to develop AI while at the same time addressing market concentration concerns in relation to data (whereby the need for access to data concentrates market power among a few data-rich companies).29 In the US, the potential impact of bias in AI systems has led the Consumer Financial Protection Bureau, the Justice Department’s Civil Rights Division, the Equal Employment Opportunity Commission and the Federal Trade Commission to issue a joint statement on enforcement efforts against discrimination and bias in automated systems30 and to the enacting of legislation mandating bias audits for automated employment decision tools by the City of New York31.

Trend 5: Regulators are increasingly using sandboxes to enable the responsible testing of AI innovations

In the EU, Singapore, and UK, regulators are using AI regulatory sandboxes to address the twin challenges of rapid AI development and their own lack of experience with AI technologies. Regulatory sandboxes enable the testing of innovative technologies in a supervised environment, with regulation that may be limited in time and/or scope. This approach has already been used in the FinTech sector to foster public and private sector collaboration. The UK Financial Conduct Authority (UK FCA) has been a leader in this concept, establishing its regulatory sandbox in 2014, and since then it has been replicated in about 40 jurisdictions. There are many benefits of this approach, including the development of more targeted and effective regulation, fostering venture capital investment, facilitating competition, and incentivizing better communication between regulators and participating firms.

The UK FCA is currently testing AI systems in FinTech, while the UK Information Commissioner’s Office (ICO) is testing data privacy within AI. Singapore is among those nations that has also developed a regulatory sandbox similar to that of the UK’s FCA. Specifically, the Singapore Infocomm Media Development Authority and the Personal Data Protection Commission are trialing “AI Verify,” a new RegTech tool designed to assess the trustworthiness of AI systems based on the principles of FEAT (fairness, ethics, accountability, and transparency). In addition, AI sandboxes in Spain, Sweden and Germany are being set up in preparation for implementation of the EU’s AI Act.32

What actions can policymakers and companies take?

Actions for policymakers

The five trends identified in this paper can provide insights to policymakers in the initial stages of developing AI rules and/or guidance, as well as those seeking to understand how their policies compare with others.

Interoperability of global regulations is important for three reasons. First, to reduce costs to companies. Second, to reduce the risk of regulatory arbitrage by ensuring a baseline of consistent, comparable, and effective rules across jurisdictions. Third, to provide consumers of globally operating AI services recognized protection from harm.

Given the complexity of AI, policymakers can ensure sufficient expertise to develop the policy and regulated entities have sufficient expertise to implement that policy effectively. It may take time to identify the need for and to obtain such expertise through guidance, training, processes, governance, and oversight, including enforcement capabilities.

When formulating AI regulations, policymakers may consider clarifying whether the intent of rulemaking is to regulate risks arising from the technology itself (e.g., properties such as natural language processing or facial recognition) or how the AI technology is used (e.g., the application of AI in hiring processes or surveillance). Based on our experience, clarity is essential for companies to realize which AI systems are in scope of a regulation and where to focus their internal oversight processes. Distinguishing between these distinct aspects will improve companies’ ability to comply with the intent of the AI rules and meet regulatory expectations.

Since many companies rely on third-party suppliers for AI, policymakers may consider ensuring that risk management procedures and compliance requirements include considerations for third-party vendor AI, especially when it is used for business-critical operations. Such provisions could include a legislation across an organization’s AI supply chain such as what exists in the EU AI Act33 where specific obligations are identified for providers, distributors, importers, and users of AI systems. Alternatively, governments could create guidelines for organizations on risk and compliance considerations when procuring AI services through third-party suppliers, such as in the US where the NIST created a playbook within the NIST Risk Management Framework for users of third-party vendor AI.34

Actions for companies

To make sure companies are meeting their own expectations and the expectations of investors, regulators, and other stakeholders, it is imperative to understand their legal responsibilities under the laws and regulations of the jurisdictions where they do business and establish policies and procedures designed to meet these responsibilities. They should also consider becoming attuned to the issues raised by leading NGOs and academics.

