EU strikes deal to regulate ChatGPT, AI tech

Original Article ↗ Hacker News Discussion ↗

EU lawmakers have reached a political deal on the AI Act, a landmark framework that would tightly regulate “high‑risk” uses of artificial intelligence such as biometric surveillance, social scoring, and systems that manipulate vulnerable people, while imposing transparency and registration duties on powerful foundation models. Commenters broadly support curbs on mass surveillance and opaque decision-making, but are sharply divided over whether regulating underlying models and open source tools will protect citizens or simply drive AI innovation and investment out of Europe. Many compare the move to GDPR: a well‑intentioned attempt to rein in tech giants that may also raise compliance costs, entrench large incumbents, and leave EU users reliant on foreign platforms.

Status of the AI Act / Text Availability

  • Several commenters note the “deal” is political, not final law; the exact legislative text and amendments were not yet public.
  • Some confusion over whether the law is “passed”; consensus in the thread: a compromise exists but legal drafting, translation, and formal votes are still pending.

Scope and Definition of “AI”

  • EU approach is risk‑ and use‑based (e.g., “high‑risk” systems like law enforcement, asylum decisions, etc.), not tied only to machine learning.
  • Annex-style definitions cited: AI includes machine learning, rule‑based/expert systems, logic‑based systems, and statistical/search/optimization methods.
  • Debate over terminology: some argue this makes “every program ever made” AI; others respond that the law regulates sensitive uses regardless of technique.

Biometrics, Social Scoring, and Manipulation

  • High‑risk/forbidden areas include: live facial recognition (with narrow law‑enforcement exceptions), biometric categorization by sensitive traits (race, sex orientation, religion, political beliefs), social scoring, and cognitive/behavioral manipulation.
  • Dispute over banning automatic race/trait detection:
    • Critics say it’s impractical, undermines useful analytics, and will push systems to infer traits indirectly.
    • Supporters argue automatic profiling by sensitive attributes is inherently dangerous and often already illegal when done manually.
  • Similar concerns around mass surveillance, predictive policing, and social scoring, with references to China and real scandals in Europe and elsewhere.

Regulation vs Innovation / EU Competitiveness

  • Strong split:
    • Critics: EU is “regulating itself out of the market,” repeating or amplifying the pattern seen with big internet platforms; small companies may geoblock the EU, delay launches, or avoid the market entirely; fear of regulatory capture by large incumbents.
    • Supporters: tech with large externalities (surveillance, discrimination, manipulation) must be constrained; better to act early than repeat the social‑media experience; some explicitly prefer slower innovation to unregulated harm.
  • Discussion of Europe’s broader tech lag (US‑dominated platforms, capital pools, fragmented markets) and whether regulation is cause or symptom.

Foundation Models, Open Source, and Documentation

  • Negotiations around “foundation models” were contentious.
  • Reported compromise: restrictions and transparency duties for powerful foundation models, but broad exemptions/advantages for open‑source models.
  • Some welcome this as protection against big‑company lock‑in and “black box” systems; others fear mandatory registration and documentation for foundation models is akin to reviving “code as munitions”‑style control.
  • Disagreement whether this will strengthen or chill FOSS; unclear how “training” vs “fine‑tuning” will be distinguished in practice.

Liability, Black Boxes, and High‑Risk Uses

  • Many argue the core issue is accountability: entities deploying systems that make life‑altering decisions (credit, welfare, policing, asylum, medical triage) must be fully responsible and able to explain outcomes.
  • Cited past harms (algorithmic discrimination, welfare scandals, biased health and hiring tools) are used as justification for explicit AI rules beyond generic data‑protection law.
  • Counter‑view: existing laws on discrimination and data processing (e.g., GDPR) should suffice; adding AI‑specific layers risks overreach and bureaucratic burden.

GDPR Analogy and Implementation Concerns

  • Some see this becoming “the new GDPR”: large firms can absorb compliance; small sites/products may block EU users.
  • Others respond that GDPR compliance is easy if you simply avoid invasive tracking; the “cookie banner hell” is portrayed as malicious or political design, not mandated by the law.
  • Similar fear that AI rules will be obeyed minimally and adversarially, producing bad UX and defensive legalism rather than genuine safety.

Copyright, Training Data, and Property Rights

  • A subset argues models should be illegal to sell unless their training data is licensed and provable; others reply this inverts burden of proof and would criminalize most current approaches.
  • Side debate on abolishing or weakening copyright vs. defending it as essential for cultural production; no consensus.

Meta‑level Concerns

  • Underlying philosophical split:
    • One camp distrusts corporations, favors stronger regulation, and sees AI as another domain requiring public control.
    • The other distrusts states and EU bureaucracy, fears creeping control and innovation strangulation, and would prefer focusing solely on harmful uses rather than the technology itself.