Experts warn of practical gaps in AI oversight and enforcement

The complexity of compliance

The World AI Regulation Summit in London highlighted a growing concern regarding the complexity of new AI laws. While the European Union (EU) AI Act entered into force in August 2024, its implementation is moving in stages with key obligations starting between 2027 and 2028. Gabriele Mazzini, the lead author of the EU AI Act, noted that the legislation is accompanied by guidance that is already three to four times its own length.

Mazzini argued that broad legal protections can leave companies confused about their actual duties. For example, a lender using AI to judge creditworthiness might be told they need human oversight but won't know what specific level of intervention is enough. This lack of clarity forces businesses to make engineering and compliance choices while they wait for official interpretations or judicial rulings.

To solve this, Mazzini suggested that giving companies more specific requirements could lead to a faster cycle for product development. He noted that while standards can provide this detail, they take time to develop. If standardization moves too slowly, he proposed that regulators should have the capacity to produce their own technical specifications to keep pace with the industry.

Technical hurdles for regulators

Even if laws are clear, regulators may lack the tools to enforce them effectively. Alex Engler, a former White House AI adviser, pointed out that an agency might have the power to interview an employer but not the legal right to see the data or software behind an automated hiring decision. He argued that existing sector regulators may not have the technical capabilities or the computing resources needed to analyze complex algorithms.

Engler emphasized that different AI applications require different types of oversight because they function so differently in reality. He compared algorithms used to set university tuition prices to those used to approve mortgages, noting they should not be governed by the same rules. He advocated for allowing sector-specific regulators to make nuanced judgments about the particular uses of AI within their industries.

The challenge lies in updating older laws to address modern issues like accuracy, robustness, and explainability. However, some officials fear that reopening these older laws could accidentally weaken existing civil rights or consumer protections. Engler suggested that states should introduce their own protections now rather than waiting for federal legislation, even if that makes future federal negotiations more difficult.

Coordinating oversight efforts

The United Kingdom is currently looking at ways to share technical expertise across different regulatory bodies. Lord Chris Holmes of Richmond proposed a statutory authority to coordinate existing UK regulators and identify gaps in oversight. He argued that simply telling existing regulators to oversee AI is not enough to fully empower them with the necessary specialized knowledge.

His proposed bill also includes the idea of designated AI officers and independent audits of business systems. To help companies test these safeguards, Holmes pointed to the use of regulatory sandboxes, which allow firms and regulators to work together on new applications. This approach aims to provide a structured environment for testing before a product hits the wider market.

However, some experts warn against creating a separate AI regulator that might overlap with existing sectoral authorities. Engler questioned how oversight would work if a central tech regulator and a sectoral human resources regulator both tried to oversee the same hiring activity. The goal for many is to find a balance where regulators can share technical support while maintaining clear accountability for the activities they supervise.

The reality of global rules

There is a common fear that strict regulation will drive businesses away to jurisdictions with fewer rules, a concept known as regulatory arbitrage. Lord Holmes challenged this idea, suggesting that clear and proportionate rules can actually give investors more confidence. He argued that investors want to know their intellectual property and investments are protected by a stable legal framework.

Mazzini noted that even with common EU legislation, different political priorities and resources among member states can still lead to inconsistent enforcement. He called for simpler laws and closer alignment of policy and supervision across the bloc to ensure a level playing field. The EU's goal is to limit arbitrage by allowing authorities across different states to act on the same rules.

Ultimately, the success of AI regulation depends on whether the rules can be translated into practical safeguards that businesses can actually implement. For regulators, the test is whether they have the authority, expertise, and resources to determine if those safeguards are working. Governments must understand not only how to write the law but also how to execute it in a practical setting.