Given the rapidly evolving nature of AI and the AI regulatory ecosystem, companies will want to consider whether existing obligations may be superseded or amended in the near future. In either case, companies should consider establishing strong AI risk management infrastructures, including governance frameworks, responsibilities, and controls for the use of AI at all levels – from the board to the management and operations. EY teams have developed a Trusted AI framework35, which sets out key steps companies can take to identify, manage, and reduce AI-related risks in order to develop a trusted AI system. Among these steps are having a clear line of accountability to individuals responsible for AI risk management, addressing the AI operator within an organization can explain the AI system’s decision framework and how it works, and the establishment of an AI ethics board to provide independent guidance to management on ethical considerations in AI development and deployment.

Figure 5: Overview of EY teams trusted AI framework

Leading practices for establishing trusted Al ecosystem
1	Al advisory board	Al advisory board is a multi-disciplinary advisory board providing independent advice and guidance on ethical considerationsin Al development.Advisors should be drawn from ethics,law,philosophy,technology,privacy,regulations and science.Theadvisory board should report to and/or be governed by the Board of Directors.
2	Al designstandards	Al ethical design policies and standards for the development of Al, including an Al ethical code of conduct and Al designprinciples.The Ai ethical design standards should define and govern the Al governance and accountability mechanisms tosafeguard users,folow social norms and comply with laws and regulations.
3	Al inventoryand impactassessment	An inventory of all algorithms,including key details of the Al,that is generated using software discovery tools.Each algorithm in the inventory should be subject to an impact assessment to assess the risks involved in its developmentand use.
4	Validation tools	Validation tools and techniques to confirm the algorithms are performing as intended and are producing accurate,fair andunbiased outcomes.These tools can also be used to monitor changes to the algorithm's decision framework.
5	Awarenesstraining	Educating executives and Al developers on the potential legal and ethical considerations for the development of Al,and theirresponsibility to safeguard an impacted users'rights,freedoms and interests.
6	Independentaudits	Undergoing independent Al ethical and design audits by a third-party against your Al and technology policies and standards,and international standards to enhance users' trust in your Al system.An independent audit would evaluate the sufficiency and effectiveness of the governance model and controls across the Allifecycle from problem identification to model training and operation.

Companies may also want to consider engaging with AI policymaking bodies and multi-stakeholder dialogues (including experts in academia and civil society organizations), either directly or through trade associations or similar organizations. These engagements can help them to better understand current regulatory requirements, anticipate potential regulatory developments and – where regulators establish regulatory sandboxes or other means for dialogue – provide input that regulators can use to develop more cost-effective, rational, and effective rules. An EY report from 2020 found that even though policymakers and companies are broadly aligned on the ethical principles relevant to the development and use of AI, there is a pronounced difference in how they prioritize each of those principles.36 An improved public-private sector dialogue will therefore facilitate greater alignment on the aspects of ethical principles around AI as well as policy priorities that will build trust. Ways in which such dialogue can be fostered include engagement with industry groups (e.g., trade associations and regulatory advisory bodies), responding to policy consultations related to AI rulemaking and participation in sandboxes (whether run by regulators or the private sector).

Relativeimportanceof ethicalprinciples
Figure 6: Findings from EY report, bridging AI’s trust gaps – aligning policymakers and companies

Averagedifferenceinweightedrank
Source:EYand TFS survey of policymakers and companies.Chart shows the difference between the average score assigned by policymakers and the average score assigned by companies for each ethical principle. Positive values indicate ethical principles preferred by policymakers; negative values indicate ethical principles preferred by companies.

Conclusion

EY teams hope the trends identified and discussed in this paper can serve governments as they consider the leading approach to oversee and guide the development of AI and do so in a manner that increases the possibility of interoperability across jurisdictions, thereby reducing the potential for regulatory arbitrage. Similarly, we hope that these themes will help companies to consider how best to align their AI governance frameworks with the requirements and expectations of regulators and build public trust. The findings in this paper may also support conversations between companies, policymakers and other stakeholders that lead to governance approaches that strike an appropriate balance between government oversight and innovation. Governments, companies, and others are testing waters and working to find new possibilities that are being enabled by AI. New rules will be needed. Fortunately, as this paper has attempted to show, there is wide agreement among countries on the foundational principles to govern the use of AI. At this unique moment of possibility and peril, now is the time to cooperate on turning those principles into practice.

Authors

EY Technology

Nicola Morini Bianzino
Chief Technology Officer, EY Technology
Ernst & Young LLP
nicola.morini.bianzino@eyg.ey.com

EY Assurance

Marie-Laure Delarue Global Vice Chair, Assurance Ernst & Young LLP marie-laure.delarue@fr.ey.com

EY Public Policy

Shawn Maher
Global Vice Chair, Public Policy
Ernst & Young LLP
shawn.maher@ey.com
Dr. Ansgar Koene
Global AI Ethics and Regulatory Leader
Ernst & Young LLP
ansgar.koene1@be.ey.com
Katie Kummer
Deputy Global Vice Chair, Public Policy
Ernst & Young LLP
catherine.kummer@ey.com
Fatima Hassan-Szlamka
Associate Director, Global Public Policy
Ernst & Young LLP
fatima.hassan@ey.com

Acknowledgements

We would like to thank the following individuals from the EY organization for their contributions: Douglas Bell, Kevin Hannan, Anne McCormick, Bridget Neill, John Hallmark, Yi Y Xie, Cathy Cobey, Richard Jackson, Katie Jaeb, Kelly Devine, and Harvey Lewis.

Appendix

For additional reading and background on the information mentioned and referenced across each jurisdiction throughout this report – The Artificial Intelligence (AI) regulatory landscape: Trends and key considerations to help policymakers and companies drive trust in the use of AI, please see the be appendix sources here:

Canada

Digital Charter Implementation Act 2020. Available at: https://ised-isde.canada.ca/site/innovationbetter-canada/en/canadas-digital-charter/billsummary-digital-charter-implementation-act-2020

Canada’s Digital Charter 2019. Available at: https://ised-isde.canada.ca/site/innovation-bettercanada/en/canadas-digital-charter-trust-digitalworld

Algorithmic Impact Assessment 2019. Available at: https://www.canada.ca/en/government/ system/digital-government/digital-governmentinnovations/responsible-use-ai/algorithmic-impactassessment.html

Directive on Automated Decision-Making 2016. Available at: https://www.tbs-sct.canada.ca/pol/ doc-eng.aspx?id=32592

China

Provisions on the Administration of Algorithm Recommendation of Internet Information Services in China 2022. Available at: http:// www.gov.cn/zhengce/zhengceku/2022-01/04/ content_5666429.htm

Beijing Consensus on Artificial Intelligence and Education 2022. Available at: http://www.moe. gov.cn/jyb_xwfb/gzdt_gzdt/s5987/201908/ W020190828311234688933.pdf

Guiding Opinions on Strengthening Ethical Governance of Science and Technology 2022. Available at: https://digichina.stanford.edu/work/ translation-guiding-opinions-on-strengtheningoverall-governance-of-internet-information-servicealgorithms/

Trustworthy Facial Recognition Applications and Protections Plan 2021. Available at: https:// carnegieendowment.org/2022/01/04/chinas-new-ai-governance-initiatives-shouldn-t-beignored-pub-86127

Ethical Norms for New Generation Artificial Intelligence 2021. Available at: https://cset. georgetown.edu/publication/ethical-norms-fornew-generation-artificial-intelligence-released/

Governance Principles for the New Generation Artificial Intelligence 2021. Available at: https://govt.chinadaily.com.cn/a/201906/17/ WS5d08a7be498e12256565e009.html

White Paper on Trustworthy Artificial Intelligence 2021. Available at: https://cset.georgetown.edu/ publication/white-paper-on-trustworthy-artificialintelligence/

European Union

Artificial Intelligence Act (AIA) 2023. Available at: https://eur-lex.europa.eu/legal-content/ EN/TXT/?qid=1623335154975&uri=CELEX-%3A52021PC0206

Artificial Intelligence Liability Directive (AILD) 2022. Available at: https://commission.europa. eu/business-economy-euro/doing-business-eu/ contract-rules/digital-contracts/liability-rulesartificial-intelligence_en

Bringing the AI Regulation Forward (Spain’s pilot for a Regulatory Sandbox on AI) 2022. Available at: https://digital-strategy.ec.europa.eu/en/events/ launch-event-spanish-regulatory-sandbox-artificialintelligence

Ethics Guidelines for Trustworthy Artificial Intelligence 2022. Available at: https://ieeexplore. ieee.org/document/9803606

Data Governance Act (DGA) 2022. Available at: https://digital-strategy.ec.europa.eu/en/policies/ data-governance-act

Proposal for a Regulation of the European Parliament and of the Council on machinery products. Available at: https://ec.europa.eu/ docsroom/documents/45508

Digital Markets Act (DMA) 2019. Available at: https://commission.europa.eu/strategy-and-policy/ priorities-2019-2024/europe-fit-digital-age/ digital-markets-act-ensuring-fair-and-open-digitalmarkets_en

Digital Services Act (DSA) 2019. Available at: https://commission.europa.eu/strategy-and-policy/ priorities-2019-2024/europe-fit-digital-age/digitalservices-act-ensuring-safe-and-accountable-onlineenvironment_en

Common European Data Spaces 2019. Available at: https://digital-strategy.ec.europa.eu/en/library/ common-european-data-spaces-agriculture-andmobility

General Data Privacy Regulation (GDPR) 2016. Available at: https://gdpr-info.eu/art-22-gdpr/

Global

EY – A survey of Artificial Intelligence risk assessment methodologies 2021. https:// www.trilateralresearch.com/wp-content/uploads/2022/01/A-survey-of-AI-Risk-Assessment-Methodologies-full-report.pdf

EY – Bridging AI’s trust gaps 2020. Available at: https://assets.ey.com/content/dam/ey-sites/eycom/en_gl/topics/ai/ey-bridging-ais-trust-gaps-report.pdf

Organization for Economic Co-operation and Development (OECD AI) Principles 2019. Available at: https://oecd.ai/en/ai-principles

Forty-two countries adopt new OECD Principles on Artificial Intelligence 2019. Available at: https://www.oecd.org/science/forty-two-countries-adopt-new-oecd-principles-on-artificial-intelligence.htm

Japan

Guidelines on Assessment of AI Reliability in the Field of Plant Safety 2020. Available at: https:// www.meti.go.jp/english/press/2021/0330_001. html

Act on the Protection of Personal Information 2020. Available at: https://www.japaneselawtranslation.go.jp/en/laws/view/2781/en

AI Utilization Guidelines 2019. Available at: https://www.soumu.go.jp/main_content/000658284.pdf

Contract Guidelines on Utilization of AI and Data 2019. Available at: https://www.meti.go.jp/english/ press/2019/1209_005.html

Korea

Digital New Deal 2021. Available at: https:// english.moef.go.kr/pc/selectTbPressCenterDtl. do?boardCd=N0001&seq=4948

Implementation strategy for trustworthy AI 2021. Available at: https://www.msit.go.kr/SYNAP/ skin/doc.html?fn=fac7f3d0354f46d0b9934dca6414a196&rs=/SYNAP/sn3hcv/result/

Human-centered national guidelines for AI ethics 2020. Available at: https://www.msit. go.kr/bbs/view.do?sCode=user&mId=113&m-Pid=112&pageIndex=&bbsSeqNo=94&nttSeqNo=3179630&searchOpt=ALL&searchTxt=

National Strategy for Artificial Intelligence 2019. Available at: https://wp.oecd.ai/app/uploads/2021/12/Korea_National_Strategy_for_Artificial_Intelligence_2019.pdf

Ethics Guidelines for Intelligent Information Society 2018. Available at: https://oecd.ai/en/dashboards/policy-initiatives/http:%2F%2Faipo.oecd. org%2F2021-data-policyInitiatives-24386

Smart City Act 2017. Available at: https://smart-city.go.kr/en/%EC%A0%95%EC%B1%85/%EB%B2%95%C2%B7%EC%A0%9C%EB%8F%84/%EC%8A%A4%EB%A7%88%ED%8A%B8%EB%8F%84%EC%8B%9C-%EB%B2%95%EB%A0%B9/

Singapore

AI Governance Testing Framework Minimum Viable Product 2022. Available at: https://www.pdpc.gov. sg/news-and-events/announcements/2021/07/developing-the-mvp-for-ai-governance-testing-framework

InfoComm Media Development Authority Artificial Intelligence in Singapore 2022. Available at: https://www.imda.gov.sg/AI

AI Ethics and Governance Body of Knowledge 2020. Available at: https://www.scs.org.sg/ai-ethics-bok

National AI Strategy 2019. Available at: https:// www.smartnation.gov.sg/initiatives/artificial-intelligence/

Advisory Council on the Ethical Use of AI and Data 2018. Available at: https://cms-lawnow.com/en/ ealerts/2018/07/singapore-to-form-advisory-council-for-ethical-use-of-ai

Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the use of Artificial Intelligence and Data Analytics in Singapore’s Financial Sector 2018. Available at: https://www. mas.gov.sg/publications/monographs-or-information-paper/2018/FEAT

Road Traffic (Autonomous Motor Vehicles) Rules 2017. Available at: https://sso.agc.gov.sg/SL/ RTA1961-S464-2017?DocDate=20170823

United Kingdom

Establishing a pro-innovation approach to regulating AI 2022. Available at: https://www.gov.uk/ government/publications/establishing-a-pro-innovation-approach-to-regulating-ai

Employment practices: monitoring at work draft guidance 2022. Available at: https://ico.org.uk/ media/about-the-ico/consultations/4021868/ draft-monitoring-at-work-20221011.pdf

Safe use rules for automated vehicles 2022. Available at: https://www.gov.uk/government/consultations/safe-use-rules-for-automated-vehicles-av

National AI Strategy 2021. Available at: https:// www.gov.uk/government/publications/national-ai-strategy

Roadmap to an effective AI assurance ecosystem 2021. Available at: https://www.gov.uk/government/publications/the-roadmap-to-an-effective-ai-assurance-ecosystem

Guidance on AI and data protection 2020. Available at: https://ico.org.uk/for-organisations/ guide-to-data-protection/key-dp-themes/guidanceon-ai-and-data-protection/

Guidelines for AI procurement 2020. Available at: https://www.gov.uk/government/publications/ guidelines-for-ai-procurement/guidelines-for-ai-procurement

Guide to using Artificial Intelligence in the public sector 2019. Available at: https://www.gov.uk/ government/collections/a-guide-to-using-artificial-intelligence-in-the-public-sector

ICO Regulatory Sandbox 2019. Available at: https://ico.org.uk/for-organisations/regulatory-sandbox/

Data trusts initiative 2018. Available at: https:// datatrusts.uk/

United States

Blueprint for an AI Bill of Rights 2022. Available at: http://www.whitehouse.gov/ostp/ai-bill-of-rights

Artificial Intelligence and algorithmic fairness initiative 2022. Available at: https://www. eeoc.gov/laws/guidance/americans-disabilities-act-and-use-software-algorithms-and-artificial-intelligence

NIST AI risk management framework 2023. Available at: https://www.nist.gov/itl/ai-risk-management-framework

NIST Principles for Explainable AI 2021. Available at: https://www.nist.gov/system/files/documents/2020/08/17/NIST Explainable AI Draft NISTIR8312 %281%29.pdf

FDA Artificial Intelligence/machine learning action plan 2021. Available at: https://www.fda.gov/newsevents/press-announcements/fda-releases-artificial-intelligencemachine-learning-action-plan

Automated employment decision tools 2021. Available at: https://legistar.council.nyc.gov/LegislationDetail.aspx?ID=4344524&GUID=B051915D-A9AC-451E-81F8-6596032FA3F9

Artificial Intelligence and machine learning (AI/ML) Software as a medical device action plan 2021. Available at: https://www.fda.gov/medical-devices/ software-medical-device-samd/artificial-intelligence-and-machine-learning-software-medical-device

Face recognition vendor test for use in the public sector 2020. Available at: https://www.nist. gov/programs-projects/face-recognition-vendor-test-frvt

Endnotes

OECD’s live repository of AI strategies and policies - OECD.AI, https://oecd.ai/en/dashboards/overview, January 2023-2024.
Group of 20 – forum for international economic cooperation, https://www.g20.org/en/about-g20/#overview, January 2023.
The OECD Artificial Intelligence (AI) Principles - OECD.AI, https://oecd.ai/en/ai-principles, May 2019.
Artificial Intelligence and Corporate Social Responsibility, SSRN, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3873097, July 2021.
Artificial Intelligence 2023 Legislation, US National Conference of State Legislators (NCSL), https://www.ncsl.org/technology-andcommunication/artificial-intelligence-2023-legislation, July 2023.
The Artificial Intelligence Act, The European Union, https://artificialintelligenceact.eu, September 2023.
Digital Charter Implementation Act, Parliament of Canada, https://www.parl.ca/LegisInfo/en/bill/44-1/C-27, November 2021.
AI Risk Management Framework, National Institute of Standards and Technology, US Department of Commerce, https://airc.nist. gov/AI_RMF_Knowledge_Base/AI_RMF, March 2023.

A survey of AI Risk Assessment Methodologies, Trilateral Research, https://www.trilateralresearch.com/wp-content/ uploads/2022/01/A-survey-of-AI-Risk-Assessment-Methodologies-full-report.pdf, December 2022.

Directive on Automated Decision-Making, Government of Canada, https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592, April 2023.
Ethical Norms for New Generation Artificial Intelligence Released, Georgetown University Center for Security and Emerging Technology, https://cset.georgetown.edu/publication/ethical-norms-for-new-generation-artificial-intelligence-released, October 2021.
Measures for the Administration of Generative Artificial Intelligence Services, Cyberspace Administration of China, http://www. cac.gov.cn/2023-04/11/c_1682854275475410.htm, April 2023.
Internet Information Service Algorithmic Recommendation Management Provisions, Stanford University, https://digichina. stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effectivemarch-1-2022, March 2022.
Proposal for a Regulation of the European Parliament and of the Council on machinery products, https://ec.europa.eu/docsroom/ documents/45508, April 2021.
“Governance Guidelines for Implementation of AI Principles Ver. 1.1” Compiled, Japan Ministry of Economy, Trade and Industry (METI), https://www.meti.go.jp/english/press/2022/0128_003.html, January 2022.
Guidelines on Assessment of AI Reliability in the Field of Plant Safety Revised, Japan Ministry of Economy, Trade and Industry (METI), https://www.meti.go.jp/english/press/2021/0330_001.html, March 2021.
Strategy for Realizing Reliable Artificial Intelligence”, Korea Ministry of Science and ICT, https://www.msit.go.kr/SYNAP/skin/doc. html?fn=fac7f3d0354f46d0b9934dca6414a196&rs=/SYNAP/sn3hcv/result, May 2021.
Smart City Law, SMART CITY KOREA, https://tinyurl.com/y3cazwv4, July 2019.
Artificial Intelligence, Singapore Infocomm Media Development Authority, https://www.imda.gov.sg/about-imda/emergingtechnologies-and-research/artificial-intelligence, January 2020.
Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore’s Financial Sector, Monetary Authority of Singapore, https://www.mas.gov.sg/publications/monographs-orinformation-paper/2018/feat, November 2018.
The roadmap to an effective AI assurance ecosystem, UK Department for Science, Innovation and Technology, https://www.gov. uk/government/publications/the-roadmap-to-an-effective-ai-assurance-ecosystem, December 2021.
Employment practices: monitoring at work draft guidance, UK Information Commissioner’s Office, https://ico.org.uk/media/aboutthe-ico/consultations/4021868/draft-monitoring-at-work-20221011.pdf, October 2022.
Blueprint for an AI Bill of Rights, The White House, https://www.whitehouse.gov/ostp/ai-bill-of-rights/what-is-the-blueprint-for-anai-bill-of-rights, October 2022.
Artificial Intelligence/Machine Learning Action Plan, U.S. Food and Drug Administration, https://www.fda.gov/news-events/pressannouncements/fda-releases-artificial-intelligencemachine-learning-action-plan, January 2021.
Data Act, Shaping Europe’s digital future, EU Commission, https://digital-strategy.ec.europa.eu/en/policies/data-act, February 2022.
Regulation (EU) 2016/679 of The European Parliament And of the Council, https://eur-lex.europa.eu/legal-content/EN/ TXT/?uri=CELEX%3A02016R0679-20160504, April 2016.
The Digital Services Act: ensuring a safe and accountable online environment, EU Commission, https://commission.europa. eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-services-act-ensuring-safe-and-accountable-onlineenvironment_en, October 2022.
EU Cyber Resilience Act | Shaping Europe’s digital future, EU Council. https://digital-strategy.ec.europa.eu/en/policies/cyberresilience-act, September 2022.
Korean New Deal, Division Development Finance Bureau - Green Climate Policy Division, https://tinyurl.com/3p4twdd6, July 2020.
Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems, US Equal Employment Opportunity Commission, https://www.eeoc.gov/joint-statement-enforcement-efforts-against-discrimination-and-bias-automatedsystems, April 2023.
A Local Law to amend the administrative code of the city of New York, in relation to automated employment decision tools, The New York City Council, https://tinyurl.com/mrxdsxm6, December 2021.
Launch event for the Spanish Regulatory Sandbox on Artificial Intelligence – Shaping Europe’s digital future, EU Commission, https://digital-strategy.ec.europa.eu/en/events/launch-event-spanish-regulatory-sandbox-artificial-intelligence, June 2022.
EU AI Act – Chapter 3 “obligations of providers and user of high-risk AI systems and other parties”, The EU, https://eur-lex.europa. eu/legal-content/EN/TXT/?uri=celex%3A52021PC0206, April 2021.
AI Risk Management Framework Playbook – Chapters 6.1 and 6.2 address AI risks associated with third-party entities, National Institute of Standards and Technology, US Department of Commerce, https://airc.nist.gov/AI_RMF_Knowledge_Base/Playbook/ Govern#Govern%206.1, January 2023.
EY AI risk management platform, EY, https://www.ey.com/en_us/consulting/trusted-ai-platform, October 2019.
Bridging AI’s trust gaps – Aligning policymakers and companies, EY, https://www.ey.com/en_us/ai/how-can-building-trust-in-aiaccelerate-your-transformation, July 2020.

EY | Building a better working world

EY exists to build a better working world, helping to create longterm value for clients, people and society and build trust in the capital markets.

Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.

Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.

EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. Information about how EY collects and uses personal data and a description of the rights individuals have under data protection legislation are available via ey.com/ privacy. EY member firms do not practice law where prohibited by local laws. For more information about our organization, please visit ey.com.

ED None. EYG no. 008887-23Gbl

This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, legal or other professional advice. Please refer to your advisors for specific advice. ey.com

EY+人工智能的全球监管格局-英-21页-WN10